PT-2025-22869 · H3C · H3C Seccenter Smp-E1114P02

Name of the Vulnerable Software and Affected Versions: H3C SecCenter SMP-E1114P02 up to 20250513 Description: A critical issue affects the function fileContent of the file /cfgFile/fileContent. The manipulation of the argument filePath leads to path traversal. This issue can be exploited remotely...

PT-2025-22854 · Qualitor · Qualitor

Name of the Vulnerable Software and Affected Versions: Qualitor version 8.20 Description: A critical issue affects some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php. The manipulation of the nmconexao argument leads to command injection. This issu...

PT-2025-22847 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall Demo up to 20250505 Description: A vulnerability was found in the processing of the file tmall/admin/account/logout, which leads to cross-site request forgery. The attack may be initiated remotely. The issue affects some unknown...

PT-2025-22838

Name of the Vulnerable Software and Affected Versions eMagicOne Store Manager for WooCommerce plugin for WordPress versions 1.2.5 and earlier Description The issue arises from missing file type validation in the set image function, allowing unauthenticated attackers to upload arbitrary files on t...

PT-2025-22844 · Unknown +1 · Msasn1.Dll +1

Name of the Vulnerable Software and Affected Versions: Sangfor aTrust version 2.3.10.60 Description: A critical vulnerability has been found in Sangfor aTrust, affecting an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is require...

PT-2025-22846 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall Demo up to 20250505 Description: A critical vulnerability was found in Tmall Demo, affecting the uploadCategoryImage function of the file tmall/admin/uploadCategoryImage. The manipulation of the File argument leads to unrestricted uploa...

PT-2025-22842 · Flir · Flir Ax8

Name of the Vulnerable Software and Affected Versions: FLIR AX8 versions up to 1.46.16 Description: A problematic issue has been found in the processing of the file /prod.php, where the manipulation of the cmd argument leads to cross-site scripting. This issue can be exploited remotely...

PT-2025-22827 · WordPress · 4Stats

Name of the Vulnerable Software and Affected Versions: 4stats plugin for WordPress versions up to, and including, 2.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the "stats/stats.php" page. This allows unauthenticated attackers...

PT-2025-22839 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Reflected Cross-Site Scripting via the login url parameter due to insufficient input...

PT-2025-23625 · Totolink · Totolink X15

Name of the Vulnerable Software and Affected Versions: TOTOLINK X15 version 1.0.0-B20230714.1105 Description: A critical vulnerability was found in the TOTOLINK X15, affecting the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the deviceMacAddr argument leads to a...

CVE-2025-47942

The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the pythonlib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course...

CVE-2024-47869

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

CVE-2024-34701

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made...

CVE-2024-0965

The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's page restriction and view page content...

CVE-2024-4739

The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource...

CVE-2024-4354

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the getfilestoimport function. This makes it possible for authenticated attackers, with author-level access and above, to make web request...

CVE-2023-49003

An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity...

CVE-2023-4570

An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using versi...

CVE-2023-34239

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in...

CVE-2022-46158

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to...