CVE-2025-36026

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...

CVE-2025-53288

Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through = 7.0.0...

CVE-2025-53304

Missing Authorization vulnerability in Rohil Contact Form - 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form - 7 : Hide Success Message: from n/a through = 1.1.4...

CVE-2025-6857

A vulnerability has been found in HDF5 1.14.6 and classified as problematic. Affected by this vulnerability is the function H5Gnodecmp3 of the file src/H5Gnode.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been...

Security Bulletin: IBM Storage Ceph is vulnerable to Integer Overflow or Wraparound in the RHEL UBI (CVE-2021-43618)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2021-43618 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2021-43618 DESCRIPTION: GNU Multiple Precision Arithmetic Library GMP is vulnerable to...

WordPress Beauty Contact Popup Form plugin <= 6.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Beauty Contact Popup Form versions = 6.0...

WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Slickstream versions = 2.0.3...

WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by zaim in WordPress Plugin ChatBot versions = 6.7.3...

CVE-2025-52717 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through = 8.0.6...

WordPress FL3R Accessibility Suite plugin <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode vulnerability discovered by Gilang in WordPress Plugin FL3R Accessibility Suite versions = 1.4...

CVE-2025-6613

A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the argument Name leads to cross site scripting. The attack can be launched...

CVE-2025-5398

CVE-2025-5398 affects Ninja Forms – The Contact Form Builder That Grows With You (WordPress plugin). The CVE describes a Stored Cross-Site Scripting (CSTI) vulnerability due to insufficient output escaping in the templating engine, impacting all versions up to and including 3.10.2.1. Exploitation...

CVE-2025-52207

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory...

SUSE SLED15: libekmfweb1 / libekmfweb1-devel / libkmipclient1 / osasnmpd / etc (SUSE-SU-2025:02017-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02017-1 advisory. Security issues fixed: - CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate...

Fedora 42 : perl-String-Compare-ConstantTime (2025-ce51c124a5)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ce51c124a5 advisory. This release fixes CVE-2024-13939 leaking the length of a secret string Tenable has extracted the preceding description block directly from the Fedora securi...

CVE-2025-52207

Summary: CVE-2025-52207 affects MikoPBX (MikoPBX/core) up to version 2024.1.114, where PBXCoreREST/Controllers/Files/PostController.php permits uploading a PHP script to an arbitrary directory. Impact (as stated): authenticated users can upload and execute arbitrary PHP, enabling remote code exec...

CVE-2015-0842

yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass...

K000152186: Python Jinja2 vulnerability CVE-2025-27516

Security Advisory Description Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an...

CVE-2025-6677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

WordPress WP Wall plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Wall versions = 1.7.3...