CVE-2025-63739

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint...

CVE-2025-61074

A stored Cross Site Scripting XSS vulnerability in the bulletin board SchwarzeBrett in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the...

PT-2025-50293

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.5.4 and below Description WeGIA is a web manager for institutions, primarily for Portuguese language users. The application does not properly validate and sanitize user inputs in the id categoria parameter of the...

PT-2025-49989

Name of the Vulnerable Software and Affected Versions adata Software GmbH Mitarbeiterportal version 2.15.2.0 Description The software contains multiple incorrect access control issues. A remote, authenticated user with low privileges can perform administrative functions and modify data belonging ...

PT-2025-50207

Name of the Vulnerable Software and Affected Versions OpenSIS versions 9.2 and below Description An issue exists in OpenSIS that relates to incorrect access control within the Student.php component. An authenticated user with limited privileges can perform unauthorized database write operations...

PT-2025-49867

CVE-2025-12807 A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints. https://t.co/lEhiHUNcHf...

Nextcloud Server Information Disclosure Vulnerability (GHSA-495w-cqv6-wr59)

Nextcloud Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-50244

Name of the Vulnerable Software and Affected Versions STVS ProVision version 5.9.10 Description The software contains a cross-site request forgery issue. This allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. An attacker can create new...

PT-2025-50245

Name of the Vulnerable Software and Affected Versions STVS ProVision version 5.9.10 Description An authenticated attacker can access arbitrary files. This is possible by manipulating the files parameter within the archive download functionality. Attackers can send GET requests to the...

PT-2025-49802

Name of the Vulnerable Software and Affected Versions CSV to SortTable WordPress plugin versions through 4.2 Description The software does not properly check certain shortcode attributes before using them to create file paths that are then used with include functions. This allows users with...

PT-2025-50098

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA version 2.7.0 Description An issue exists in the phpinisaveAction function within the webmain/system/cogini/coginiAction.php file. This allows authenticated users to modify PHP configuration files through the a parameter ...

CVE-2025-65594

OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized database write operations relating to the data of other users...

CVE-2025-63739

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint...

PT-2025-50241

Name of the Vulnerable Software and Affected Versions IntelliChoice eFORCE Software Suite version 2.5.9 Description The software contains a flaw that allows attackers to identify valid usernames. This is achieved by exploiting the ctl00$MainContent$UserName POST parameter. By sending requests wit...

PT-2025-49803

Name of the Vulnerable Software and Affected Versions Custom Admin Menu WordPress plugin versions through 1.0.0 Description The plugin does not properly sanitise and escape a parameter before displaying it on a page, which can lead to a Reflected Cross-Site Scripting issue. This could potentially...

CVE-2025-63739

Xinhu Rainrock RockOA 2.7.0 is affected by CVE-2025-63739 due to a flaw in phpinisaveAction() in webmain/system/cogini/coginiAction.php. An authenticated user can use the a parameter on index.php to modify PHP configuration files. The vulnerability affects the cited version; Red Hat and other sou...

PT-2025-49835

A vulnerability has been identified in Gridscale X Prepay All versions V4.2.1. The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions...

CVE-2025-61074

Affected product: adata Software GmbH Mitarbeiter Portal 2.15.2.0 (SchwarzeBrett bulletin board). Vulnerability: Stored XSS in the Inhalts parameter of CreateNachricht and EditNachricht endpoints, exploitable by remote authenticated users to run arbitrary JavaScript in other users’ browsers. Impa...

CVE-2025-61075

CVE-2025-61075 concerns multiple incorrect access control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 . The Red Hat, ENISA EUVD, NVD and CVE records converge on the same description: remote authenticated, low-privileged users can perform administrative functions and manipula...

PT-2025-49801

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...