Rarlab WinRAR 安全漏洞

Rarlab WinRAR is a file compression/decompression software from Rarlab. A security vulnerability exists in Rarlab WinRAR version 7.11, which originates from cross-site scripting in the Generate Report function and could lead to the disclosure of user information...

WordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Photography versions = 7.7.2...

CVE-2025-5317 Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac

An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac BEST before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the...

CVE-2025-12813 Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated...

CVE-2025-64484

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...

PT-2025-45608

Name of the Vulnerable Software and Affected Versions Smart School version 7.0 Description A stored Cross Site Scripting XSS issue exists in Smart School version 7.0. This is due to insufficient validation of user-supplied data when a POST request is sent to the '/online admission' API endpoint...

PT-2025-45524

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and below Description SuiteCRM is an open-source Customer Relationship Management CRM software application. Versions 7.14.7 and below are susceptible to unauthenticated reflected Cross-Site Scripting XSS. Exploitation ...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions 7.14.7 and earlier and 8.0.0-beta.1 through 8.9.0, which stems from a user session not being disabled when the account is deactivated, which could result in elevated...

CVE-2025-64196 WordPress Booster for WooCommerce plugin <= 7.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through = 7.2.5...

CVE-2025-61994

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...

EUVD-2025-37975

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...

CVE-2025-61994

GROWI is affected by CVE-2025-61994: stored cross-site scripting in versions prior to 7.2.10 when a page with crafted content is created, potentially allowing arbitrary script execution in a victim’s browser. Remediation: upgrade to GROWI 7.3.0 or later (per JVN/Red Hat advisories). Other sources...

CVE-2025-36367

IBM i versions 7.2–7.6 are affected by CVE-2025-36367 due to an invalid IBM i SQL services authorization check, allowing a malicious actor to escalate privileges to root on the host OS. Affected products/versions: IBM i 7.6, 7.5, 7.4, 7.3, 7.2. Underlying cause: missing authorization check in IBM...

Security Bulletin: IBM i is affected by a privilege escalation in IBM i SQL services [CVE-2025-36367]

Summary IBM i is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check CVE-2025-36367 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2025-36367 DESCRIPTION: IBM i is vulnerable to privilege escalation caused by an invali...

OESA-2025-2606 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact...

RHSA-2025:19345 Red Hat Security Advisory: redis:7 security update

Bulletin has no description...

redis:7 security update

7.2.11-1.0.1 - Build with 64k pages to support redis on UEK on aarch64 7.2.11-1 - rebase to 7.2.11 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

CVE-2025-64118 node-tar vulnerable to race condition leading to uninitialized memory exposure

node-tar is a Tar for Node.js. In 7.5.1, using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2...

CVE-2025-64118

node-tar is a Tar for Node.js. In 7.5.1, using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2...

Squid < 7.2 Information Disclosure (SQUID-2025:2)

The version of Squid on the remote host is prior to 7.2. It is, therefore, affected by an information disclosure vulnerability: - Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information...