16950 matches found
PT-2025-17511 · Creativemindssolutions · Cm Answers
Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM Answers versions through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions through 3.3.3, update to a version that...
Security Bulletin: NVIDIA App - April 2025
NVIDIA has released a software update for the NVIDIA App. To protect your system, download and install the latest version of NVIDIA App from the NVIDIA App site. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update addresses...
PT-2025-17494 · Unknown · Brecht Custom Related Posts
Name of the Vulnerable Software and Affected Versions: Brecht Custom Related Posts versions n/a through 1.7.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...
WordPress wProject Theme < 5.8.0 is vulnerable to Privilege Escalation
Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39366 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dc57f98abe0c Credits Dave Jong Patchstack Required privileg...
PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce
Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...
PT-2025-17517 · Unknown · Ataur R Gutenkit
Name of the Vulnerable Software and Affected Versions: Ataur R GutenKit versions through 2.2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...
Cross-Site Scripting
yiisoft/yii is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to in specific scenarios where the fallback error renderer is used, allowing an attacker to execute arbitrary scripts in the context of the user’s browser...
GoBGP crashes in the flowspec parser
An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...
GoBGP does not verify that the input length
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...
GHSA-C5JG-WR5V-2WP2 GoBGP does not verify that the input length
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...
GoBGP does not properly check the input length
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...
PT-2025-17470 · Ibm · Ibm Maximo Asset Management
Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6.1.3 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a...
CVE-2025-28104
Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input...
WordPress CiyaShop Theme <= 4.18.0 is vulnerable to PHP Object Injection
Software CiyaShop Type Theme Vulnerable versions = 4.18.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39349 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 68a2f2e9e8f8 Credits Bonds Required privilege Unauthenticated Publishe...
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...
CVE-2025-43961
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser...
PT-2025-17414 · Markdown · Qmarkdown
Name of the Vulnerable Software and Affected Versions: QMarkdown aka quasar-ui-qmarkdown versions prior to 2.0.5 Description: The issue allows for XSS via headers, even when the no-html option is set. This could potentially lead to malicious script execution. Recommendations: For versions prior t...
PT-2025-17426 · Gobgp +4 · Gobgp +4
Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: An issue was discovered that allows an attacker to cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. Recommendations: For versions prior...