PT-2025-42650

Name of the Vulnerable Software and Affected Versions Apache Geode versions 1.10 through 1.15.1 Description Apache Geode is susceptible to Cross-Site Request Forgery CSRF attacks via GET requests to the Management and Monitoring REST API. Successful exploitation could allow an attacker to execute...

PT-2025-42596

Name of the Vulnerable Software and Affected Versions Hikvision iSecure Center affected versions not specified Description The software contains insufficient parameter validation, leading to a command injection issue. Attackers may be able to gain platform privileges and execute arbitrary command...

F5 BIG-IP Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An elevation of privilege vulnerability exists in the BIG-IP's iControl REST and TMOS Shell tmsh modules. The vulnerability...

CVE-2025-62422: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...

CVE-2023-28815: Improper Neutralization of Parameter/Argument Delimiters

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domest...

CVE-2025-34514

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...

CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...

CVE-2025-53868

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

BIT-VALKEY-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

BIT-REDIS-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48437 Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in corp-ais-client-my-channel-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a5c6a2e2c6632d11abe65b902c4dee848386ec4240aba0fee8f76983ac4ff56 The OpenSSF Package Analysis project identified 'corp-ais-client-my-channel-lib' @ 99.9.10 npm as malicious. It is considered malicious because:...

MAL-2025-48433 Malicious code in corp-ais-client-my-channel-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a5c6a2e2c6632d11abe65b902c4dee848386ec4240aba0fee8f76983ac4ff56 The OpenSSF Package Analysis project identified 'corp-ais-client-my-channel-lib' @ 99.9.10 npm as malicious. It is considered malicious because:...

Malicious code in company-browser-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7621dd08044aeaacb68745078c793611d91031eb9852f8f667f739d485efe939 The OpenSSF Package Analysis project identified 'company-browser-package' @ 99.9.10 npm as malicious. It is considered malicious because: - The...

Malicious code in internal-plugin-lifecycle-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 332aa89488a5ecb7012588f98648ef97de374565f906dfc69ff80d4d344e9a03 The OpenSSF Package Analysis project identified 'internal-plugin-lifecycle-card' @ 99.9.10 npm as malicious. It is considered malicious because:...

MAL-2025-48434 Malicious code in internal-plugin-lifecycle-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 332aa89488a5ecb7012588f98648ef97de374565f906dfc69ff80d4d344e9a03 The OpenSSF Package Analysis project identified 'internal-plugin-lifecycle-card' @ 99.9.10 npm as malicious. It is considered malicious because:...

PT-2025-42535

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Description Bagisto is susceptible to Server-Side Template Injection SSTI because user-provided input isn't properly sanitized when processing product descriptions with the server-side templating engine. An...

PT-2025-42502

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden Description The software contains authenticated OS command injection flaws in several web-accessible PHP scripts. These scripts utilize the exec function, enabling a verified attacke...

CVE-2025-34514: Improper Neutralization of Special Elements used in an OS Command

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...