PT-2025-4370

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A critical issue was identified in the "/WeGIA/html/socio/sistema/controller/controla xlsx.php" endpoint, which accepts file uploads without proper validation. This allows the upload of malicious...

CVE-2024-48457

An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a...

PT-2024-36416 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat Admin version 2.2.0-beta Description: The issue is a cross-site scripting XSS vulnerability. It affects the /admin/articles/create endpoint. Recommendations: For Dcat Admin version 2.2.0-beta, consider disabling access to the...

PYSEC-2024-298

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information SETTINGSSUPPORT. This is due to inadequate access control for support information...

PT-2024-17481 · Bit Form · The Contact Form By Bit Form

Name of the Vulnerable Software and Affected Versions: The Contact Form by Bit Form versions up to, and including, 2.17.3 Description: The issue is related to unauthorized access of data due to a missing capability check on the "bitform-form-entry-edit" endpoint. This allows authenticated attacke...

PT-2024-36241 · WordPress · Wp Mailster

Name of the Vulnerable Software and Affected Versions: WP Mailster versions 1.8.17.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF problem, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

CVE-2024-55660 SiYuan has an SSTI via /api/template/renderSprig

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection SSTI through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables...

CVE-2024-8676 Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...

PT-2024-33292 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: An issue was discovered in Logpoint where an endpoint used by Distributed Logpoint Setup was exposed. This exposure allows unauthenticated attackers to bypass CSRF protections and authentication...

PT-2024-33082 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: The issue concerns a Cross-Site Scripting XSS vulnerability. It can be exploited via the nm religiao parameter in the "/intranet/educar religiao lst.php?busca=S&nm religiao=" endpoint...

PT-2024-11552 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for Sensitive Data Exposure through a GET request to "/user/getUserWithTeam". This requires authentication and discloses information associated with all registered user ID...

PT-2024-33482 · Zimaos · Zimaos

Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows authenticated users to perform a directory traversal attack via the API endpoint http:///v2 1/file, enabling access to sensitive system directories such as /etc. This could expos...

Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Patches Will be patched in 14.3.1 and 15.0.0. Workarounds...

Improper Authentication

github.com/ory/kratos is vulnerable to an Improper Authentication. The vulnerability is due to an incorrect assumption of the highest available Authentication Assurance Level AAL as aal1 instead of aal2, allowing users to access endpoints without the required aal2 session under certain...

PT-2024-31871 · Unknown · Blood Bank/Donation Management System

Name of the Vulnerable Software and Affected Versions: Blood Bank and Donation Management System version 1.0 Description: A Cross Site Scripting XSS issue is present in the update contact.php file, allowing an attacker to inject malicious scripts via the name parameter of the "update contact.php"...

PT-2024-39074 · Lmxcms · Lmxcms

Name of the Vulnerable Software and Affected Versions: lmxcms versions up to 1.4 Description: A critical issue was found in the function formatData of the file /admin.php?m=Acquisi&a=testcj&lid=1, which is part of the SQL Command Execution Module. The manipulation of the argument data leads to co...

PT-2024-29379 · Organizr · Organizr

Name of the Vulnerable Software and Affected Versions: Organizr version 1.90 Description: The issue is related to Cross Site Scripting XSS via the "api.php" endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users' sessions. Recommendations: Fo...

PT-2024-22971 · Sportsnet · Sportsnet

Name of the Vulnerable Software and Affected Versions: SportsNET version 4.0.1 Description: The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query to the...

K000140787: Gunicorn vulnerability CVE-2024-1135

Security Advisory Description Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling HRS vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This iss...

PT-2024-30003 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: publiccms versions V4.0.202302.e and before Description: The issue concerns an Any File Upload vulnerability via the "publiccms/admin/cmsTemplate/saveMetaData" endpoint. This allows unauthorized file uploads, potentially leading to security...