CVE Vulnerability Catalog

Podatność CVE-2025-11025 dotyczy platformy Vimesoft Corporate Messaging, która pozwala na wyciąganie wbudowanych danych wrażliwych z wysyłanych wiadomości. Problem ten występuje w wersjach od V1.3.0 do przed V2.0.0.

A security flaw has been discovered in OGRECave Ogre up to 14.4.1 affecting the STBIImageCodec::encode function in /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp of the Image Handler component. The manipulation results in a heap-based buffer overflow. The attack is only possible with local access, and the exploit has been released to the public.

BehaviorTree through version 4.7.0 contains a stack-based buffer overflow in the ParseScript function in /src/script_parser.cpp (Diagnostic Message Handler component) via manipulation of the error_msgs_buffer argument. The attack requires local access and the exploit has been publicly disclosed.

A vulnerability has been found in libucl up to version 0.9.2 in the ucl_include_common function of /src/ucl_util.c. Manipulation leads to a heap-based buffer overflow. Local access is required and the exploit has been publicly disclosed.

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. It allows an attacker to cause uncontrolled CPU consumption via specific GraphQL queries, potentially leading to a Denial of Service (DoS) condition.

GitLab EE versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 contain a privilege escalation issue. A developer with specific group management permissions could escalate privileges and gain unauthorized access to additional system capabilities.

The Google+ Comments plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.

The kontur Admin Style plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.4.

The SEO Search Permalink plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.3.

The Silencesoft RSS Reader plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation. This issue affects versions up to and including 0.6.

The Click & Tweet plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 0.8.9.

The Recaptcha – wp plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 0.2.6.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Page Manager for Elementor from n/a through <= 2.0.5.

Missing Authorization vulnerability in WP Subscription Forms PRO allows exploiting incorrectly configured access control security levels. This issue affects WP Subscription Forms PRO from n/a through <= 2.0.5.

The Frames plugin by HaruTheme has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Frames versions from n/a through 1.5.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count allows DOM-Based XSS. This issue affects bbp topic count from n/a through <= 3.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows DOM-Based XSS. This issue affects Job Board Manager from n/a through <= 2.1.61.

Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery. This issue affects ZoloBlocks from n/a through <= 2.3.11.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products ai-related-products allows Stored XSS. This issue affects Smart Related Products from n/a through <= 2.0.8.

The Nota Fiscal Eletrônica WooCommerce plugin up to version 3.4.0.9 has missing authorization, allowing exploitation of incorrectly configured access control security levels.