PT-2025-29382 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.5.0 Description: Roundup is susceptible to a cross-site scripting issue. This occurs through the interaction between URLs and issue tracker templates devel and responsive. Recommendations: Update Roundup to version...

WordPress Order Delivery Date Pro for WooCommerce plugin < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure vulnerability

Unauthenticated Arbitrary Post Title Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.6.0...

Microsoft PC Manager Elevation of Privilege Vulnerability (Jul 2025) - Windows

Microsoft PC Manager is prone to an elevation of privilege vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Responsive Coming Soon Landing Page / Holding Page for WordPress plugin <= 3.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Responsive Coming Soon Landing Page / Holding Page for WordPress versions = 3.0...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-webflux-5.3.27.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of spring-webflux-5.3.27.jar Vulnerability Details CVEID:CVE-2024-38819 DESCRIPTION: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks...

WordPress WP Firebase Push Notification plugin <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification vulnerability

Cross-Site Request Forgery to Broadcast Notification vulnerability discovered by Nabil Irawan in WordPress Plugin WP Firebase Push Notification versions = 1.2.0...

PT-2025-28227 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 version 5.5.16 Description: The issue allows a remote attacker to obtain sensitive information. This is achieved via the "bbs/member confirm.php" endpoint. Recommendations: For gnuboard5 version 5.5.16, consider restricting access t...

io.zipkin:benchmarks (=2.22.1) potentially affected by CVE-2025-53602 via io.zipkin:zipkin-server (=2.22.1)

io.zipkin:zipkin-server MAVEN version =2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks =2.22.1 Source cves: CVE-2025-53602 Source advisory: OSV:GHSA-794X-8X6X-QPFC...

CVE-2025-7061

A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. The exploit has been disclosed to the public and...

PT-2025-27927 · Unknown · The Beautiful Cookie Consent Banner

Name of the Vulnerable Software and Affected Versions: Nikel Beautiful Cookie Consent Banner versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2025-49867 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9303a55298f9 Credits Frank Required privilege...

CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...

WordPress Classiera Theme <= 4.0.34 is vulnerable to SQL Injection

Software Classiera Type Theme Vulnerable versions = 4.0.34 Fixed in 4.0.35 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52722 Patch priority High CVSS severity High 9.3 Developer Joinwebs PSID bef854c7c688 Credits Lê Quốc Bảo Required privilege Unauthenticated Published 1...

PT-2025-27566 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.7.7 Description: The issue concerns the exposure of a PHP phpinfo debug page to unauthenticated users, potentially containing sensitive data useful for an attacker. Recommendations: For versions...

GHSA-8GQP-HR9G-PG62 Conductor vulnerable to OS command injection through unrestricted access to Java classes

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes...

WordPress Game Users Share Buttons plugin <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via themeNameId Parameter vulnerability discovered by theviper17y in WordPress Plugin Game Users Share Buttons versions = 1.3.0...

CVE-2025-53097 Roo Code extension vulnerable to Potential Information Leakage via JSON Schema

Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's searchfiles tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was able to inject a prompt into the agent coul...

CVE-2025-45737

An issue in NetEase Hangzhou Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component...

WordPress Post Carousel Slider for Elementor plugin <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function vulnerability

Authenticated Subscriber+ Missing Authorization via processwbelpspromoform Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Post Carousel Slider for Elementor versions = 1.6.0...

PT-2025-26826 · Unknown · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /panel/add-staff.php. The manipulation of the Name argument leads to SQL injection. It is possibl...