CVE-2025-47489 WordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through = 2.0.29...

CVE-2025-46816

The CVE-2025-46816 affects goshs, a Go-based SimpleHTTPServer. Versions 0.3.4 up to, but not including, 1.0.5 are vulnerable due to the dispatchReadPump path not validating the -c CLI option, enabling remote command execution via websockets when the server is started without arguments. This is co...

PT-2025-19775 · Unknown · Itranswarp

Name of the Vulnerable Software and Affected Versions: itranswarp version 2.19 Description: An issue in the component /manage/ of itranswarp allows attackers to bypass authentication via a crafted request. Recommendations: For version 2.19, consider restricting access to the /manage/ component...

CVE-2025-47226

A flaw was found in the Snipe-IT component. The affected versions contain incorrect authorization protocols for accessing asset information. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases / apparmor (CVE-2016-1585)

The version of CBL-Mariner Releases / apparmor installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2016-1585 advisory. - In all versions of AppArmor mount rules are accidentally widened when compiled...

CVE-2025-43971

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-46472 WordPress The Pack Elementor addons plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through = 2.1.6...

CVE-2025-3907 Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

Cross-Site Request Forgery CSRF vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9...

PT-2025-17525 · Mojoomla · Wpams

Name of the Vulnerable Software and Affected Versions: WPAMS versions prior to 44.0 Description: The issue affects WPAMS, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting. Recommendations: For versions prior to...

CVE-2025-43971

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-43961

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser...

CVE-2025-39461

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through = 24.07.02...

CVE-2025-32545 WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through = 0.1...

CVE-2025-39423 WordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through = 1.0...

CVE-2025-29449

An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function...

CVE-2025-27571

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived...

http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

Moodle 4.5.x < 4.5.1 Reflected XSS In Question Bank Filter

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.8 or 4.4.4 prior to 4.4.5 or 4.5.x prior to 4.5.1 . It is, therefore, affected by a Reflected XSS in question bank filter. Note that the scanner has not tested for these issues but has inste...

CVE-2025-32481 WordPress Nino Social Connect plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ninotheme Nino Social Connect allows Stored XSS. This issue affects Nino Social Connect: from n/a through 2.0...

FreeBSD : Mozilla -- memory corruption (34c51a2b-13c8-11f0-a5bd-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 34c51a2b-13c8-11f0-a5bd-b42e991fc52e advisory. [email protected] reports: Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of...