PT-2025-48369

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has...

PT-2025-48367

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7 Description OrangeHRM does not invalidate existing sessions when a user is disabled or a password change occurs, allowing active session cookies to remain valid indefinitely. This allows a disabled user, or a...

ClipBucket V5 安全漏洞

ClipBucket V5 is a video hosting platform for MacWarrior individual developers. A security vulnerability exists in ClipBucket V5 versions prior to 5.5.2, which stems from an authorization bypass in the AJAX tagging system that could lead to a large-scale tagging attack...

PT-2025-48368

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no...

PT-2025-48366

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7 Description OrangeHRM is a human resource management system. A flaw exists in the password reset workflow where the system does not verify that the username submitted in the final reset request matches the...

WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Poystick in WordPress Plugin Bold Page Builder versions = 5.5.2...

CVE-2025-66026

CVE-2025-66026 is a reflected XSS in REDAXO CMS (pre-5.20.1) affecting the Mediapool view where args[types] is echoed into an info banner without escaping. The root cause is lack of HTML-escaping when rendering the value, allowing an authenticated user to trigger arbitrary JavaScript execution in...

EUVD-2025-199658

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free UAF vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library specifically in src/sp/transport/mqtt/brokertcp.c. The vulnerability...

CVE-2025-65953 NanoMQ UAF of retain message due to invalid MQTTV5 properties

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free UAF vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library specifically in src/sp/transport/mqtt/brokertcp.c. The vulnerability...

REDAXO CMS is vulnerable to XSS through its module management component

A stored cross-site scripting XSS vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the...

"FOD" App uses hard-coded cryptographic keys

Overview "FOD" App provided by Fuji Television Network, Inc. uses hard-coded cryptographic keys Use of hard-coded cryptographic key CWE-321 - CVE-2025-64304 The keys are used in the processing of JWT data. Impact The cryptographic keys may be retrieved. The developer considers that the impact is...

REDAXO 安全漏洞

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO version 5.20.0, which stems from improper handling of the Output code field in the module management component and could lead to a stored cross-site scripting attack...

CVE-2025-63498

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting XSS via the "userName" parameter...

CVE-2025-11933

CVE-2025-11933 describes an issue in wolfSSL up to version 5.8.2 where improper input validation in the TLS 1.3 CKS extension parsing can allow a remote unauthenticated attacker to cause a denial‑of‑service with a crafted ClientHello containing duplicate CKS extensions. Affected software is wolfS...

CVE-2025-62709

ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...

CVE-2025-13357

Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. Thi...

CVE-2025-66083 WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through = 5.0.4...

CVE-2025-63888

The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability...

OPENSUSE-SU-2025:15756-1 blender-5.0-5.0.0-1.1 on GA media

These are all security issues fixed in the blender-5.0-5.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-11446

Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12...