Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

PT-2025-29447 · Phpgurukul · Phpgurukul Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Dairy Farm Shop Management System version 1.3 Description: A critical issue exists in PHPGurukul Dairy Farm Shop Management System 1.3. This issue is due to a SQL injection vulnerability within the invoices.php and receipts.php...

PT-2025-29493 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the pid parameter at the SEMCMS ct.php endpoint. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS ct.php...

PT-2025-28098 · Curl +1 · Curl +1

Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20 Description: A critical issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl, leading to server-side request forgery. The attack may be initiated remotely...

PT-2025-28186 · Natours · Natours

Name of the Vulnerable Software and Affected Versions: Natours affected versions not specified Description: The issue allows an attacker to take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the "/forgetpassword" endpoint...

PT-2025-28002

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.14.0-rc5 Description: A slab-use-after-free read vulnerability has been identified in the Linux kernel, specifically in the vidtv module. This issue occurs when the PSI initialization fails, and the si member ...

PT-2025-27565 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.7.7 Description: The issue is related to Cross-Site Scripting XSS in the getqsetting.php functionality, which could allow reflected execution of scripts in the browser on interaction...

PT-2025-27358

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A stack-based buffer overflow issue has been found, affecting the function H5G node cmp3 in the file src/H5Gnode.c. This issue can be exploited locally. Recommendations: For HDF5 version 1.14.6, consider...

PT-2025-26915 · WordPress · Event Rsvp/Simple Event Management Plugin

Name of the Vulnerable Software and Affected Versions: The Event RSVP and Simple Event Management Plugin versions up to, and including, 4.1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in...

PT-2025-28077 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical issue has been found in the Belkin F9K1122, affecting the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection...

PT-2025-26687 · Unknown · Sysmonelixir

Name of the Vulnerable Software and Affected Versions: SysmonElixir versions prior to 1.0.1 Description: The issue concerns SysmonElixir, a system monitor HTTP service in Elixir. Prior to version 1.0.1, the "/read" endpoint reads any file from the server's file system, including sensitive files...

PT-2025-26571 · Sparklemotion +1 · Nokogiri +1

Name of the Vulnerable Software and Affected Versions: sparklemotion nokogiri versions up to 1.18.7 Description: A vulnerability was found in sparklemotion nokogiri, affecting the function hashmap get with hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer...

PT-2025-26532 · Code Projects · Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: Simple Online Hotel Reservation System version 1.0 Description: A critical vulnerability was found in the Simple Online Hotel Reservation System. The issue is related to SQL injection, which can be triggered by manipulating the Username or...

PT-2025-26220

Name of the Vulnerable Software and Affected Versions jq version 1.8.0 Description A heap use after free issue exists within the function f strflocaltime of /src/builtin.c. This is a problem in a command-line JSON processor. Recommendations For version 1.8.0, consider restricting access to the f...

CVE-2025-6070

The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server...

PT-2025-25483 · WordPress · Restrict File Access

Name of the Vulnerable Software and Affected Versions: Restrict File Access plugin for WordPress versions up to, and including, 1.1.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server, which can conta...

WordPress plugin Restrict File Access 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...

CVE-2025-6070: Improper Limitation of a Pathname to a Restricted Directory

The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server...

PT-2025-25105 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-25153 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...