CVE-2025-42901 Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability ...

CVE-2025-42901

CVE-2025-42901 affects SAP Application Server for ABAP (BAPI Explorer) where an authenticated attacker can store malicious JavaScript payloads that execute in the victim’s browser. Impact is described as low for confidentiality and integrity, with no availability impact. Root cause involves store...

FreePBX Endpoint Manager 操作系统命令注入漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from the FreePBX open source. An operating system command injection vulnerability exists in FreePBX Endpoint Manager versions prior to 16.0.92 and prior to 17.0.6, which stems from insufficient user input cleanup, an...

HPE Aruba Networking EdgeConnect OS 安全漏洞

HPE Aruba Networking EdgeConnect OS is an operating system from HPE America. A security vulnerability exists in HPE Aruba Networking EdgeConnect OS that stems from an arbitrary file deletion vulnerability in the command line interface, which could lead to an authenticated, remote malicious actor...

CVE-2025-54822: Improper Authorization

An improper authorization vulnerability CWE-285 vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an...

PT-2025-41929

Name of the Vulnerable Software and Affected Versions Ivanti EPMM versions prior to 12.6.0.2 Ivanti EPMM versions prior to 12.5.0.4 Ivanti EPMM versions prior to 12.4.0.4 Description A path traversal issue exists in the admin panel of Ivanti EPMM. A remote, authenticated attacker with...

PT-2025-41881

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to 4.0 SP1 Description A SQL injection issue exists in SINEC NMS. The vulnerability is present in the getTotalAndFilterCounts API endpoint. An authenticated attacker with low privileges can exploit this to insert data,...

CVE-2025-42901: Improper Control of Generation of Code

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability ...

CVE-2025-58324: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated attacker ...

PT-2025-41964

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 6.2 through 7.2.2 FortiSIEM versions 7.0 FortiSIEM versions 7.1 FortiSIEM versions 6.3 FortiSIEM versions 6.4 FortiSIEM versions 6.5 FortiSIEM versions 6.6 FortiSIEM versions 6.7 Description An improper neutralization of inp...

PT-2025-41983

Name of the Vulnerable Software and Affected Versions AOS firmware affected versions not specified Description A flaw exists in an AOS firmware binary that could allow a malicious, authenticated actor to permanently delete critical boot information. Exploitation of this issue can cause the system...

PT-2025-41987

Name of the Vulnerable Software and Affected Versions AOS-10 GW and AOS-8 Controller/Mobility Conductor affected versions not specified Description An arbitrary file download issue exists in the web-based management interface. Exploitation of this issue could allow an authenticated malicious acto...

PT-2025-41984

Name of the Vulnerable Software and Affected Versions AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description An issue exists that allows an authenticated malicious actor to download arbitrary files through crafted exploits. The...

CVE-2025-10243: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-10985: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

PT-2025-41988

Name of the Vulnerable Software and Affected Versions AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description An issue exists in a low-level interface library that could allow an authenticated malicious actor to download arbitrary...

Improper autorization over static files

...

Hewlett Packard Enterprise ArubaOS 安全漏洞

Hewlett Packard Enterprise ArubaOS HPE ArubaOS is a networked wireless operating system from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise ArubaOS HPE ArubaOS that originates from a low-level interface inventory in an arbitrary file download...

Hewlett Packard Enterprise ArubaOS 安全漏洞

Hewlett Packard Enterprise ArubaOS HPE ArubaOS is a networked wireless operating system from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise ArubaOS HPE ArubaOS that stems from an arbitrary file download vulnerability in the CLI binary, which could le...

CVE-2025-10732: Missing Authorization

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...