PT-2025-9135 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to 1.2.0 Description: The issue concerns the backup restore functionality, which allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template...

PT-2025-9088 · WordPress · The Site Mailer – Smtp Replacement

Name of the Vulnerable Software and Affected Versions: The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress versions prior to 1.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping...

SOTESHOP 跨站脚本漏洞

SOTESHOP is an online store system from SOTESHOP Inc. A cross-site scripting vulnerability exists in SOTESHOP versions prior to 8.3.4. An attacker can exploit this vulnerability to remotely execute code...

PT-2025-9078 · Blackmagic Design · Davinci Resolve

Name of the Vulnerable Software and Affected Versions: DaVinci Resolve versions prior to 19.1.3 Description: The issue is related to incorrect file permissions in DaVinci Resolve on MacOS, which can lead to Dylib Hijacking. This inconsistency with standard macOS security practices allows for...

mongosh vulnerable to local privilege escalation

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\nodemodules. This issue affects mongosh prior to 2.3.0...

CVE-2024-51539

The Dell Secure Connect Gateway SCG Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability can only be exploited locally on the affected system. A high-privilege attack...

CVE-2025-1693

Summary: CVE-2025-1693 affects the MongoDB Shell (mongosh) prior to version 2.3.9. When mongosh is connected to a cluster that is partially or fully under an attacker’s control, an attacker can inject control characters into the shell output, potentially causing falsified messages that appear to ...

MongoDB Shell may be susceptible to control character injection via pasting

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue...

PT-2025-8947 · Unknown · Yukseloglu Filter B2B Login Platform

Name of the Vulnerable Software and Affected Versions: Yukseloglu Filter B2B Login Platform versions prior to 16.01.2025 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

Viayoo Via Browser 代码注入漏洞

Viayoo Via Browser is a lightweight free Android web browser from Viayoo. A code injection vulnerability exists in Viayoo Via Browser version 5.9.0 and prior versions, which stems from improper handling of the Javascript Bridge component...

Exploit for CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb with the ve...

PT-2025-8673 · WordPress · Post Timeline Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Post Timeline WordPress plugin versions prior to 2.3.10 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

Amazon Linux 2 : ghostscript (ALAS-2025-2760)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2760 advisory. PS interpreter - check Indexed colour space index NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707990NOTE:...

AZL-57327 CVE-2025-26598 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...

PT-2025-7850 · Booknetic · Booknetic

Name of the Vulnerable Software and Affected Versions: Booknetic versions prior to 4.0.10 Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to trick a user into performing unintended actions on a web application. Recommendations: For versions...

PT-2025-7716 · Agito Computer · Health4All

Name of the Vulnerable Software and Affected Versions: Agito Computer Health4All versions prior to 10.01.2025 Description: The issue affects the access control security levels in Health4All, allowing exploitation due to incorrectly configured access control and potential authentication abuse...

ClickHouse < 19.13.5.44

The version of ClickHouse installed on the remote host is prior to 19.13.5.44. It is, therefore, affected by a HTTP header injection vulnerability via the url table function. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Copyparty 安全漏洞

Copyparty is a portable file server for ed individual developers. A security vulnerability exists in Copyparty versions prior to 1.16.15. An attacker exploiting this vulnerability could execute arbitrary javascript with the same privileges as the user...

PT-2025-7777 · Tawkto · Tawkto Widget

Name of the Vulnerable Software and Affected Versions: TawkTo Widget versions prior to 1.3.8 Description: The issue arises from the processing of user input in a way that allows JavaScript execution, leading to Cross Site Scripting XSS. Recommendations: For versions prior to 1.3.8, update to...

Opera Mini 安全漏洞

Opera Mini is a web browser application from the Norwegian company Opera. A security vulnerability exists in Opera Mini versions prior to 52.2, which originates from a susceptibility to an address bar spoofing attack that allows a malicious page to impersonate another page and trick users into...