PT-2025-17108 · Woocommerce · Woocommerce Loyal Customers

Name of the Vulnerable Software and Affected Versions: WooCommerce Loyal Customers versions through 2.6 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions through 2.6,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2025:1294-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory. - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, whi...

PT-2025-17122 · Unknown · Kiotviet Sync

Name of the Vulnerable Software and Affected Versions: KiotViet Sync versions 1.8.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2025-16935 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: The Icegram Express formerly known as Email Subscribers WordPress plugin versions prior to 5.7.52 Description: The issue concerns the Icegram Express WordPress plugin, which does not properly sanitise and escape some of its settings. This cou...

PT-2025-16968 · Vicente Ruiz Gálvez · Vr-Frases

Name of the Vulnerable Software and Affected Versions: Vicente Ruiz Gálvez VR-Frases versions 3.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means that an attacker...

PT-2025-16967 · Vooplayer · Vooplayer

Name of the Vulnerable Software and Affected Versions: vooPlayer versions 4.0.0 through 4.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions 4.0.0 through...

PT-2025-17126 · Unknown · Credova Financial

Name of the Vulnerable Software and Affected Versions: Credova Financial versions through 2.4.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions through 2.4.8...

PT-2025-17198 · Jetbrains · Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: JetBrains Toolbox App versions prior to 2.6 Description: The issue concerns command injection in the SSH plugin. Recommendations: For versions prior to 2.6, update to version 2.6 or later to resolve the issue...

PT-2025-17163 · Unknown · Stylemix Ulisting

Name of the Vulnerable Software and Affected Versions: Stylemix uListing versions n/a through 2.2.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in Stylemix uListing. Recommendations: For versions n/a through 2.2.0, update to a version late...

PT-2025-17245

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server version 3.16.1 Description An improper neutralization of input issue was identified in GitHub Enterprise Server, allowing cross-site scripting in GitHub Markdown that used $$..$$ math blocks. Exploitation required acce...

PT-2025-17125 · Termel · Termel Pdf 2 Post

Name of the Vulnerable Software and Affected Versions: termel PDF 2 Post versions prior to 2.4.0 Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Remote Code Inclusion. This means that an attacker could potentially inject...

WordPress WPCasa plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin WPCasa versions = 1.3.2...

SUSE-SU-2025:1295-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavi...

SUSE-SU-2025:1294-1 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen bsc1185842 Other fixes: - Updated to version 2.2.34...

PT-2025-16865 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: The issue allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with "NT...

PT-2025-16870 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: The issue allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with "NT...

PT-2025-16911 · Hitachi Vantara · Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, including 9.3.x and 8.3.x Description: The software does not properly neutralize user-controllable input before it is placed in output that is used as a web page,...

PT-2025-16788 · Wxwidgets +2 · Wxwidgets +2

Name of the Vulnerable Software and Affected Versions: wxWidgets versions prior to 3.2.7 Description: A crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. Recommendations: For versions prior to 3.2.7, update to version 3.2.7 or later to resolve the issue...

PT-2025-16836 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: A SQL injection vulnerability has been identified in the affected application through the internally used UpdateConnectionVariableArchivingBuffering method. This could allow an...

PT-2025-16798 · Drupal · Drupal Stage File Proxy

Name of the Vulnerable Software and Affected Versions: Drupal Stage File Proxy versions 0.0.0 through 3.1.4 Description: The issue is related to the allocation of resources without limits or throttling in Drupal Stage File Proxy, allowing flooding. Recommendations: For versions 0.0.0 through 3.1....