PT-2025-20706 · Ооо "Юзергейт" · Usergate Next-Generation Firewall

Уязвимость сервиса HTTP-Proxy программного обеспечения межсетевого экрана UserGate Next-Generation Firewall NGFW существует из-за отсутствия мер по проверке вводимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, читать произвольные файлы...

PT-2025-18186 · Unknown · Phpgurukul Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul COVID19 Testing Management System version 1.0 Description: A critical issue has been found in the PHPGurukul COVID19 Testing Management System, affecting the file /test-details.php. The manipulation of the Status argument leads to...

PT-2025-18204 · Unknown · Phpgurukul Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Nurse Hiring System version 1.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /admin/view-request.php. The manipulation of the viewid argument leads to SQL injection. This...

PT-2025-18190 · Unknown · Phpgurukul Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Nurse Hiring System version 1.0 Description: A critical issue affects the processing of the file /admin/edit-nurse.php, leading to sql injection. The attack may be initiated remotely. Multiple parameters might be affected...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

PT-2025-18120 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: snowflake-connector-net versions 2.1.2 through 4.4.0 Description: The issue concerns a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the connector reads logging configuration from ...

VulnCheck KEV: CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content...

PT-2025-18037 · Unknown · Seeyon Zhiyuan Oa Web Application System

Name of the Vulnerable Software and Affected Versions: Seeyon Zhiyuan OA Web Application System version 8.1 SP2 Description: A problematic issue has been found in the Seeyon Zhiyuan OA Web Application System, affecting some unknown processing of the file...

CVE-2025-27937

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory 'Path Traversal'. If exploited, an arbitrary file in the affected product may be obtained by a remote attacker who can log in to the product...

CVE-2025-27937

CVE-2025-27937 affects SIOS Quick Agent V3 and V2 (Windows). The issue is a path traversal vulnerability (improper limitation of a pathname to a restricted directory) in the product, allowing a remote attacker to obtain an arbitrary file in the affected product after logging in. Affected versions...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-3606

Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device...

PT-2025-17983 · Unknown · Withstars Books-Management-System

Name of the Vulnerable Software and Affected Versions: withstars Books-Management-System version 1.0 Description: A vulnerability was found in the system, affecting an unknown functionality of the file /reader delete.html. This issue leads to cross-site request forgery and can be launched remotel...

PT-2025-18027 · Unknown · Quick Agent V3 +1

Name of the Vulnerable Software and Affected Versions: Quick Agent V3 and Quick Agent V2 affected versions not specified Description: The issue involves an improper limitation of a pathname to a restricted directory, commonly referred to as a Path Traversal issue. If exploited, an arbitrary file ...

The vulnerability of the LockDatabaseSettings method in the software for managing and monitoring deleted objects in telemetry and telemechanics systems, allowing a hacker to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the LockDatabaseSettings method in software for managing and monitoring deleted objects in telemetry and telemechanics systems related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass security...

The vulnerability of the UnlockTcmSettings method in the software for managing and monitoring deleted objects in telemetering and telemechanics systems allows a perpetrator to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the UnlockTcmSettings method in the software for managing and monitoring removed objects in Telemetry and Telemechanics systems is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass securi...

PT-2025-18002 · Unknown · Scriptandtools Ecommerce-Website-In-Php

Name of the Vulnerable Software and Affected Versions: ScriptAndTools eCommerce-website-in-PHP version 3.0 Description: A vulnerability was found in the processing of the file /admin/subscriber-csv.php, which can lead to information disclosure. The attack may be initiated remotely. Recommendation...

CVE-2025-28233

Incorrect access control in BW Broadcast TX600 14980, TX300 32990 31448, TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking...

CVE-2025-37087

A vulnerability in the cmdb service of the HPE Performance Cluster Manager HPCM could allow an attacker to gain access to an arbitrary file on the server host...

CVE-2025-32950

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server...