CVE-2025-14095 Privilege boundary violation in Radiometer Products

A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The...

CVE-2025-66133

Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through = 4.0.7...

HCL BigFix Remote Control 安全漏洞

HCL BigFix Remote Control is a remote desktop management platform from HCL India. A security vulnerability exists in HCL BigFix Remote Control version 10.1.0.0326 and prior versions, which stems from improper management of content security policies and could lead to the execution of malicious cod...

PT-2025-51823

Name of the Vulnerable Software and Affected Versions Radiometer Products affected versions not specified Description A privilege boundary violation exists in Radiometer Products. Successful exploitation may allow a user with physical access to gain unauthorized access. Recommendations At the...

The vulnerability of the Open in Channel function in the Mattermost instant messaging application allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Open in Channel function in the Mattermost instant messaging application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the Mattermost instant messaging application’s API component, which allows a hacker to compromise the confidentiality of protected information

The vulnerability of the Mattermost instant messaging application’s API component is related to deficiencies in the authentication process when processing the teamid parameter. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected information...

Radiometer Products 安全漏洞

Radiometer Products is a line of medical diagnostic instruments from the Danish company Radiometer. A security vulnerability exists in Radiometer Products that stems from a weakness in the design of the application software access control implementation that could result in a physical accessor...

EUVD-2025-203571

Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through = 1.1.1...

CVE-2025-64634

Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through = 7.13.2...

PentestEval: Benchmarking LLM-Based Penetration Testing with Modular and Stage-Level Design

Penetration testing is essential for assessing and strengthening system security against real-world threats, yet traditional workflows remain highly manual, expertise-intensive, and difficult to scale. Although recent advances in Large Language Models LLMs offer promising opportunities for...

The vulnerability of the Nagios Network Analyzer software, a monitoring and network traffic analysis tool, arises from the lack of security measures taken to protect the website structure. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the Nagios Network Analyzer software relates to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the microprogrammed software for GNCC GC2 Indoor Security Camera cameras relates to deficiencies in authentication procedures, allowing intruders to bypass the authentication process.

The vulnerability of the microprogrammed video surveillance camera software from GNCC GC2 Indoor Security Camera is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a intruder to bypass the authentication process...

PT-2025-51239

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management allows a perpetrator to gain access to read, modify, and delete data.

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management involves deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to data...

The vulnerability of the xfs component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the xfs component in Linux operating systems is related to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows an attacker to trigger a service failure...

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially...

Arbitrary File Upload

net.mingsoft, ms-mcms is vulnerable to Arbitrary File Upload. The vulnerability is due to improper validation of uploaded files in the /ms/template/writeFileContent.do component, which allows an attacker to upload arbitrary files and potentially execute malicious code on the server...

CVE-2025-11707

CVE-2025-11707 – Login Lockdown & Protection (WordPress) : A vulnerability in all versions up to and including 2.14 allows unauthenticated attackers who have access to an admin email to generate valid unblock keys for their IP, bypassing IP blocks after failed logins due to insufficient randomnes...

CVE-2025-11707 Login Lockdown & Protection <= 2.14 - IP Block Bypass

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblockkey key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys...