PT-2025-35268

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4907 Description: An allocation of resources without limits or throttling issue exists in File Station 5. If a remote attacker gains a user account, they can exploit this issue to prevent other systems,...

PT-2025-35256

Name of the Vulnerable Software and Affected Versions: File Station versions prior to 5.5.6.4907 Description: A NULL pointer dereference issue exists in File Station 5. A remote attacker who has obtained a user account can exploit this issue to initiate a denial-of-service DoS attack...

PT-2025-35276

Name of the Vulnerable Software and Affected Versions: QNAP versions prior to QTS 5.2.5.3145 build 20250526 QNAP versions prior to QuTS hero h5.2.5.3138 build 20250519 Description: A NULL pointer dereference issue exists in QNAP operating systems. A remote attacker gaining a user account can...

PT-2025-35285

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An improper certificate validation issue exists in Qsync Central. A remote attacker gaining a user account can compromise system security. Recommendations: Update to Qsync Central version...

PT-2025-35284

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An improper certificate validation issue exists in Qsync Central. A remote attacker gaining a user account can compromise system security. Recommendations: Update to Qsync Central version...

PT-2025-35270

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An allocation of resources without limits or throttling issue exists in Qsync Central. A remote attacker gaining a user account can exploit this to prevent other systems, applications, or...

CVE-2025-29901

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29901

CVE-2025-29901 affects QNAP File Station 5. A NULL pointer dereference vulnerability could allow a remote attacker who has a user account to cause a denial-of-service on affected systems. The issue is rooted in File Station 5 (versions prior to 5.5.6.4933). A fixed release is available: File Stat...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests. Remediation Upgrade...

CVE-2025-47206

An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later...

August 19, 2025—KB5066187 (OS Build 17763.7683) Out-of-band

None None...

Linux Distros Unpatched Vulnerability : CVE-2022-32746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module,...

The vulnerability of the Apache Tomcat application server, related to deficiencies in access control, allows attackers to intercept sessions and gain access to user accounts.

The vulnerability of the Apache Tomcat application server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to intercept sessions and gain access to the user account...

PT-2025-33647 · Unknown · File Station 5

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4933 Description: An out-of-bounds write vulnerability affects File Station 5. If a remote attacker gains a user account, they can exploit the vulnerability to modify or corrupt memory. Recommendations:...

CVE-2025-46389

CWE-620: Unverified Password Change...

CVE-2025-54124 XWiki Platform: Any user with editing rights can access password properties through Database List Properties

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

Windows

Windows Awesome tools to play with Windows ! List of tools used for exploiting Windows: - Exploitation : Windows Software Exploitation - hacking-team-windows-kernel-lpe : Previously-0day exploit from the Hacking Team leak, written by Eugene Ching/Qavar. - mimikatz : A little tool to play with...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

PT-2025-31138 · WordPress · No Boss Testimonials

Name of the Vulnerable Software and Affected Versions: No Boss Testimonials versions 1.0.0 through 3.0.0 No Boss Testimonials versions 4.0.0 through 4.0.2 Description: A stored Cross-Site Scripting XSS issue exists in the No Boss Testimonials component. This allows an attacker to inject malicious...

CVE-2025-6215

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public permissioncallback always returns true and invokes wpcreateuser unconditionally, ignoring the site’s...