RARLabs WinRAR < 7.11 Symbolic Mark of the Web Security Bypass Vulnerability - Windows

WinRAR is prone to a symbolic link mark of the web bypass vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Photon OS 5.0: Python3 PHSA-2024-5.0-0434

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0434. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Fedora: Security Advisory (FEDORA-2025-f7671643c4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-15293 · Unknown · Apollo-Compiler

Name of the Vulnerable Software and Affected Versions: apollo-compiler versions prior to 1.27.0 Description: The issue concerns a query-based compiler for the GraphQL query language. Prior to version 1.27.0, a vulnerability allowed queries with deeply nested and reused named fragments to be...

Medium: python3

Issue Overview: A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means...

Oracle Linux 9 : gimp (ELSA-2025-3617)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3617 advisory. - Fixes: CVE-2023-44441 CVE-2023-44442 CVE-2023-44443 CVE-2023-44444 Tenable has extracted the preceding description block directly from the Oracle Lin...

Fedora: Security Advisory (FEDORA-2025-f87fe38331)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : chromium (2025-98dd4c4639)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-98dd4c4639 advisory. Update to 135.0.7049.52 High CVE-2025-3066: Use after free in Navigations Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs Medium...

Fedora 40 : chromium (2025-609ed3aaa7)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-609ed3aaa7 advisory. Update to 135.0.7049.52 High CVE-2025-3066: Use after free in Navigations Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs Medium...

CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

PT-2025-14975 · Wpminds · Wpminds Simple Wp Events

Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker...

Debian: Security Advisory (DLA-4112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Django 5.0.x < 5.0.14, 5.1.x < 5.1.8 DoS Vulnerability - Windows

Django is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; ...

PT-2025-14970 · Unknown · Illid Advanced Woo Labels

Name of the Vulnerable Software and Affected Versions: ILLID Advanced Woo Labels versions n/a through 2.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-14913 · WordPress · Erick Danzer Easy Query – Wp Query Builder

Name of the Vulnerable Software and Affected Versions: Erick Danzer Easy Query – WP Query Builder versions 2.0.4 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Bli...

PT-2025-15011 · Era404 · Era404 Stafflist

Name of the Vulnerable Software and Affected Versions: ERA404 StaffList versions 3.2.6 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For ERA404 StaffList...

PT-2025-15013

Name of the Vulnerable Software and Affected Versions 1 Click WordPress Migration versions n/a through 2.2 Description The issue is related to the exposure of sensitive system information due to uncleared debug information in 1 Click WordPress Migration, allowing the retrieval of embedded sensiti...

PT-2025-14924 · Unknown · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Ays Pro Secure Copy Content Protection and Content Locking versions n/a through 4.5.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XS...

PT-2025-14839 · Unknown · Spatie/Browsershot

Name of the Vulnerable Software and Affected Versions: spatie/browsershot versions 0.0.0 through 3.1 Description: The issue is related to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input. This enables attackers to access localhost and list all of...

PT-2025-14981 · Unknown · Xpro Theme Builder

Name of the Vulnerable Software and Affected Versions: Xpro Theme Builder versions 1.2.8.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Xpro Theme Builder...