PT-2025-9114 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.3 LTS through 9.4 CD Description: The issue concerns the storage of potentially sensitive information in environment variables, which could be accessed by a local user. Recommendations: For IBM MQ versions 9.3 LTS through 9....

PT-2025-9026 · Xiq-Se · Xiq-Se

Name of the Vulnerable Software and Affected Versions: XIQ-SE versions prior to 24.2.11 Description: A server misconfiguration in XIQ-SE may allow user enumeration under specific conditions. Recommendations: For versions prior to 24.2.11, update to version 24.2.11 or later to resolve the issue...

PT-2025-8694

Name of the Vulnerable Software and Affected Versions CGI gem versions prior to 0.4.2 Description The CGI::Cookie.parse method in the CGI library contains a potential Denial of Service DoS vulnerability. The method does not impose any limit on the length of the raw cookie value it processes,...

PT-2025-8230 · Unknown · Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: Privilege Management for Windows versions prior to 25.2 Description: A local authenticated attacker can elevate privileges on a system via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic...

PT-2025-7694 · Unknown · Divi Donation Modules

Name of the Vulnerable Software and Affected Versions: Give – Divi Donation Modules versions prior to 2.0.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into externally-accessible files or directories. Recommendations: For...

PT-2025-7661 · Sourcecodester · Sourcecodester Best Church Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Church Management Software version 1.0 Description: A vulnerability was found in the software, rated as problematic. It affects some unknown functionality of the file /admin/app/profile crud.php. The manipulation of the ol...

PT-2025-28156

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to 1.9.24 Description: The issue allows an unauthenticated attacker to inject malicious JavaScript into the "v1/runs/ingest" endpoint by adding an empty citations field. This triggers a code path where...

CVE-2025-24841

Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser...

PT-2025-29145 · Trend Micro · Trend Micro Worry-Free Business Security Services

Name of the Vulnerable Software and Affected Versions: Trend Micro Worry-Free Business Security Services WFBSS agent affected versions not specified Description: A missing authentication issue in the Trend Micro Worry-Free Business Security Services WFBSS agent could allow an unauthenticated...

CVE-2025-25604

The Totolink X5000R router, specifically version V9.1.0u.6369_B20230113 , is vulnerable to a command injection flaw. The issue originates from the vif_disable function within the mtkwifi.lua component. This vulnerability allows for the execution of arbitrary commands, which could lead to unauthor...

PT-2025-7453 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason, but no further explanation is given...

PT-2025-7539 · Dell · Dell Recoverpoint For Virtual Machines

Name of the Vulnerable Software and Affected Versions: Dell Recover Point for Virtual Machines version 6.0.X Description: The issue is related to weak file system permissions. A low-privileged local attacker could potentially exploit this, impacting only non-sensitive resources in the system...

PT-2025-7787

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Additional checks are required to ensure that trusttext is applied to glossary entries being restored when it is enabled. Recommendations At the moment, there is no information about a newer...

PT-2025-7786

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Insufficient capability checks allow unauthorized access to disable badges that a user does not have permission to access. Recommendations At the moment, there is no information about a newer...

PT-2025-14112 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-LINK DI-8100 version 16.07.26A1 Description: The issue is related to a Buffer Overflow in the ipsec road asp function, which can be exploited via the host ip parameter. Recommendations: For D-LINK DI-8100 version 16.07.26A1, as a temporary...

PT-2025-7125 · Unknown · Phpgurukul Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.1 Description: A SQL Injection issue was found in the /shopping/track-orders.php file, allowing remote attackers to execute arbitrary code via the orderid POST request parameter. Recommendations: Fo...

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information...

PT-2025-7245

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.12.10 and earlier, 2.13.x versions prior to 2.13.6 Description The issue is related to a NULL pointer dereference in xmlPatMatch in pattern.c. This is a general information about the problem, and no specific details about...

Cross-Site Scripting (XSS)

org.apache.felix, org.apache.felix.webconsole is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper neutralization of user-supplied input during web page generation, which allows an attacker to inject and execute malicious scripts in a user's browser...

PT-2025-6857 · Ywoa · Ywoa

Name of the Vulnerable Software and Affected Versions: ywoa versions up to 2024.07.03 Description: A critical issue has been found that affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to SQL injection. Th...