PT-2025-18684

Name of the Vulnerable Software and Affected Versions LLaMA-Factory version prior to 1.0.0 Description LLaMA Factory enables fine-tuning of large language models. A critical issue exists in the llamafy baichuan2.py script, which performs insecure deserialization using torch.load on user-supplied...

PT-2025-17652

Name of the Vulnerable Software and Affected Versions BusyBox versions through 1.37.0 Description The issue allows local users to launch a network application with an argv0 containing an ANSI terminal escape sequence. This can lead to a denial of service when netstat is used by a victim, causing...

PT-2025-17653 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A buffer overflow issue was discovered in the downloadFile.cgi, specifically through the v14 and v3 parameters. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as ...

PT-2025-17646 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5032 B20200408 Description: The issue concerns a Command Injection vulnerability in the downloadFile.cgi file via the QUERY STRING parameter. This allows for potential exploitation. There is a high risk of...

PT-2025-17662 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.7 through 17.9.6 GitLab EE versions 17.10 through 17.10.4 GitLab EE versions 17.11 through 17.11.0 Description: An issue has been discovered in access controls that could allow users to view certain restricted project...

PT-2025-17507 · Watu Quiz · Watu Quiz

Name of the Vulnerable Software and Affected Versions: Watu Quiz versions 3.4.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-17491 · Unblu · Unblu Spark

Name of the Vulnerable Software and Affected Versions: Unblu Spark versions 8.0.0 through 8.12.1 Unblu Spark version 8.13.1 Description: An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned...

PT-2025-17506 · Codepeople · Codepeople Appointment Booking Calendar

Name of the Vulnerable Software and Affected Versions: codepeople Appointment Booking Calendar versions 1.3.92 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows SQL Injection in the codepeople Appointment Booking Calendar...

PT-2025-17472

Name of the Vulnerable Software and Affected Versions ppp versions prior to 2.5.2 Description The passprompt plugin in pppd mishandles privileges. This issue affects versions of PPP prior to 2.5.2. Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue...

PT-2025-17503 · Unknown · Rbaer List Last Changes

Name of the Vulnerable Software and Affected Versions: rbaer List Last Changes versions n/a through 1.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17502 · Unknown · Link Library

Name of the Vulnerable Software and Affected Versions: Link Library versions n/a through 7.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17523 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.3.0p29 Checkmk versions 2.2.0p41 Checkmk versions =2.1.0p49 Description: The issue involves the insertion of sensitive information into log files in Checkmk, causing remote site authentication secrets to be written to log...

PT-2025-17597 · Git +1 · 3X-Ui

Name of the Vulnerable Software and Affected Versions: 3X-UI versions prior to 2.5.3 Description: The issue allows a remote attacker to execute arbitrary code via the management script. This is possible because the x-ui passes the no check certificate option to wget when downloading updates, whic...

PT-2025-17514 · Vform · Vform

Name of the Vulnerable Software and Affected Versions: VForm versions 3.1.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-17456 · Qi Anxin · Qi-Anxin Tianqing Endpoint Security Management System

Name of the Vulnerable Software and Affected Versions: Qi-ANXIN Tianqing Endpoint Security Management System version 10.0 Description: The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System allows users to restore malicious files to arbitrary file paths...

PT-2025-17425 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: An issue was discovered that allows attackers to cause a panic via a zero value for softwareVersionLen. Recommendations: For versions prior to 3.35.0, update to version 3.35.0 or later to resolve th...

PT-2025-22288 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the web sys infoContact post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, as a temporary workaround, consider disabling the web sy...

PT-2025-22291 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the radIpkey parameter in the web radiusSrv post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, consider restricting access to the w...

PT-2025-22289 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the remote ip parameter in the web snmpv3 remote engineId add post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, consider restricti...

PT-2025-17401 · Kitty +1 · Kitty +1

Name of the Vulnerable Software and Affected Versions: kitty versions prior to 0.41.0 Description: The issue concerns the open actions.py script in kitty, which does not request user confirmation before executing a local executable file. This file may have been linked from an untrusted document,...