Debian: Security Advisory (DLA-4127-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-16205 · Blubrry · Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: PowerPress Podcasting plugin by Blubrry WordPress plugin versions prior to 11.9.18 Description: The issue is related to the PowerPress Podcasting plugin by Blubrry WordPress plugin, which does not properly sanitise and escape some of its...

PT-2025-16225 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker can craft a link with a malicious script that gets embedded in references to other resources,...

PT-2025-20924 · Nosurf · Nosurf

Name of the Vulnerable Software and Affected Versions: nosurf versions prior to 1.2.0 Description: A vulnerability in nosurf allows an attacker who controls content on the target site, or on a subdomain of the target site, to bypass CSRF checks and issue requests on a user's behalf. This is due t...

PT-2025-17419

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.21.4 Description The issue is related to out-of-bounds reads in the phase one correct function within decoders/load mfbacks.cpp for tag 0x412 processing. This is caused by large w0 or w1 values or the frac and mult...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : expat (SUSE-SU-2025:1201-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1201-1 advisory. - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overfl...

GHSA-P9HH-MH5X-WVX3 Formie has XSS vulnerability for importing forms

Impact When importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to...

BIT-HELM-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

SUSE-SU-2025:1201-1 Security update for expat

This update for expat fixes the following issues: - CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavi...

PT-2025-16083 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...

PT-2025-16094 · Unknown · Notfound Testimonial Slider/Showcase Pro

Name of the Vulnerable Software and Affected Versions: NotFound Testimonial Slider And Showcase Pro versions 2.3.15 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows P...

Microsoft PC Manager < 3.15.4.0 Elevation of Privilege Vulnerability (Apr 2025) - Windows

Microsoft PC Manager is prone to an elevation of privilege vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Huawei EulerOS: Security Advisory for openjpeg2 (EulerOS-SA-2025-1366)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-16064 · Unknown · Woocommerce Sales Mis Report

Name of the Vulnerable Software and Affected Versions: WooCommerce Sales MIS Report versions prior to 4.0.3 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. Recommendations: For...

PT-2025-16026

Name of the Vulnerable Software and Affected Versions: ch-go library versions prior to 0.65.0 Description: The issue arises when the ch-go library is used under a specific condition where the query includes large, uncompressed malicious external data. This allows an attacker in control of such da...

PT-2025-16070 · Unknown · Easy Post Duplicator

Name of the Vulnerable Software and Affected Versions: Easy Post Duplicator versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-16098 · Unknown · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: Error Log Viewer versions 1.0.5 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This allows fo...

PT-2025-16087 · Joomsky · Joomsky Js Job Manager

Name of the Vulnerable Software and Affected Versions: JoomSky JS Job Manager versions prior to 2.0.2 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-16091 · Unknown · Neoslab Database Toolset

Name of the Vulnerable Software and Affected Versions: neoslab Database Toolset versions 1.8.4 and earlier Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and acce...

PT-2025-22637

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.05.1 Description The issue lacks argument sanitization for the case in the gs lib ctx stash sanitized arg function in base/gslibctx.c. This allows a created PDF document to include its password in...