PT-2025-17531 · David Gwyer +1 · Simple Sitemap – Create A Responsive Html Sitemap +1

Name of the Vulnerable Software and Affected Versions: Simple Sitemap – Create a Responsive HTML Sitemap versions 3.5.14 and earlier Description: A Missing Authorization issue affects the Simple Sitemap plugin. This issue may allow unauthorized access. Recommendations: For Simple Sitemap – Create...

PT-2025-17528 · Caseproof · Memberpress

Name of the Vulnerable Software and Affected Versions: Memberpress versions 1.11.37 and earlier Description: The issue affects the Memberpress plugin, allowing for Reflected Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation. Recommendations:...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

PT-2025-17494 · Unknown · Brecht Custom Related Posts

Name of the Vulnerable Software and Affected Versions: Brecht Custom Related Posts versions n/a through 1.7.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

Security Bulletin: NVIDIA App - April 2025

NVIDIA has released a software update for the NVIDIA App. To protect your system, download and install the latest version of NVIDIA App from the NVIDIA App site. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update addresses...

PT-2025-17482 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.0.0-00 through 11.0.0-04 Hitachi Ops Center Analyzer viewpoint OVF versions 10.0.0-00 through 11.0.0-04 Description: The issue is related to an authentication credentials leakage. This means that...

PT-2025-17511 · Creativemindssolutions · Cm Answers

Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM Answers versions through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions through 3.3.3, update to a version that...

WordPress wProject Theme < 5.8.0 is vulnerable to Privilege Escalation

Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39366 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dc57f98abe0c Credits Dave Jong Patchstack Required privileg...

PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...

PT-2025-17517 · Unknown · Ataur R Gutenkit

Name of the Vulnerable Software and Affected Versions: Ataur R GutenKit versions through 2.2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

Cross-Site Scripting

yiisoft/yii is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to in specific scenarios where the fallback error renderer is used, allowing an attacker to execute arbitrary scripts in the context of the user’s browser...

GoBGP does not verify that the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

GoBGP crashes in the flowspec parser

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

GHSA-C5JG-WR5V-2WP2 GoBGP does not verify that the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

GoBGP does not properly check the input length

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

PT-2025-17470 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6.1.3 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a...

CVE-2025-28104

Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input...

WordPress CiyaShop Theme <= 4.18.0 is vulnerable to PHP Object Injection

Software CiyaShop Type Theme Vulnerable versions = 4.18.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39349 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 68a2f2e9e8f8 Credits Bonds Required privilege Unauthenticated Publishe...