PT-2025-17171 · Unknown · Ashish Ajani Contact Form Vcard Generator

Name of the Vulnerable Software and Affected Versions: Ashish Ajani Contact Form vCard Generator versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means th...

PT-2025-17108 · Woocommerce · Woocommerce Loyal Customers

Name of the Vulnerable Software and Affected Versions: WooCommerce Loyal Customers versions through 2.6 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions through 2.6,...

PT-2025-17040 · Unknown · Beacon Lead Magnets/Lead Capture

Name of the Vulnerable Software and Affected Versions: Beacon Lead Magnets and Lead Capture versions 1.5.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means a...

PT-2025-17107 · Unknown · Feedify – Web Push Notifications

Name of the Vulnerable Software and Affected Versions: Feedify – Web Push Notifications versions n/a through 2.4.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that ...

SUSE SLES12 Security Update : expat (SUSE-SU-2025:1295-1)

"The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1295-1 advisory. - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2025:1294-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory. - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, whi...

PT-2025-16935 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: The Icegram Express formerly known as Email Subscribers WordPress plugin versions prior to 5.7.52 Description: The issue concerns the Icegram Express WordPress plugin, which does not properly sanitise and escape some of its settings. This cou...

PT-2025-17122 · Unknown · Kiotviet Sync

Name of the Vulnerable Software and Affected Versions: KiotViet Sync versions 1.8.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2025-16968 · Vicente Ruiz Gálvez · Vr-Frases

Name of the Vulnerable Software and Affected Versions: Vicente Ruiz Gálvez VR-Frases versions 3.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means that an attacker...

PT-2025-16967 · Vooplayer · Vooplayer

Name of the Vulnerable Software and Affected Versions: vooPlayer versions 4.0.0 through 4.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions 4.0.0 through...

PT-2025-17198 · Jetbrains · Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: JetBrains Toolbox App versions prior to 2.6 Description: The issue concerns command injection in the SSH plugin. Recommendations: For versions prior to 2.6, update to version 2.6 or later to resolve the issue...

PT-2025-17125 · Termel · Termel Pdf 2 Post

Name of the Vulnerable Software and Affected Versions: termel PDF 2 Post versions prior to 2.4.0 Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Remote Code Inclusion. This means that an attacker could potentially inject...

PT-2025-17163 · Unknown · Stylemix Ulisting

Name of the Vulnerable Software and Affected Versions: Stylemix uListing versions n/a through 2.2.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in Stylemix uListing. Recommendations: For versions n/a through 2.2.0, update to a version late...

PT-2025-17126 · Unknown · Credova Financial

Name of the Vulnerable Software and Affected Versions: Credova Financial versions through 2.4.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions through 2.4.8...

PT-2025-17245

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server version 3.16.1 Description An improper neutralization of input issue was identified in GitHub Enterprise Server, allowing cross-site scripting in GitHub Markdown that used $$..$$ math blocks. Exploitation required acce...

WordPress WPCasa plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin WPCasa versions = 1.3.2...

SUSE-SU-2025:1295-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavi...

SUSE-SU-2025:1294-1 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen bsc1185842 Other fixes: - Updated to version 2.2.34...

PT-2025-16871 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: The issue allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with "NT...

PT-2025-16828 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: The issue allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with "NT...