CVE-2025-31120

CVE-2025-31120 affects NamelessMC 2.1.4 and earlier. The issue stems from an insecure view count mechanism on the forum page that relies on a client-side cookie nl-topic-[tid] (or session for guests) to decide whether a view should be counted. When the cookie is absent, every page request increme...

CVE-2025-31118 NamelessMC Has Forum Reply Submission Time Limit Bypass

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature viewtopic.php does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction,...

CVE-2025-30357

CVE-2025-30357 affects NamelessMC forum software. In versions ≤ 2.1.4, a malicious user posting spam across topics could trigger deletion of that user by an admin, which would cause all that user’s posts (and in turn related topics by unrelated users) to be marked as deleted. The issue has been p...

PT-2025-17309 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue allows an authenticated attacker to perform a UI-based denial of service DoS by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This is...

PT-2025-17317 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A security issue was identified in Dify, an open-source LLM app development platform, where normal users are improperly granted permissions to edit app names, descriptions, and icons. This access...

Slackware Linux 15.0 / current libxml2 Multiple Vulnerabilities (SSA:2025-108-01)

The version of libxml2 installed on the remote host is prior to 2.11.9 / 2.13.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-108-01 advisory. New libxml2 packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted t...

PT-2025-17259 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions prior to 2.94.10 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-17313 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue concerns an insecure view count mechanism in the forum page of NamelessMC, a free website software for Minecraft servers. This mechanism relies on a client-side cookie nl-topic-tid or...

PT-2025-17315

Name of the Vulnerable Software and Affected Versions Fastify versions 4.29.0 through 5.3.1 Fastify version 4.9.0 Description Fastify is a fast, low overhead web framework for Node.js. Applications specifying different validation strategies for different content types may bypass validation by...

PT-2025-17310 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue arises when a malicious user leaves spam comments on many topics. If an administrator deletes the malicious user's account, all their posts along with the associated topics by unrelat...

PT-2025-17294 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions 0.6.8 and prior Description: A vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in "/export" should only allow administrator users to export DSL...

CVE-2025-32782

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

SUSE-SU-2025:1345-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2024-40635: Fixed integer overflow in User ID handling bsc1239749 Other fixes: - Update to containerd v1.7.27...

WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Hotel Booking versions = 3.6...

PT-2025-17056 · Unknown · Antoine Guillien Restrict Taxonomies

Name of the Vulnerable Software and Affected Versions: Antoine Guillien Restrict Taxonomies versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potenti...

PT-2025-17171 · Unknown · Ashish Ajani Contact Form Vcard Generator

Name of the Vulnerable Software and Affected Versions: Ashish Ajani Contact Form vCard Generator versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means th...

PT-2025-17107 · Unknown · Feedify – Web Push Notifications

Name of the Vulnerable Software and Affected Versions: Feedify – Web Push Notifications versions n/a through 2.4.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that ...

SUSE SLES12 Security Update : expat (SUSE-SU-2025:1295-1)

"The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1295-1 advisory. - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618...

PT-2025-17040 · Unknown · Beacon Lead Magnets/Lead Capture

Name of the Vulnerable Software and Affected Versions: Beacon Lead Magnets and Lead Capture versions 1.5.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means a...

PT-2025-17108 · Woocommerce · Woocommerce Loyal Customers

Name of the Vulnerable Software and Affected Versions: WooCommerce Loyal Customers versions through 2.6 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions through 2.6,...