PT-2025-16133 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - Wikibase Media Info Extension versions 1.39 through 1.43 Description: The issue is related to Improper Input Validation, which allows Cross-Site Scripting XSS. This exposes systems to XSS risk. Recommendations: For versions 1.39...

PT-2025-16070 · Unknown · Easy Post Duplicator

Name of the Vulnerable Software and Affected Versions: Easy Post Duplicator versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

CVE-2025-32700

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php,...

CVE-2025-2408 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information...

WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Coming Soon Countdown versions = 2.2...

CVE-2025-32116

CVE-2025-32116 is a reflected XSS vulnerability in the WordPress plugin QR Master. The connected Wordfence WordPress vulnerability report lists QR Master (affected through version 1.0.5) with the issue described as improper neutralization of input during web page generation, enabling reflected cr...

CVE-2025-2805

CVE-2025-2805 is an unauthenticated arbitrary shortcode execution in the ORDER POST WordPress plugin (versions up to 2.0.2). The root cause is improper validation before running do_shortcode, enabling attackers to execute arbitrary shortcodes. Wordfence & the CVE entry list this as a high-severit...

BELL-CVE-2025-31498

Bulletin has no description...

IP Address Spoofing

github.com/phires/go-guerrilla is vulnerable to IP address spoofing. The vulnerability is due to improper enforcement of the PROXY protocol due to the server accepting multiple PROXY commands, allowing clients to override the original IP address...

Remote Code Execution (RCE)

github.com/jaredallard/archives is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper archive parsing due to insufficient validation of specially crafted archive files, which allows an attacker to execute arbitrary code or modify files in the context of the user running...

SS-2025-001 - User enumeration via timing attack

More info at https://www.silverstripe.org/download/security-releases/ss-2025-001...

PT-2025-16016

Name of the Vulnerable Software and Affected Versions Arm Ltd Valhall GPU Kernel Driver versions r29p0 through r53p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r53p0 TP-Link Smart Hub versions prior to an unspecified fixed version Description A Use After Free issue ...

PT-2025-23104

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave...

WordPress Customify Theme <= 0.4.8 is vulnerable to Broken Access Control

Software Customify Type Theme Vulnerable versions = 0.4.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-26920 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6338c0e15242 Credits Fariq Fadillah Gusti Insani Required...

PT-2025-15962 · Sharethis · Sharethis Dashboard For Google Analytics

Name of the Vulnerable Software and Affected Versions: ShareThis Dashboard for Google Analytics versions 3.2.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2025-15988 · Unknown · Codeastro Internet Banking System

Name of the Vulnerable Software and Affected Versions: Code Astro Internet Banking System version 2.0.0 Description: A Remote Code Execution RCE vulnerability exists due to improper file upload validation in the profile pic parameter within pages view client.php. Recommendations: Code Astro...

PT-2025-15986 · Ibm · Ibm Maximo Application Suite

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite versions 8.11 through 9.0 Description: The issue is related to improper input validation, allowing an authenticated user to perform unauthorized actions. Recommendations: For versions 8.11 through 9.0, update to a...

PT-2025-20730 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: The issue concerns a remote code execution vulnerability in the formSafeEmailFilter function. This allows for unauthorized execution of code, potentially leading to security breaches. Recommendations:...

WordPress Embedder plugin 1.3-1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by kr0d in WordPress Plugin Embedder versions 1.3-1.3.5...