Our news and updates

In Pgpool-II versions 4.0 and 4.1 series, 4.2.0 to 4.2.21, 4.3.0 to 4.3.14, 4.4.0 to 4.4.11, 4.5.0 to 4.5.6 and 4.6.0 a critical severity vulnerability CVE-2025-46801 was detected. This vulnerability allows attackers to bypass authentication and log in as arbitrary users, enabling them to read, modify, or disable data in the connected database. To address this issue, users should upgrade Pgpool-II to versions 4.6.1, 4.5.7, 4.4.12, 4.3.15, 4.2.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46801.

In LibreNMS versions up to and including 25.4.0 a low severity vulnerability CVE-2025-47931 was detected. This vulnerability allows attackers to inject malicious scripts via the group name parameter in the /poller/groups form, potentially executing those scripts when viewed by other users. To address this issue, users should upgrade LibreNMS to version 25.5.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47931.

In Wise Chat plugin for WordPress versions up to and including 3.3.3 a high severity vulnerability CVE-2024-13613 was detected. This vulnerability allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, potentially exposing file attachments from chat messages. To address this issue, users should upgrade Wise Chat plugin to versions 3.3.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13613.

In Zulip versions 10.0 to before 10.3 a medium severity vulnerability CVE-2025-47930 was detected. This vulnerability allows attackers to bypass the “Who can create public channels” access control by creating a private or web-public channel and then changing its privacy setting to public. Similarly, private channels can be created without proper permissions using the API or by altering HTML. To address this issue, users should upgrade Zulip to version 10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47930.

In WP Booking Calendar plugin for WordPress versions up to and including 10.11.1 a medium severity vulnerability CVE-2025-4669 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the wpbc shortcode, which execute when a user accesses an injected page, due to insufficient input sanitization and output escaping. To address this issue, users should upgrade WP Booking Calendar plugin to versions 10.11.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4669.

In Jupiter X Core plugin for WordPress versions up to and including 4.8.12 a medium severity vulnerability CVE-2025-3888 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via SVG file inclusion due to insufficient input sanitization and output escaping, leading to script execution when a user accesses the affected page. To address this issue, users should upgrade Jupiter X Core plugin to versions 4.9.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3888.

In EventON Pro plugin versions up to and including 4.9.6 a medium severity vulnerability CVE-2025-3527 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts due to a missing capability check in the assets/lib/settings/settings.js file, leading to script execution when a user accesses an affected page. To address this issue, users should upgrade EventON Pro plugin to versions 4.9.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3527.

In Mattermost versions 10.6.x ≤ 10.6.1, 10.5.x ≤ 10.5.2, 10.4.x ≤ 10.4.4 and 9.11.x ≤ 9.11.11 a medium severity vulnerability CVE-2025-31947 was detected. This vulnerability allows attackers to cause external LDAP accounts to be locked out by triggering repeated login failures through Mattermost, as LDAP users are not locked out properly. To address this issue, users should upgrade Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31947.

In Mattermost versions 10.6.x ≤ 10.6.1, 10.5.x ≤ 10.5.2, 10.4.x ≤ 10.4.4 and 9.11.x ≤ 9.11.11 a medium severity vulnerability CVE-2025-3446 was detected. This vulnerability allows authenticated users with permission only to invite non-guest users to add guest users to teams via the API. To address this issue, users should upgrade Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3446.