PT-2025-24077 · WordPress · Simple History

Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...

PT-2025-24166 · Unknown · Melipayamak

Name of the Vulnerable Software and Affected Versions: Melipayamak versions through 2.2.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...

PT-2025-24120 · WordPress · Seerox Wp Media File Type Manager

Name of the Vulnerable Software and Affected Versions: Seerox WP Media File Type Manager versions 2.3.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Seerox WP Media Fi...

PT-2025-24256 · Foxit · Foxit Esign

Name of the Vulnerable Software and Affected Versions: Foxit eSign for WordPress versions 2.0.3 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Foxit eSign...

PT-2025-24172 · WordPress · Wp Wham All Currencies For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Wham All Currencies for WooCommerce versions n/a through 2.4.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that a...

PT-2025-24307 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: An improper certificate validation issue has been reported, allowing a remote attacker with a user account to compromise the system's security. Recommendations: For versions prior to...

PT-2025-24249 · Automattic · Newspack Newsletters

Name of the Vulnerable Software and Affected Versions: Automattic Newspack Newsletters versions prior to 3.13.0 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing attacks. Recommendations: For versions...

PT-2025-24110 · Unknown · Whassan Ki Live Video Conferences

Name of the Vulnerable Software and Affected Versions: whassan KI Live Video Conferences versions n/a through 5.5.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For...

CVE-2025-48998

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. ...

SUSE-SU-2025:01525-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u452 icedtea-3.35.0 Security issues fixed: - CVE-2025-21587: unauthorized creation, deletion or modification of critical data through the JSSE component. bsc1241274 - CVE-2025-30691: unauthorized update, insert or...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2025:01807-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01807-1 advisory. Security fixes: - CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242666 Other fixes: - Enable...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2025:01806-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01806-1 advisory. Security fixes: - CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242666 Other...

PT-2025-23949 · Hewlett Packard · Hpe Insight Remote Support

Name of the Vulnerable Software and Affected Versions: HPE Insight Remote Support versions prior to 7.15.0.646 Description: A vulnerability in HPE Insight Remote Support may allow an unauthenticated denial of service. Recommendations: For versions prior to 7.15.0.646, update to version 7.15.0.646...

PT-2025-23910 · Unknown · 2Clickportal

Name of the Vulnerable Software and Affected Versions: 2ClickPortal versions prior to 7.14.3 Description: The issue is related to improper neutralization of input provided by an unauthorized user into the changes reference id parameter in the URL, allowing for boolean-based Blind SQL Injection...

PT-2025-23944 · Unknown · Bdthemes Element Pack Pro

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Pro versions prior to 8.0.0 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 8.0.0, upda...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:01809-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01809-1 advisory. Update to version 0.0.20250529T205903 2025-05-29T20:59:03Z jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases:...

CVE-2025-5690

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the...

CVE-2025-5690

The CVE-2025-5690 entry concerns PostgreSQL Anonymizer (versions 2.0 and 2.1). Affected component: the masking mechanism when dynamic masking is enabled, which allows a masked user to bypass table masking rules and read original data via a database cursor or the --insert option in pg_dump. This i...

CVE-2025-5690 Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the...

CVE-2025-48935 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue...