PT-2025-52492

Name of the Vulnerable Software and Affected Versions Galette versions prior to 1.2.0 Description Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, it was possible to gain higher privileges by updating an existing account using a self-forged...

PT-2025-52485

Name of the Vulnerable Software and Affected Versions Galette versions 0.9.6 through 1.1.9 Description Galette is a membership management web application designed for non-profit organizations. Individuals with the 'group manager' role can circumvent intended restrictions, enabling unauthorized...

CVE-2025-54741

Missing Authorization vulnerability in Tyler Moore Super Blank super-blank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Blank: from n/a through = 1.2.0...

PT-2025-52046

Name of the Vulnerable Software and Affected Versions Tyler Moore Super Blank versions through 1.2.0 Description An authorization issue exists in Tyler Moore Super Blank, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Tyler Moore Super...

CVE-2025-14049

The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin LJUsers 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-sit...

PT-2025-50900

The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin VikRentItems Flexible Rental Management System 跨站脚本漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

CVE-2025-67646

CVE-2025-67646 affects the MediaWiki extension TableProgressTracking. Versions 1.2.0 and earlier do not enforce CSRF token validation in the REST API, allowing an attacker to craft a malicious page that, when loaded by an authenticated wiki user, can perform unintended authenticated actions (e.g....

EUVD-2025-202641

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

CVE-2025-12190 Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopbyajaxoptimizegallery function. This makes it possible for unauthenticated attackers to...

WordPress plugin Image Optimizer by wps.sk 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

[SECURITY] [DLA 4378-1] r-cran-gh security update

Debian LTS Advisory DLA-4378-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert November 25, 2025 https://wiki.debian.org/LTS Package : r-cran-gh Version : 1.2.0-1+deb11u1 CVE ID : CVE-2025-54956 Debian Bug : 1110481 A vulnerability has been discovered in r-cran-gh,...

OPENSUSE-SU-2025:15731-1 python311-Brotli-1.2.0-1.1 on GA media

These are all security issues fixed in the python311-Brotli-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-12161

The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-12161 Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload

The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and...

EUVD-2025-38032

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bingu replyMail replymail allows Stored XSS.This issue affects replyMail: from n/a through = 1.2.0...

WordPress plugin replyMail 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...