PT-2025-30008 · WordPress · Masterstudy Lms Pro

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS Pro versions up to and including 4.7.9 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the install and activate plugin function. Thi...

CommuniGate Pro Authentication Bypass

The vulnerability of the CommuniGate Pro mail server lies in the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to send emails with arbitrary content to any email address...

Europol Disrupts NoName057(16) Hacktivist Group Linked to DDoS Attacks Against Ukraine

An international operation coordinated by Europol has disrupted the infrastructure of a pro-Russian hacktivist group known as NoName05716 that has been linked to a string of distributed denial-of-service DDoS attacks against Ukraine and its allies. The actions have led to the dismantling of a maj...

CVE-2025-6265

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

MAL-2025-6119 Malicious code in pro-rhr-container (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec0b1a38dedf4534ebb29ea3d45af93b41e050a360c99c229eaaff93be82f775 The OpenSSF Package Analysis project identified 'pro-rhr-container' @...

Malicious code in pro-rhr-container (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec0b1a38dedf4534ebb29ea3d45af93b41e050a360c99c229eaaff93be82f775 The OpenSSF Package Analysis project identified 'pro-rhr-container' @...

CVE-2025-53926

Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefo...

CVE-2024-26293

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS...

CVE-2025-52363

Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access...

WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin KBx Pro Ultimate versions = 8.0.5...

CVE-2025-6265

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

CVE-2025-6265

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

CVE-2025-6265

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

CVE-2025-6265

CVE-2025-6265 affects Zyxel NWA50AX PRO firmware versions 7.10(ACGE.2) and earlier. A path traversal vulnerability exists in the file_upload-cgi CGI program that could allow an authenticated administrator to access certain directories and delete files (e.g., the configuration file) on the device....

CVE-2025-34109: Uncontrolled Search Path Element

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with...

PT-2025-43326

Name of the Vulnerable Software and Affected Versions quantumcloud KBx Pro Ultimate versions through 8.0.5 Description A flaw exists in quantumcloud KBx Pro Ultimate that allows for object injection due to deserialization of untrusted data. This issue impacts the knowledgebase-helpdesk-pro...

PT-2025-29534 · Zyxel · Zyxel Nwa50Ax Pro

Name of the Vulnerable Software and Affected Versions: Zyxel NWA50AX PRO firmware versions 7.10ACGE.2 and earlier Description: A path traversal vulnerability exists in the file upload-cgi CGI program. This could allow an authenticated attacker with administrator privileges to access specific...

Panda Security’s various products have code-related issues and vulnerabilities.

Panda Security Antivirus and others are products of the Spanish company Panda Security.Panda Security Antivirus is a suite of antivirus programs.Panda Security Internet Security is a suite of cloud-based antivirus programs. Panda Security Free Antivirus is a free antivirus program. A security...

CVE-2025-6265: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

CVE-2025-52363

Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access...