PT-2025-20872 · Siemens · Scalance Lpe9403

Name of the Vulnerable Software and Affected Versions: SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions Description: A vulnerability has been identified where affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a...

CVE-2025-40575: Use of Uninitialized Variable

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0 HF0. Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash o...

CVE-2025-41645: Incorrect Resource Transfer Between Spheres

An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake...

CVE-2024-51447: Observable Response Discrepancy

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.2. The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to...

CVE-2025-4559

The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-4559 Netvision ISOinsight - SQL Injection

The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

NetVision Information ISOinsight 安全漏洞

NetVision Information ISOinsight is an operations and maintenance management platform from China Zhengbang Information NetVision Information. A security vulnerability exists in NetVision Information ISOinsight, which stems from a SQL injection vulnerability that could lead to the execution of...

CVE-2025-4560: Missing Authentication for Critical Function

The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings, and uploading files...

CVE-2025-4559: Improper Neutralization of Special Elements used in an SQL Command

The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-4558: Unverified Password Change

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system...

CVE-2025-4557: Missing Authentication for Critical Function

The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific APIs and operate system functions. These functions include opening gates and restarting the system...

CVE-2025-4556: Unrestricted Upload of File with Dangerous Type

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-3713

The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack...

CVE-2024-6648

Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'productitempath' within the 'config' JSON file, allowing them to read any file on the system...

CVE-2025-3712

The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack...

CVE-2025-3710

The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device...

CVE-2025-3712: Heap-based Buffer Overflow

The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack...

RCEs and more in the KUNBUS GmbH Revolution Pi PLC

TL;DR Four new vulnerabilities in the Revolution Pi industrial PLCs Two give unauthenticated attackers RCE—potentially a direct impact on safety and operations Documentation and firmware is public, meaning greater oversight and better security in the long run KUNBUS’ PSIRT and CISA were great at...

PT-2025-20380

Name of the Vulnerable Software and Affected Versions AP Page Builder versions prior to 4.0.0 Description The issue is an Absolute Path Traversal vulnerability that could allow an unauthenticated remote user to modify the product item path within the config JSON file, allowing them to read any fi...

CVE-2024-6648: Improper Limitation of a Pathname to a Restricted Directory

Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'productitempath' within the 'config' JSON file, allowing them to read any file on the system...