WordPress Buddypress Force Password Change plugin <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update vulnerability

Authenticated Subscriber+ Account Takeover via Password Update vulnerability discovered by kr0d in WordPress Plugin Buddypress Force Password Change versions = 0.1...

MAL-2025-3373 Malicious code in @sporta-technology/rn-components.text-input (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3366 Malicious code in @sporta-technology/d11-web-components.toggle (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3361 Malicious code in @sporta-technology/d11-web-components.tags.tags-status (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3359 Malicious code in @sporta-technology/d11-web-components.tags.tags (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3343 Malicious code in @sporta-technology/d11-web-components.radio (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3342 Malicious code in @sporta-technology/d11-web-components.progress-line (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3340 Malicious code in @sporta-technology/d11-web-components.popout (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3339 Malicious code in @sporta-technology/d11-web-components.pagination (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3301 Malicious code in @medibank-lib/medi-analytics (npm)

--- -= Per source details. Do not edit below this line.=-...

Stack Based Buffer Overflow

org.jsonschema2pojo, jsonschema2pojo-core is vulnerable to Stack-based buffer overflow. The vulnerability is due to improper input validation in the apply function of the SchemaRule.java file, allows attackers to exploit the function, leading to a stack-based buffer overflow...

PT-2025-17706 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.6 through 17.9.7 GitLab EE/CE versions 17.10 through 17.10.5 GitLab EE/CE versions 17.11 through 17.11.1 Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing...

PT-2025-17599 · Axis · Axis Camera Station Pro

Name of the Vulnerable Software and Affected Versions: AXIS Camera Station Pro affected versions not specified Description: A non-admin user can remove system files, causing a boot loop, by redirecting a file deletion when recording video. Recommendations: At the moment, there is no information...

Q4 Investor Relations Platform 安全漏洞

Q4 Investor Relations Platform is an investor relations platform from Q4 Canada. A security vulnerability exists in Q4 Investor Relations Platform version v5.147.1.2, which stems from an unfiltered input to the SearchTerm parameter in the search function, and could lead to a cross-site scripting...

PT-2025-17656 · Drupal · Drupal Colorbox

Name of the Vulnerable Software and Affected Versions: Drupal Colorbox versions 0.0.0 through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...

GO-2025-3621 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

CVE-2025-3767 SQL Injection in Centreon BAM boolean KPI listing

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...

PT-2025-17535 · Crocoblock · Jetwoobuilder

Name of the Vulnerable Software and Affected Versions: JetWooBuilder versions 2.1.18 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For JetWooBuilder versions 2.1.18 an...

PT-2025-17582 · Unknown · Dpmadirektpro

Name of the Vulnerable Software and Affected Versions: DPMAdirektPro version 4.1.5 Description: The issue allows for DLL Hijacking by placing a malicious DLL in a directory, which is then loaded by the application instead of the legitimate DLL. This results in the malicious DLL loading with the...

PT-2025-17515 · Unknown · Vikrestaurants Table Reservations/Take-Away

Name of the Vulnerable Software and Affected Versions: VikRestaurants Table Reservations and Take-Away versions 1.3.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.3.3 and earlier,...