Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,780 results · page 13 of 36
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48487 · Other software · freescout-help-desk · reported by GitHubMedium 6
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message after a completed action, it is possible to inject a payload to exploit XSS vulnerability. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48486 · Other software · freescout-help-desk · reported by GitHubMedium 6.1
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of input validation and sanitization in both \Session::flash and __, allowing user input to be executed without proper filtering. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48485 · Other software · freescout-help-desk · reported by GitHubMedium 6.1
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data when an authenticated user updates the profile of an arbitrary customer. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48484 · Other software · freescout-help-desk · reported by GitHubMedium 4.6
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. This issue has been patched in version 1.8.178.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48483 · Other software · freescout-help-desk · reported by GitHubMedium 6.3
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additionally, if an administrator accesses one of these emails with a modified signature, it could result in a subsequent Cross-Site Request Forgery (CSRF) vulnerability. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48482 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill() method is called with all client-provided data, including unexpected values for channel and channel_id, leading to a mass assignment vulnerability. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48481 · Other software · freescout-help-desk · reported by GitHubMedium 6.1
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link from the email to gain initial access to the account. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48480 · Other software · freescout-help-desk · reported by GitHubHigh 7
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERM_EDIT_USERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's avatar, resulting in the deletion of the file .htaccess in the folder /storage/app/public. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48479 · Other software · freescout-help-desk · reported by GitHubHigh 8.5
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the laravel-translation-manager package does not correctly validate user input, enabling the deletion of any directory, given sufficient access rights. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48478 · Other software · freescout-help-desk · reported by GitHubHigh 7
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a mass assignment vulnerability, allowing an attacker to manipulate all fields of the object, which are enumerated in the $fillable array (the User object), when creating a new user. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48477 · Other software · freescout-help-desk · reported by GitHubHigh 7.1
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence of actions to implement a functional capability, but the application allows access to the functional capability without correctly completing one or more actions in the sequence. The leaves the attributes of Mailbox object able to be changed by the fill method. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48476 · Other software · freescout-help-desk · reported by GitHubHigh 7.1
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result, a user with the right to edit other users of the system can change their password, and then log in to the system using the set password. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48475 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the existing mailboxes, as well as to any of the existing conversations, has the ability to view and edit the System's clients. The limitation of client visibility can be implemented by the limit_user_customer_visibility setting, however, in the specified scenarios, there is no check for the presence of this setting. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48474 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with show_only_assigned_conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. This issue has been patched in version 1.8.180.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48473 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other mailboxes or from other conversations to which they do not have access (access restriction to conversations is implemented by the show_only_assigned_conversations setting, which is also not checked). This issue has been patched in version 1.8.179.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48472 · Other software · freescout-help-desk · reported by GitHubMedium 6.9
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have access to the mailbox, then after disabling (enabling) notifications for this mailbox, the user will gain access to it. This issue has been patched in version 1.8.179.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48471 · Other software · freescout-help-desk · reported by GitHubHigh 7
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code execution if the Apache web server is used. This issue has been patched in version 1.8.179.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48390 · Other software · freescout-help-desk · reported by GitHubHigh 8.6
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the php_path parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the file_exists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as php_path, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48389 · Other software · freescout-help-desk · reported by GitHubHigh 8.6
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025FreeScout is a free self-hosted help desk and shared mailbox.CVE-2025-48388 · Other software · freescout-help-desk · reported by GitHubHigh 7
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Unrestricted Upload of File with Dangerous TypeCVE-2025-47658 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.2.9.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu.CVE-2025-25539 · Other software · Onespan · reported by MITREMedium 6.5
Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu.
- Product
- Vasco Self-service Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.github.com
May 20, 2025In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function calCVE-2025-37965 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()" The populate_dml_plane_cfg_from_plane_state() uses the GFP_KERNEL flag for memory allocation, which shouldn't be used in atomic contexts. The allocation is needed only for using another helper function get_scaler_data_for_plane(). [How] Modify helpers to pass a pointer to scaler_data within existing context, eliminating the need for dynamic memory allocation/deallocation and copying. (cherry picked from commit bd3e84bc98f81b44f2c43936bdadc3241d654259)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 10, 2025libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at tCVE-2025-47816 · Other software · GNU · reported by MITRELow 2.9
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document.
- Product
- PSPP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsavannah.gnu.orgsavannah.gnu.org
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't ownCVE-2023-53084 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_iocCVE-2023-53035 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO. This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side. KMSAN-enabled kernels detect this issue as follows: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0xc0/0x100 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:169 [inline] nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025Auth0 Account Link Extension is an extension aimed to help link accounts easily.CVE-2025-46345 · Other software · auth0-extensions · reported by GitHubMedium 6.9
Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater.
- Product
- auth0-account-link-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper Move the gfn_to_pfn_cache lock CVE-2022-49884 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper Move the gfn_to_pfn_cache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvm_gfn_to_pfn_cache_init()'s ability to re-initialize the cache's locks. For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock. (thread 1) | (thread 2) | kvm_xen_set_evtchn_fast | read_lock_irqsave(&gpc->lock, ...) | | kvm_gfn_to_pfn_cache_init | rwlock_init(&gpc->lock) read_unlock_irqrestore(&gpc->lock, ...) | Rename "cache_init" and "cache_destroy" to activate+deactivate to avoid implying that the cache really is destroyed/freed. Note, there more races in the newly named kvm_gpc_activate() that will be addressed separately. [sean: call out that this is a bug fix]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: bpf: Fix wrong reg type conversion in release_reference() Some helper functions will allocCVE-2022-49873 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix wrong reg type conversion in release_reference() Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release these memories by calling the corresponding helper functions. When a resource is released, all pointer registers corresponding to the resource should be invalidated. The verifier use release_references() to do this job, by apply __mark_reg_unknown() to each relevant register. It will give these registers the type of SCALAR_VALUE. A register that will contain a pointer value at runtime, but of type SCALAR_VALUE, which may allow the unprivileged user to get a kernel pointer by storing this register into a map. Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this problem.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 27, 2025An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool coCVE-2025-3886 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 5.7
An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool component.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Apr 24, 2025WP AVCL Automation Helper (formerly WPFlyLeads): Server-Side Request Forgery (SSRF)CVE-2025-46531 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.
- Product
- WP AVCL Automation Helper (formerly WPFlyLeads)
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update WP AVCL Automation Helper (formerly WPFlyLeads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Appsero Helper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39377 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.
- Product
- Appsero Helper
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025HelpGent: Deserialization of Untrusted DataCVE-2025-32658 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.
- Product
- HelpGent
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update HelpGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP Helper Premium: Missing AuthorizationCVE-2025-24737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mat Bao Corporation WP Helper Premium wp-helper-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Helper Premium: from n/a through <= 4.6.1.
- Product
- WP Helper Premium
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update WP Helper Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumCVE-2025-22104 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow was possible. Therefore, create a new ibmvnic function that loops over a buffer and calls hex_dump_to_buffer instead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3: Login Buffer: ibmvnic 30000003 env3: 01000000af000000 <...> ibmvnic 30000003 env3: 2e6d62692e736261 ibmvnic 30000003 env3: 65050003006d6f63 ================================================================== BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic] Read of size 8 at addr c0000001331a9aa8 by task ip/17681 <...> Allocated by task 17681: <...> ibmvnic_login+0x2f0/0xffc [ibmvnic] ibmvnic_open+0x148/0x308 [ibmvnic] __dev_open+0x1ac/0x304 <...> The buggy address is located 168 bytes inside of allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf) <...> =====================================================
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 15, 2025Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter.CVE-2025-32993 · Other software · Vision Helpdesk · reported by MITREMedium 6.5
Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authentication is not needed.
- Product
- Vision Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnav1n.medium.comvisionhelpdesk.com
Apr 10, 2025SEO Help: Missing AuthorizationCVE-2025-32244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuantumCloud SEO Help seo-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Help: from n/a through <= 6.7.9.
- Product
- SEO Help
- Affected
- up to 6.7.9
- What to do
- Affects up to 6.7.9. Update SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025SEO Help: Server-Side Request Forgery (SSRF)CVE-2025-32675 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a through <= 6.7.9.
- Product
- SEO Help
- Affected
- up to 6.7.9
- What to do
- Affects up to 6.7.9. Update SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base: Sensitive Information ExposureCVE-2024-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
- Product
- KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 3, 2025Support Helpdesk Ticket System Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alisaleem252 Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2.
- Product
- Support Helpdesk Ticket System Lite
- Affected
- up to 4.5.2
- What to do
- Affects up to 4.5.2. Update Support Helpdesk Ticket System Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30901 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30886 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30882 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.
- Product
- JS Help Desk
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Missing AuthorizationCVE-2025-30880 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30878 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Awesome Support – WordPress HelpDesk & Support: Sensitive Information ExposureCVE-2024-13567 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2025Zulip server provides an open-source team chat that helps teams stay productive and focused.CVE-2025-27149 · Other software · zulip · reported by GitHubMedium 4.6
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems.CVE-2025-30205 · Other software · oddlama · reported by GitHubHigh 7.6
kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag `v1.2.0` or higher. As a workaround, the user can set the log level `KANIDM_LOG_LEVEL` to any level higher than `info`, for example `warn`.
- Product
- kanidm-provision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Appsero Helper: Cross-Site Request ForgeryCVE-2024-13436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'appsero_helper' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Appsero Helper
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2025XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance.CVE-2025-27604 · Websites & servers · xwikisas · reported by GitHubHigh 7.5
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.
- Product
- application-confluence-migrator-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.