CVE-2025-3740 School Management System for Wordpress <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update

The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary...

PT-2025-30046 · Opencti · Opencti

Name of the Vulnerable Software and Affected Versions: OpenCTI versions prior to 6.6.6 Description: OpenCTI is a platform for managing cyber threat intelligence knowledge and observables. An IDOR vulnerability exists in the GraphQL NotificationLineNotificationMarkReadMutation and...

PT-2025-30047 · Xuxueli · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in Xuxueli xxl-job. The commandJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to OS command injection. This...

PT-2025-30093 · Unknown +1 · Qbittorrent +1

Name of the Vulnerable Software and Affected Versions: qBittorrent versions prior to 5.1.2 Description: qBittorrent does not prevent access to a local file referenced in a link URL. This issue affects the rsswidget.cpp and searchjobwidget.cpp files. Recommendations: Update qBittorrent to version...

PT-2025-30039 · Unknown · Gnuboard G6

Name of the Vulnerable Software and Affected Versions: Gnuboard g6 versions up to 6.0.10 Description: A problematic issue has been identified in Gnuboard g6. The issue affects processing of the /bbs/scrap popin update/qa/ file within the Post Reply Handler component, leading to cross site...

Fedora 41 : rust-sequoia-octopus-librnp (2025-71b9c49854)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-71b9c49854 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

PT-2025-30008 · WordPress · Masterstudy Lms Pro

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS Pro versions up to and including 4.7.9 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the install and activate plugin function. Thi...

PT-2025-30001 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions up to and including 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection due to a missing capability check on the b1 run query API endpoint. This allows authenticated attackers...

PT-2025-30027 · Joomla +1 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: RSBlog! versions 1.11.6 through 1.14.5 Description: A stored cross-site scripting XSS issue exists in the RSBlog! component for Joomla. The issue allows remote authenticated users to inject arbitrary web script or HTML code via the jformtags...

PT-2025-30060 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the formSafeEmailFilter function of the /goform/SafeEmailFilter file. Manipulation of the page argument leads to a stack-based buffer overflow, potentially allowing for remot...

PT-2025-29993 · WordPress · Map My Locations

Name of the Vulnerable Software and Affected Versions: Map My Locations plugin for WordPress versions prior to 1.2 Description: The plugin is susceptible to Stored Cross-Site Scripting through the map my locations shortcode due to inadequate input sanitization and output escaping of user-supplied...

PT-2025-30009 · WordPress · Malcure Malware Scanner

Name of the Vulnerable Software and Affected Versions: Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress versions prior to 16.9 Description: The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary...

PT-2025-30053 · Unknown · @Nuxtjs/Mdc

Name of the Vulnerable Software and Affected Versions: @nuxtjs/mdc versions prior to 0.17.2 Description: A remote script-inclusion / stored cross-site scripting issue exists in @nuxtjs/mdc. A Markdown author can inject a element, which rewrites how relative URLs are resolved. This allows an...

CVE-2025-53941 Hollo renders posts received with form elements and allows submission

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue...

PT-2025-29939 · Opencv · Opencv

Name of the Vulnerable Software and Affected Versions: OpenCV versions prior to 4.12.0 Description: OpenCV, an Open Source Computer Vision Library, contains an issue where an uninitialized pointer variable on the stack can lead to an arbitrary heap buffer write when processing crafted JPEG images...

PT-2025-29949 · Sophos · Intercept X For Windows

Name of the Vulnerable Software and Affected Versions: Intercept X for Windows versions prior to 2024.3.2 Description: A vulnerability related to registry permissions in the Intercept X for Windows updater can allow a local user to gain SYSTEM level privileges during a product upgrade...

PT-2025-29915 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.6 Description: WeGIA is an open source web manager. A SQL Injection issue was identified that allows an attacker to manipulate SQL queries and access sensitive database information. The vulnerability exists in the...

PT-2025-29962 · Sophos · Sophos Intercept X For Windows With Central Device Encryption +1

Name of the Vulnerable Software and Affected Versions: Sophos Intercept X for Windows with Central Device Encryption versions 2025.1 and older Description: A local privilege escalation vulnerability allows arbitrary code execution. Recommendations: Update Sophos Intercept X for Windows with Centr...

PT-2025-29897 · Alone +1 · Alone +1

Name of the Vulnerable Software and Affected Versions: Bears Backup versions prior to 2.0.1 Description: The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.0.0. This is due to the bbackup ajax handle function lacking capability check...

CVE-2025-53929

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcor.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...