PT-2025-20558

Name of the Vulnerable Software and Affected Versions Yifang CMS version 2.0.2 Description The issue is related to Server-Side Request Forgery SSRF in the "/api/file/getRemoteContent" API endpoint. This allows an attacker to forge requests from the server to an arbitrary destination, potentially...

Information Disclosure

github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability is due to insufficient input validation or improper handling of malformed payloads, which allows an attacker to expose sensitive information by triggering logging of secret data during secret creation or update...

CVE-2025-20187

Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage) contains a vulnerability in the application data endpoints that could allow an authenticated, remote attacker to write arbitrary files via directory traversal due to improper API request validation. Exploitation would require sending m...

CVE-2025-20210 Cisco Catalyst Center Unprotected API Endpoint

A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings. This vulnerability is due to the lack of authentication in an API endpoint. An attacker could...

Cisco Catalyst Center Unauthenticated API Access Vulnerability

A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings. This vulnerability is due to the lack of authentication in an API endpoint. An attacker could...

PT-2025-20259 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager versions affected versions not specified Description: A vulnerability in the application data endpoints could allow an authenticated, remote attacker to write arbitrary files to an affected system. This issue is...

CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds a...

PT-2025-19784 · Brcc · Brcc

Name of the Vulnerable Software and Affected Versions: brcc version 1.2.0 Description: The issue is related to incorrect access control in the "/admin/" API endpoint, which allows attackers to gain access to Admin rights via a crafted request. Recommendations: For brcc version 1.2.0, as a tempora...

GHSA-GCQF-F89C-68HV Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

Vault Community and Vault Enterprise Key/Value kv Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is...

SUSE-SU-2025:1439-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2025-32414: Fixed an out-of-bounds read when parsing text via the Python API. bsc1241551 - CVE-2025-32415: Fixed a crafted XML document may lead to a heap-based buffer under-read. bsc1241453...

CVE-2024-48907

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...

PT-2025-18678 · Tenda · Tenda W20E

Name of the Vulnerable Software and Affected Versions: Tenda W20E version 15.11.0.6 Description: A command injection issue was found in the formSetDebugCfg function through the level parameter. This issue allows attackers to execute arbitrary commands via a manipulated request. Recommendations: F...

Cross-Site Scripting (XSS)

github.com/songquanpeng/one-api is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation and sanitization of the argument "Homepage Content/About System/Footer.", allows malicious content to be injected and executed in the user's browser...

CVE-2025-2811 GL.iNet GL-A1300 Slate Plus API redos

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

CVE-2025-2811 GL.iNet GL-A1300 Slate Plus API redos

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

GL.iNet多款产品 安全漏洞

GL.iNet GL-A1300 Slate Plus and others are products of China's GL.iNet GL.iNet.GL.iNet GL-A1300 Slate Plus is a high performance travel router.GL.iNet GL-AR300M16 Shadow is a portable OpenWrt router.GL. iNet GL-AR300M Shadow is a router. A security vulnerability exists in several GL.iNet products...

PT-2025-17954 · Gl.Inet · Gl-A1300 Slate Plus +22

Name of the Vulnerable Software and Affected Versions: GL.iNet GL-A1300 Slate Plus version 4.x GL.iNet GL-AR300M16 Shadow version 4.x GL.iNet GL-AR300M Shadow version 4.x GL.iNet GL-AR750 Creta version 4.x GL.iNet GL-AR750S-EXT Slate version 4.x GL.iNet GL-AX1800 Flint version 4.x GL.iNet...

GHSA-345Q-9JMQ-G9Q4 Moodle allows unauthenticated REST API user data exposure

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites where PHP is configured with zend.exceptionignoreargs = 'On' or...

CVE-2025-32044 Moodle: unauthenticated rest api user data exposure

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exceptionignoreargs = 1 in the...

CVE-2025-32044

CVE-2025-32044 affects Moodle via unauthenticated access to sensitive user data exposed through stack traces returned by specific REST API calls. Affected until PHP is configured with zend.exception_ignore_args != 1 (sites with zend.exception_ignore_args = 1 are not affected). The CVE entry notes...