CVE-2025-11009

The CVE-2025-11009 issue affects Mitsubishi Electric GT Designer3 (GOT2000 GOT1000) where credentials are stored in plaintext in project files (Cleartext Storage of Sensitive Information). Root cause: credentials verifi ed/stored in plaintext (CWE-312). Impact: local, unauthenticated attacker cou...

CVE-2025-65185

Summary: CVE-2025-65185 affects Entrinsik Informer v5.10.1, enabling username enumeration during local login by supplying an OTP code and a new password and observing application responses. The vulnerability's impact is described as low (CVSS v3.1: 2.8, LOCAL access, user interaction required). O...

PT-2025-51856

A reflected cross-site scripting XSS vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload...

itsourcecode Online Cake Ordering System SQL注入漏洞

itsourcecode Online Cake Ordering System is an online cake ordering system of itsourcecode open source. A SQL injection vulnerability exists in version 1.0 of itsourcecode Online Cake Ordering System, which stems from incorrect manipulation of the parameter ID in the file...

CVE-2025-65185

There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses...

Powerstone Affiliate Me SQL注入漏洞

Powerstone Affiliate Me is an affiliate marketing management system from Powerstone Ghana. A SQL injection vulnerability exists in Powerstone Affiliate Me version 5.0.1, which stems from improper manipulation of the admin.php endpoint id parameter, which could lead to a SQL injection attack...

CVE-2025-65185

There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses...

itsourcecode COVID Tracking System 安全漏洞

The itsourcecode COVID Tracking System is a new crown pneumonia tracking system open-sourced by itsourcecode. A security vulnerability exists in version 1.0 of itsourcecode COVID Tracking System, which stems from malicious code injection of the parameter id in the file /cts/admin/?page=zone, whic...

PT-2025-51973

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.1 Description Open OnDemand provides remote web access to supercomputers. The Apache proxy in versions 4.0.8 and earlier allows sensitive headers to be passed to origin servers. This could allow malicious user...

PT-2025-51841

Name of the Vulnerable Software and Affected Versions ITSourcecode COVID Tracking System Using QR-Code version 1.0 Description A SQL injection issue exists in the '/cts/admin/?page=zone' file. The issue occurs because malicious code can be injected through the id parameter and directly used in SQ...

RiteCMS 安全漏洞

RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a code execution vulnerability that stems from a flaw in the parsespecialtags function, which can be exploited by an attacker to cause remote code execution...

CVE-2025-67168

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...

ChurchCRM 代码注入漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from a code execution vulnerability that stems from user input in the installation wizard being written directly to a configuration file without validation, which can be exploited by an attacker to cause remote code execution...

UBUNTU-CVE-2025-64520

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch...

CVE-2025-64520

GLPI CVE-2025-64520 affects versions 9.1.0 up to (but not including) 10.0.21, where an unauthorized API user can read all knowledge base entries. Root cause: insufficient API authorization. Impact: confidentiality high; integrity/availability not affected per disclosure. Remediation: upgrade to 1...

CVE-2025-13532

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager BoKS can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain...

CVE-2025-13532

This CVE concerns Fortra’s Core Privileged Access Manager (BoKS): BoKS Server Agent 9.0 with yescrypt support running in a BoKS 8.1 domain is affected by insecure defaults that can cause the use of weak password hash algorithms. The issue is described across multiple sources as an insecure defaul...

CVE-2025-52196

Server-Side Request Forgery SSRF vulnerability in Ctera Portal 8.1.x 8.1.1417.24 allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe...

CVE-2025-68142

CVE-2025-68142 involves PyMdown Extensions (Python-Markdown) where the figure caption extension (pymdownx.blocks.caption) exposes a ReDO S vulnerability in versions before 10.16.1. The flaw can cause long processing delays when handling unchecked user content, potentially leading to hangs; exploi...

AZL-72661 CVE-2025-68308 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusb: leaf: Fix potential infinite loop in command parsers The kvaserusbleafwaitcmd and kvaserusbleafreadbulkcallback functions contain logic to zero-length commands. These commands are used to align data to the USB...