PT-2025-14406 · Wbw · Product Table By Wbw

Name of the Vulnerable Software and Affected Versions: Product Table by WBW versions 2.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-14244 · Joomsky · Joomsky Js Job Manager

Name of the Vulnerable Software and Affected Versions: JoomSky JS Job Manager versions through 2.0.2 Description: The issue affects the access control security levels in JoomSky JS Job Manager, allowing for authorization bypass through user-controlled key exploitation. This occurs due to...

PT-2025-14081 · WordPress · Gutentor

Name of the Vulnerable Software and Affected Versions: The Gutentor WordPress plugin versions prior to 3.4.7 Description: The issue allows admins to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For...

PT-2025-14246 · Unknown · Black Widgets For Elementor

Name of the Vulnerable Software and Affected Versions: Black Widgets For Elementor versions 1.3.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

Amazon Linux 2 : firefox (ALASFIREFOX-2025-036)

The version of firefox installed on the remote host is prior to 128.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-036 advisory. Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability...

PT-2025-14093 · WordPress · Contempo Real Estate Core

Name of the Vulnerable Software and Affected Versions: Contempo Real Estate Core plugin for WordPress versions up to and including 3.6.3 Description: The issue is related to stored cross-site scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-14073 · Unknown · Tla Media Gtm Kit

Name of the Vulnerable Software and Affected Versions: TLA Media GTM Kit versions n/a through 2.3.1 Description: The issue allows retrieval of embedded sensitive data due to debug messages revealing unnecessary information. Recommendations: For versions n/a through 2.3.1, update to a version that...

PT-2025-14108

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 137 Thunderbird versions prior to 137 Description The issue allows an unexpected file to be uploaded after selecting a malicious Windows .url shortcut from the local filesystem. This bug only affects Firefox on Window...

CBL Mariner 2.0 Security Update: php (CVE-2025-1217)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1217 advisory. - In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when...

PT-2025-37309

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description Chamilo is a learning management system with an OS Command Injection issue in the /main/cron/lang/check parse lang.php file. Exploitation may allow a remote attacker to execute arbitrary SQL querie...

PT-2025-14063 · Joomsky · Joomsky Js Help Desk

Name of the Vulnerable Software and Affected Versions: JoomSky JS Help Desk versions n/a through 2.9.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in JoomSky JS Help Desk...

PT-2025-14064 · Joomsky · Joomsky Js Help Desk

Name of the Vulnerable Software and Affected Versions: JoomSky JS Help Desk versions 2.9.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized SQL commands to be execute...

PT-2025-14077 · WordPress · Multiple Shipping/Billing Address For Woocommerce

Name of the Vulnerable Software and Affected Versions: Multiple Shipping And Billing Address For Woocommerce versions prior to 1.5 Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in the Multiple Shipping And Billing Address For Woocommerce plugin...

PT-2025-14243 · Woocommerce · Shipdepot For Woocommerce

Name of the Vulnerable Software and Affected Versions: ShipDepot for WooCommerce versions 1.2.19 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For ShipDepot fo...

PT-2025-14262 · Repuso · Social Proof Testimonials/Reviews By Repuso

Name of the Vulnerable Software and Affected Versions: Social proof testimonials and reviews by Repuso versions n/a through 5.21 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

CVE-2025-24214

CVE-2025-24214: A privacy issue where text-field contents were logged; fixed in visionOS 2.4, iOS 18.4/iPadOS 18.4, tvOS 18.4, and macOS Sequoia 15.4. The CVSS details indicate a LOCAL attack with LOW complexity and USER INTERACTION required, and the impact is confidentiality loss. The issue coul...

CVE-2025-31128

gifplayer is a jQuery plugin for playing/stopping animated GIFs that contains a cross‑site scripting (XSS) vulnerability. The vulnerability affects versions prior to 0.3.7 and has been fixed in 0.3.7. Multiple connected sources corroborate an XSS flaw in the Gif Player integration and recommend u...

MGASA-2025-0121 Updated zvbi packages fix security vulnerabilities

A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbistrndupiconvucs2 of the file src/conv.c. The manipulation of the argument srclength leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has...

CVE-2025-3019

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existin...

CVE-2025-2402

A hard-coded, non-random password for the object store minio of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It...