PT-2025-25669 · Simen · Simen

Name of the Vulnerable Software and Affected Versions: Simen versions n/a through 4.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File Inclusion in...

PT-2025-25703 · Unknown · Thembay Diza

Name of the Vulnerable Software and Affected Versions: thembay Diza versions 1.3.8 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This ...

PT-2025-25625

Name of the Vulnerable Software and Affected Versions frdel Agent-Zero versions up to 0.8.4 Description A path traversal issue affects the image get function in the /python/api/image get.py file, caused by the manipulation of the path argument. Recommendations For frdel Agent-Zero versions up to...

PT-2025-25706 · Wp2Leads · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions 3.5.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

Adobe Acrobat Reader Memory Misreference Vulnerability (CNVD-2025-13321)

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. A memory misreference vulnerability exists in Adobe Acrobat Reader, which can be exploited by an attacker to execute code on the system or cause the application to...

PT-2025-25731 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.9.5.2 Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. Recommendations: For Metagauss ProfileGrid versions through 5.9.5.2, update to ...

PT-2025-25633 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A Cross-Site Request Forgery CSRF issue is present. No additional details are provided about the issue, including the number of potentially affected devices or real-world incidents...

PT-2025-25677 · Unknown · Valvepress Rankie

Name of the Vulnerable Software and Affected Versions: ValvePress Rankie affected versions not specified Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-25723 · WordPress · Wp Codeus Advanced Sermons

Name of the Vulnerable Software and Affected Versions: WP Codeus Advanced Sermons versions n/a through 3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-25713 · Unknown · Postapanduri

Name of the Vulnerable Software and Affected Versions: PostaPanduri versions n/a through 2.1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

CVE-2025-48992 Group-Office vulnerable to blind XSS

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting XSS vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, whi...

CVE-2025-6137

creationtimestamp| type| source ---|---|--- 2025-06-16 20:27:18+00:00| seen| https://bsky.app/profile/potato.software/post/3lrqswhm2im2l 2025-06-16 20:31:30+00:00| published-proof-of-concept| Telegram/Z-E45SeLQmulAiMNJbdsp5CiTjOWjFSQdsTMSo28OTtfoQ 2025-06-16 20:37:06+00:00|...

GHSA-8C26-XM99-53W7 Liferay Portal does not limit the depth of a GraphQL queries

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on t...

Liferay Portal does not limit the depth of a GraphQL queries

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service DoS attacks on t...

Weblate lacks rate limiting when verifying second factor

Impact The verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. Patches This issue has been addressed in Weblate 5.12 via...

PT-2025-25563 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A vulnerability was found in the PHPGurukul Rail Pass Management System. The issue affects an unknown functionality of the file /contact.php. The manipulation of the Name argumen...

PT-2025-26910 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: ndpi affected versions not specified Description: The software contains a use-of-uninitialized-value issue. This occurs within the ndpi strdup function, which is called during ndpi detection process packet processing, as reported in fuzzing...

PT-2025-26858

Name of the Vulnerable Software and Affected Versions: Registrator versions prior to 1.9.5 Description: The issue concerns a GitHub app that automates creation of registration pull requests for julia packages. If the clone URL returned by GitHub is malicious, an argument injection is possible in...

The vulnerability of the graphics processor in microprogrammed software embedded in Qualcomm chips allows attackers to execute arbitrary commands.

The vulnerability of the graphics processor in embedded Qualcomm software systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

MAL-2025-6469 Malicious code in browser-history-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...