PT-2025-37258

Name of the Vulnerable Software and Affected Versions: InstantCMS versions through 2.17.3 Description: InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery SSRF vulnerability exists that allows authenticated remote attackers to make arbitrary...

CVE-2025-8696 DoS attack against the Stork UI from an unauthenticated user

If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0...

CVE-2025-10197 HJSoft HCM Human Resources Management System downlawbase sql injection

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection...

CVE-2025-10197 HJSoft HCM Human Resources Management System downlawbase sql injection

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection...

CVE-2025-10197

CVE-2025-10197 concerns HJSoft HCM Human Resources Management System (up to 20250822). The vulnerability is a SQL injection in an unknown functionality of the file path /templates/attestation/../../selfservice/lawresource/downlawbase, triggered by manipulating the ID argument. Remote exploitation...

CVE-2025-10197: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection...

PT-2025-37002

Name of the Vulnerable Software and Affected Versions: HJSoft HCM Human Resources Management System versions prior to 20250823 Description: A SQL injection issue exists in HJSoft HCM Human Resources Management System. The vulnerability is located in an unknown functionality of the file...

Phish-Blitz: Advancing Phishing Detection with Comprehensive Webpage Resource Collection and Visual Integrity Preservation

Phishing attacks are increasingly prevalent, with adversaries creating deceptive webpages to steal sensitive information. Despite advancements in machine learning and deep learning for phishing detection, attackers constantly develop new tactics to bypass detection models. As a result, phishing...

TCP/IP driver Privilege Escalation

The vulnerability of the TCP/IP driver for Windows operating systems is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Cloud-init Arbitrary Command Execution

The vulnerability of the Cloud-init configuration tool is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Brokering File System Privilege Escalation

The vulnerability of the Brokering File System BFS in Windows operating systems is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase their privileges...

Linux Distros Unpatched Vulnerability : CVE-2018-12475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service- downloadfiles of openSUSE Open Build Service allows authenticate...

Microsoft SQL Server Information Disclosure Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in SQL Server allows an authorized attacker to disclose information over a network...

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Graphics Kernel allows an authorized attacker to elevate privileges locally...

Liferay Portal is vulnerable to SSRF through custom object attachment fields

A server-side request forgery SSRF vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw...

PT-2025-36545

Name of the Vulnerable Software and Affected Versions: SAP HCM My Timesheet Fiori 2.0 application affected versions not specified Description: The SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of...

Nuxt Icon < 1.4.5 Server-Side Request Forgery

Nuxt Icon versions prior to 1.4.5 are vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs in the icon fetching functionality. An attacker can exploit this vulnerability by providing a malicious URL that points to an internal or restricted resource,...

CVE-2025-43763

A server-side request forgery SSRF vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw...

CVE-2025-43763

SSRF vulnerability CVE-2025-43763 affects Liferay Portal 7.4.0–7.4.3.131 and Liferay DXP 2024.Q1.1–Q4.7 across multiple 2024 releases, specifically in custom object attachment fields. An attacker can induce the application to make unauthorized requests to other instances, creating new object entr...

CVE-2025-43763

A server-side request forgery SSRF vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw...