CVE-2025-24957 SQL Injection endpoint 'get_detalhes_socio.php' parameter 'id_socio' in WeGIA

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, getdetalhessocio.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information...

CVE-2025-24957

WeGIA (Web Manager for Charitable Institutions) has a SQL Injection flaw in the get_detalhes_socio.php endpoint (parameter id_socio). The vulnerability could allow an authorized attacker to run arbitrary SQL and access or delete sensitive data. According to CVE records, the issue is addressed in ...

CVE-2025-24961

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this...

CVE-2025-24370 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

CVE-2025-24961

CVE-2025-24961 affects org.gaul S3Proxy and describes an insecure path traversal in the filesystem and filesystem-nio2 storage backends that could unintentionally expose local files to users. The root cause is a path traversal flaw when using those backends, enabling access to files outside the i...

PT-2025-5605 · Org.Gaul · 3Proxy

Name of the Vulnerable Software and Affected Versions: org.gaul S3Proxy versions prior to 2.6.0 Description: The issue affects users of the filesystem and filesystem-nio2 storage backends, potentially exposing local files to authenticated clients. This could lead to unauthorized access to sensiti...

PT-2025-4118 · Zenvia · Zenvia Movidesk

Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue has been found in the New Ticket Handler component, where the manipulation of the subject argument leads to cross-site scripting. This can be initiated...

Incorrect Authorization

Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Incorrect Authorization due to improper RBAC enforcement. Remediation Upgrade zenml to version 0.72.0 or higher. References - GitHub Commit - GitHub PR...

Race Condition

Overview parallel-ssh is an Asynchronous parallel SSH library Affected versions of this package are vulnerable to Race Condition in the scpsend function, leading to incomplete file transfers without error notifications. Remediation Upgrade parallel-ssh to version 2.9.1 or higher. References -...

Server-side Request Forgery (SSRF)

Overview django-icon-picker is an A custom Django model field that allows users to select icons from a predefined set. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the downloadandsavesvg function, which interpolates arbitrary URLs without filtering out...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the execute functions in ServerSuspendHandler.java and ServerResumeHandler.java, which do not perform sufficient checks for the authorization of the running user. This allows a user with the Monitor or Auditor...

PT-2025-5353 · Unknown +1 · Kubewarden-Controller +1

Name of the Vulnerable Software and Affected Versions: kubewarden-controller versions prior to 1.21.0 Description: The issue concerns the validation of namespaced resources by AdmissionPolicy and AdmissionPolicyGroup policies in kubewarden-controller. An attacker can exploit this to prevent the...

Deserialization of Untrusted Data

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the insecure handling of serialization exceptions which is not supported for all exceptions. This is because The OCSP response cache...

DEBIAN-CVE-2025-0840

A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemblebytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2024-29869

Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to...

PT-2025-5577

Name of the Vulnerable Software and Affected Versions Hyperbridge versions prior to 15.0.1 Description A critical issue was discovered in the ismp-grandpa crate, allowing a malicious prover to easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or...

SUSE CVE-2023-30536

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

PT-2025-7036

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.18 Description GLPI is an asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This allows an attacker to execute arbitrary SQL commands. A...

PT-2025-1396 · Open5Gs · Open5Gs Mme

Name of the Vulnerable Software and Affected Versions: Open5GS MME versions prior to 2.6.4 Description: The issue allows an attacker to send a malformed ASN.1 packet over the S1AP interface, triggering an assertion that can cause a denial of service. Specifically, an attacker may send an "Initial...

CVE-2025-23208

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...