SUSE SLED15 / SLES15 / openSUSE 15 Security Update : expat (SUSE-SU-2025:1201-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1201-1 advisory. - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overfl...

GHSA-P9HH-MH5X-WVX3 Formie has XSS vulnerability for importing forms

Impact When importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to...

BIT-HELM-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

SUSE-SU-2025:1201-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavi...

PT-2025-16094 · Unknown · Notfound Testimonial Slider/Showcase Pro

Name of the Vulnerable Software and Affected Versions: NotFound Testimonial Slider And Showcase Pro versions 2.3.15 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows P...

Microsoft PC Manager < 3.15.4.0 Elevation of Privilege Vulnerability (Apr 2025) - Windows

Microsoft PC Manager is prone to an elevation of privilege vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Huawei EulerOS: Security Advisory for openjpeg2 (EulerOS-SA-2025-1366)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-16083 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...

PT-2025-16064 · Unknown · Woocommerce Sales Mis Report

Name of the Vulnerable Software and Affected Versions: WooCommerce Sales MIS Report versions prior to 4.0.3 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. Recommendations: For...

PT-2025-16026

Name of the Vulnerable Software and Affected Versions: ch-go library versions prior to 0.65.0 Description: The issue arises when the ch-go library is used under a specific condition where the query includes large, uncompressed malicious external data. This allows an attacker in control of such da...

PT-2025-16098 · Unknown · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: Error Log Viewer versions 1.0.5 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This allows fo...

PT-2025-16087 · Joomsky · Joomsky Js Job Manager

Name of the Vulnerable Software and Affected Versions: JoomSky JS Job Manager versions prior to 2.0.2 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-16091 · Unknown · Neoslab Database Toolset

Name of the Vulnerable Software and Affected Versions: neoslab Database Toolset versions 1.8.4 and earlier Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and acce...

PT-2025-22637

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.05.1 Description The issue lacks argument sanitization for the case in the gs lib ctx stash sanitized arg function in base/gslibctx.c. This allows a created PDF document to include its password in...

PT-2025-16070 · Unknown · Easy Post Duplicator

Name of the Vulnerable Software and Affected Versions: Easy Post Duplicator versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

CVE-2025-30150

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

CVE-2025-30151

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...

WordPress Simple WP Events plugin <= 1.8.17 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mika in WordPress Plugin Simple WP Events versions = 1.8.17...

CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The...

PT-2025-15916 · WordPress · Fedify

Name of the Vulnerable Software and Affected Versions: Feedify WordPress plugin versions prior to 2.4.6 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...