GO-2025-3683 Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf

Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf...

Mattermost Fails to Verify User's Permissions When Accessing Groups

Mattermost versions 10.5.x = 10.5.2, 9.11.x = 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request...

GHSA-M32F-FJW2-37V3 Bullfrog's DNS over TCP bypasses domain filtering

Summary Using tcp breaks blocking and allows DNS exfiltration. PoC name: test on: push: branches: - "" jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses:...

GHSA-QGWX-RFFP-6CX9 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures

Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost...

CVE-2025-27524 Weak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager

Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06...

BELL-CVE-2025-24495

Bulletin has no description...

BELL-CVE-2023-53146

Bulletin has no description...

BELL-CVE-2024-45332

Bulletin has no description...

BELL-CVE-2025-20012

Bulletin has no description...

MAL-2025-3824 Malicious code in custom-social-connections (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63d17fbe69636024ad8599ea6675d12b5c1473dcee490a3f63f3bc80a0ad7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-Site Scripting (XSS)

@lumieducation/h5p-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the omission of the sanitizeHtml function call for plain text strings, which allows attackers to inject malicious HTML or JavaScript code...

PT-2025-21351 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting an unknown part of the file /pages/stockin add.php. The manipulation of the prod name argument leads to SQL injection. It is...

PT-2025-21349 · WordPress · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions 3.5.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially...

PT-2025-21262 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions prior to 2.1 Description: The issue allows an authenticated regular user to access sensitive application secrets. This is achieved via the "/api/v1/settings" endpoint. Recommendations: For versions prior to 2.1,...

PT-2025-21461 · WordPress · The Gdpr Framework By Data443

Name of the Vulnerable Software and Affected Versions: The GDPR Framework By Data443 WordPress plugin versions prior to 2.2.0 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2025-21583 · Meteor · Meteor

Name of the Vulnerable Software and Affected Versions: Meteor versions up to 3.2.1 Description: A vulnerability was found in the function Object.assign of the file packages/ddp-server/livedata server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression...

PT-2025-21398 · Unknown · Mb Custom Post Types & Custom Taxonomies

Name of the Vulnerable Software and Affected Versions: MB Custom Post Types & Custom Taxonomies versions prior to 2.7.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21361 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions 2.5.13 and earlier Description: Emlog is an open source website building system. The system has a deserialization issue. A user can create a carefully crafted nickname, causing str replace to replace the value of name orig with...

The vulnerability of the Substance 3D Stager software lies in the possibility of an operation going beyond the buffer boundaries in memory, allowing a hacker to execute arbitrary code.

The vulnerability of the Substance 3D Stager software-related 3D design software is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2025-21524 · Unknown · Quiz Maker

Name of the Vulnerable Software and Affected Versions: Quiz Maker versions prior to 6.5.9.9 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape some of its...