PT-2025-15701 · Verydows · Verydows

Name of the Vulnerable Software and Affected Versions: verydows version 2.0 Description: The issue is related to insecure permissions, allowing a remote attacker to execute arbitrary code by uploading a specific file type. This can be achieved through the action of loading a particular type of...

CVE-2025-29394

An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type...

BentoML 代码问题漏洞

BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions prior to 1.4.8 that stems from insecure deserialization and could...

Schneider Electric Trio Q Licensed Data Radio 安全漏洞

Schneider Electric Trio Q Licensed Data Radio is a radio from Schneider Electric France. A security vulnerability exists in Schneider Electric Trio Q Licensed Data Radio versions prior to v2.7.2, which stems from insecure storage of sensitive information and could lead to unauthorized access...

📄 Artica Proxy 4.50 Remote Code Execution

Artica Proxy version 4.50 suffers from a remote code execution vulnerability due to insecure deserialization. Exploit Title: CVE-2024-2054 Artica-Proxy administrative web application insecure deserialization RCE Google Dork: Date: 23-04-2024 Exploit Author: Madan Vendor Homepage:...

The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of Remote Desktop Services RDS for Windows operating systems lies in the use of insecure mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2025-29394

An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type...

CVE-2025-29394

CVE-2025-29394 affects verydows v2.0. The issue is an insecure permissions flaw in file uploads that permits a remote attacker to execute arbitrary code. Root cause: improper handling of uploaded files (permissions) enabling code execution. Evidence across sources confirms impact as remote code e...

CVE-2025-29809

Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally...

CVE-2025-29809

CVE-2025-29809 is a Windows Kerberos security feature bypass vulnerability. The issue involves insecure storage of sensitive information in Kerberos, enabling an attacker with local access and low privileges, and no user interaction, to bypass a security feature. Affected product/area: Windows Ke...

CVE-2025-27443

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access...

CVE-2025-27443

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access...

CVE-2025-27443

CVE-2025-27443 concerns Zoom Workplace Apps for Windows, caused by insecure default variable initialization in the affected software. The vulnerability could allow an authenticated user to cause a loss of integrity via local access. Multiple connected sources consistently describe the issue in Zo...

CVE-2025-27443 Zoom Workplace Apps for Windows - Insecure Default Variable Initialization

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access...

CVE-2025-27443 Zoom Workplace Apps for Windows - Insecure Default Variable Initialization

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access...

CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is...

CVE-2025-32028

CVE-2025-32028 affects HAX CMS PHP. The issue lies in the save() function in HAXCMSFile.php, which blocks only a non-exhaustive list of file types (.php, .sh, .js, .css); the logic is described as fail-open, enabling insecure file uploads. This can lead to remote code execution as described acros...

CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is...

CVE-2025-29985

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-29985

Dell Common Event Enabler, versions CEE 9.0.0.0, contains an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus Agent CAVA. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...