Information Disclosure

Indico is vulnerable to information disclosure. The vulnerability is due to an endpoint exposing user details such as name, affiliation, and email in bulk when listed in certain fields like ACLs, which allows an attacker to retrieve basic user information without proper authorization...

BIT-GITLAB-2025-6168 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests...

BIT-PHP-MIN-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

Arbitrary Code Execution (ACE)

job-iteration is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper handling of input in the CsvEnumerator class, which allows an attacker to execute arbitrary commands on the host system by exploiting unsanitized file paths or untrusted input...

BELL-CVE-2025-6965

Bulletin has no description...

BELL-CVE-2025-50106

Bulletin has no description...

BELL-CVE-2025-53905

Bulletin has no description...

PT-2025-29750 · WordPress · Antispam For Contact Form 7

Name of the Vulnerable Software and Affected Versions: AntiSpam for Contact Form 7 versions through 0.6.3 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their knowledge...

PT-2025-29819 · Unity Business Technology Pty · The E-Commerce Erp

Name of the Vulnerable Software and Affected Versions: The E-Commerce ERP versions n/a through 2.1.1.3 Description: An incorrect privilege assignment issue exists in Unity Business Technology Pty Ltd The E-Commerce ERP, allowing privilege escalation. Recommendations: Update The E-Commerce ERP to ...

PT-2025-29776 · Awethemes · Hillter

Name of the Vulnerable Software and Affected Versions: awethemes Hillter versions through 3.0.7 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update awethemes Hillter to a version later than 3.0.7...

PT-2025-29739 · Crocoblock · Jetpopup

Name of the Vulnerable Software and Affected Versions: Crocoblock JetPopup versions through 2.0.15.1 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting XSS flaw. This allows for the injection of...

PT-2025-29767 · WordPress · Bplugins Lightbox Block

Name of the Vulnerable Software and Affected Versions: bPlugins LightBox Block versions through 1.1.30 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. This can lead to the execution of...

PT-2025-29779 · Unknown · Md Yeasin Ul Haider Url Shortener

Name of the Vulnerable Software and Affected Versions: Md Yeasin Ul Haider URL Shortener versions through 3.0.7 Description: The software contains a SQL injection flaw due to improper neutralization of special elements within SQL commands. This allows for potential SQL injection attacks...

PT-2025-29873

Name of the Vulnerable Software and Affected Versions BIND versions 9.20.0 through 9.20.10 BIND versions 9.21.0 through 9.21.9 BIND versions 9.20.9-S1 through 9.20.10-S1 Description If a named caching resolver is configured with serve-stale-enable set to yes, and with stale-answer-client-timeout...

PT-2025-29757 · Tribulant · Tribulant Software Newsletters

Name of the Vulnerable Software and Affected Versions: Tribulant Software Newsletters versions n/a through 4.10 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Tribulant Software Newsletters, allowing attackers to perform actions on behalf of authenticated users. This issue...

PT-2025-29756 · WordPress · Blockswp Theme Builder For Elementor

Name of the Vulnerable Software and Affected Versions: BlocksWP Theme Builder For Elementor versions through 1.2.3 Description: The BlocksWP Theme Builder For Elementor software contains a Cross-Site Request Forgery CSRF issue. This allows for the execution of unintended actions on behalf of an...

PT-2025-29763 · WordPress · Wp Hide Post

Name of the Vulnerable Software and Affected Versions: xfinitysoft WP Post Hide versions n/a through 1.0.9 Description: A Cross-Site Request Forgery CSRF issue exists in xfinitysoft WP Post Hide, allowing attackers to perform actions on behalf of an authenticated user. Recommendations: Update...

PT-2025-29742 · Unknown · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: Bold Page Builder versions through 5.4.1 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks. Recommendations: Update Bold...

PT-2025-29729 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: hashthemes Easy Elementor Addons versions through 2.2.5 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for stored cross-site scripting attacks...

PT-2025-29761 · WordPress · Toast Plugins Animator

Name of the Vulnerable Software and Affected Versions: Toast Plugins Animator versions n/a through 3.0.16 Description: A Cross-Site Request Forgery CSRF issue exists in Toast Plugins Animator. This allows attackers to perform actions on behalf of unsuspecting users. Recommendations: Update Toast...