i-PRO Configuration Tool vulnerable to use of hard-coded cryptographic key

Overview i-PRO Configuration Tool provided by i-PRO Co., Ltd. contains a vulnerability below. Use of hard-coded cryptographic key CWE-321 Diego Giubertoni of Nozomi Networks Inc. reported this vulnerability to i-PRO Co., Ltd. and coordinated. After the coordination was completed, i-PRO Co., Ltd...

PT-2025-17776 · Zoho · Zoho Creator Forms

Name of the Vulnerable Software and Affected Versions: Zoho Creator Forms versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in Zoho Creator Forms...

JVN#84627857: i-PRO Configuration Tool vulnerable to use of hard-coded cryptographic key

i-PRO Configuration Tool provided by i-PRO Co., Ltd. contains a vulnerability below. Use of hard-coded cryptographic key CWE-321 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Base Score: 6.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Base Score: 5.5 CVE-2025-32730 Impact...

PT-2025-17821 · Unknown · Twitter Card Generator

Name of the Vulnerable Software and Affected Versions: Twitter Card Generator versions 1.0.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Twitter Card Generator. Recommendations: For Twitter Card Generator versions...

PT-2025-17742 · Everest Themes · Everestthemes Grace Mag

Name of the Vulnerable Software and Affected Versions: everestthemes Grace Mag versions 1.1.5 and earlier Description: The issue affects the everestthemes Grace Mag, allowing for PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known ...

PT-2025-17841 · Xpert Tab · Xpert Tab

Name of the Vulnerable Software and Affected Versions: Xpert Tab versions 1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

OPENSUSE-SU-2025:15025-1 libraw-devel-0.21.4-1.1 on GA media

These are all security issues fixed in the libraw-devel-0.21.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-17836 · Unknown · Danielriera Image Style Hover

Name of the Vulnerable Software and Affected Versions: DanielRiera Image Style Hover versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS in DanielRiera...

PT-2025-17788 · Unknown · Djjmz Social Counter

Name of the Vulnerable Software and Affected Versions: djjmz Social Counter versions 2.0.5 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 2.0.5 and earlier, update to a version that contains a fix fo...

PT-2025-17775 · Unknown · Olav Kolbu Google News

Name of the Vulnerable Software and Affected Versions: Olav Kolbu Google News versions n/a through 2.5.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-17774 · Unknown · Syed Balkhi Floating Social Bar

Name of the Vulnerable Software and Affected Versions: Syed Balkhi Floating Social Bar versions 1.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-17814 · Unknown · Kasonzhao Advanced Lazy Load

Name of the Vulnerable Software and Affected Versions: kasonzhao Advanced lazy load versions 1.6.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-17791 · WordPress · Wp Customize Login Page

Name of the Vulnerable Software and Affected Versions: WP Customize Login Page versions 1.6.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17865 · Albedo Telecom · Albedo Telecom Net.Time

Name of the Vulnerable Software and Affected Versions: ALBEDO Telecom Net.Time - PTP/NTP clock Serial No. NBC0081P version 1.4.4 Description: The issue is related to an insufficient session expiration, which could allow an attacker to transmit passwords over unencrypted connections, resulting in...

PT-2025-17829 · Msmitley · Wp Cookie Consent

Name of the Vulnerable Software and Affected Versions: msmitley WP Cookie Consent versions 1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject malicious script...

PT-2025-17779 · Relentless Apps · Rrssb

Name of the Vulnerable Software and Affected Versions: Relentless Apps RRSSB versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker can...

PT-2025-17830 · Unknown · Steve Availability Calendar

Name of the Vulnerable Software and Affected Versions: Steve Availability Calendar versions 0.2.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-17800 · Unknown · Matthew Muro Multi-Column Taxonomy List

Name of the Vulnerable Software and Affected Versions: Matthew Muro Multi-Column Taxonomy List versions 1.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker c...

PT-2025-17728 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions prior to build 39904 Description: The issue is related to local privilege escalation due to insecure folder permissions. Recommendations: For versions prior to build 39904, update to build...

PT-2025-17757 · Heateor · Heateor Support Sassy Social Share

Name of the Vulnerable Software and Affected Versions: Heateor Support Sassy Social Share versions 3.3.73 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which can be used for phishing attacks. Recommendations:...