PT-2025-34002 · WordPress · Bearsthemes Alone

Name of the Vulnerable Software and Affected Versions: Bearsthemes Alone affected versions not specified Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Bearsthemes Alone allows Code Injection. Recommendations: At the moment, there is no information about a...

CVE-2025-54750: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.11.1...

CVE-2025-9263: Improper Control of Resource Identifiers

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers...

PT-2025-33497

Name of the Vulnerable Software and Affected Versions: Wulkano KAP version 3.6.0 Description: Improper Control of Generation of Code 'Code Injection' in Wulkano KAP on MacOS allows TCC Bypass. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...

CVE-2025-39483

CVE-2025-39483 is an Unauthenticated Shortcode/Code Injection vulnerability in the imithemes Eventer WordPress plugin. Affected: Eventer before 3.9.9.1 (via versions up to 3.9.6 per sources). Impact: shortcodes could be abused to inject code. Remediation: update Eventer to version 3.9.9.1 or late...

CVE-2025-3703: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This issue affects CSS & JavaScript Toolbox: from n/a through 12.0.3...

CVE-2025-55346: Improper Control of Generation of Code

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

PT-2025-33241 · Thembay · Urna

Name of the Vulnerable Software and Affected Versions: thembay Urna versions through 2.5.7 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. Recommendations:...

CVE-2025-39483: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a through 3.9.9.1...

CVE-2025-42950: Improper Control of Generation of Code

SAP Landscape Transformation SLT allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as...

CVE-2025-8793: Improper Control of Resource Identifiers

A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument projectID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has be...

CVE-2025-54613: Improper Control of a Resource Through its Lifetime

Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability...

CVE-2025-54619: Improper Control of a Resource Through its Lifetime

Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availability...

CVE-2025-54612: Improper Control of a Resource Through its Lifetime

Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability...

Improper Control of Interaction Frequency

Overview django-smart-ratelimit is an A flexible and efficient rate limiting library for Django applications Affected versions of this package are vulnerable to Improper Control of Interaction Frequency via counter.save function that does not implement atomic increments. In the fixed-window backe...

CVE-2025-8030: Improper Control of Generation of Code

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

CVE-2025-24937: Improper Control of Filename for Include/Require Statement in PHP Program

File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible...

CVE-2025-53927: Improper Control of Generation of Code

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the shutil.copy2 method in Python to copy the command they...

CVE-2024-47065: Improper Control of Interaction Frequency

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously...

The vulnerability of the channel.c component in the Linux operating system’s kernel allows a hacker to gain access to confidential data.

The vulnerability of the channel.c component in the Linux operating system’s kernel is related to improper control of resource identifiers. Exploiting this vulnerability can allow an attacker to access confidential data...