PT-2025-17093 · Unknown · Terminal Africa

Name of the Vulnerable Software and Affected Versions: Terminal Africa versions 1.13.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that an attacker can...

PT-2025-17075 · Deetronix · Deetronix Booking Ultra Pro

Name of the Vulnerable Software and Affected Versions: Deetronix Booking Ultra Pro versions 1.1.19 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

SUNNET Wisdom Master Pro 安全漏洞

SUNNET Wisdom Master Pro is a Wisdom Master management platform from SUNNET. A security vulnerability exists in SUNNET Wisdom Master Pro 5.2 and earlier versions, which stems from a lack of authorization and could lead to a remote attacker obtaining some user data...

CVE-2025-24909

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-32789

EspoCRM (open-source CRM) prior to version 9.0.7 is affected by a vulnerability in the user password hashing disclosure feature. The issue allows an attacker to infer other users’ password hashes by sorting the user list by the password hash, potentially enabling password changes if the attacker ...

CVE-2025-32789 EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function

EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...

CVE-2025-27929 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-24850

Growatt Cloud Applications vulnerability CVE-2025-24850 allows exporting other users’ plant information due to improper access control/auth handling. Documented effects include exposure of user plant data and other sensitive information across API endpoints. Connected sources cite the advisory fr...

SicommNet multiple vulnerabilities

RISK EVALUATION SicommNET BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain...

CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...

CVE-2025-3575

CVE-2025-3575 affects Deporsite from T-INNOVA. The vulnerability is an Insecure Direct Object Reference allowing an attacker to retrieve sensitive information from other users through the idUsuario parameter at /helper/Familia/establecerUsuarioSeleccion. The CVE entry notes a high impact with CVS...

PT-2025-16326 · Unknown · Landing Page Cat

Name of the Vulnerable Software and Affected Versions: Landing Page Cat versions 1.7.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2025-16531

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Unauthenticated attackers can retrieve the full list of users associated with arbitrary accounts. Recommendations At the moment, there is no information about a newer version that contains a f...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which stems from an attacker being able to export other users' plant information...

Meta slurps up EU user data for AI training

European Facebook users have so far avoided having their public posts used to train parent company Meta's AI model. That's about to change, the company has warned. In a blog post today, it said that EU residents' data was fair game and it would be slurping up public posts for training soon...

PT-2025-16227 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Stored XSS Cross-site Scripting attacks. An attacker might trick a user into filling a form designed for changing user's data with a malicious script...

CVE-2023-38614

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive user data...

CVE-2023-41077

An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks...

CVE-2023-38614

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive user data...

CVE-2023-38614

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive user data...