CVE-2025-49132 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...

CVE-2025-49132 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...

Dotnetnuke < 10.0.1 Possibly bypass of IP Filters (GHSA-fjhg-3mrh-mm7h)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.0.1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

PHPGurukul Pre-School Enrollment System 注入漏洞

Pre-School Enrollment System is a web-based preschool enrollment system. The Pre-School Enrollment System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in the file /admin/checkavailability.ph...

PHPGurukul Pre-School Enrollment System 注入漏洞

Pre-School Enrollment System is a web-based preschool enrollment system. The Pre-School Enrollment System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter fathername in the file /enrollment.php. An attacke...

PT-2025-26417 · Unknown · Lewe Chordpress

Name of the Vulnerable Software and Affected Versions: Lewe ChordPress versions 3.9.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

Sensitive Information Disclosure

Weblate is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inclusion of full IP addresses in audit log notifications, which could be accessed by third-party services like SMTP relays or spam filters...

MAL-2025-5476 Malicious code in web-app-activities (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-25265

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure...

CodeAstro-Online-Healthcare-Patient-Record-Management-System

PoC exploit for Stored XSS on CodeAstro-Online-Healthcare-Patien...

WordPress Civi Framework plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Civi Framework plugin that stems from the WEB application not adequately verifying that a request is from a...

CVE-2025-25265

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure...

CVE-2025-25265 Unauthenticated File Read via Web Interface

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure...

CVE-2025-25265 Unauthenticated File Read via Web Interface

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure...

CVE-2025-25265

CVE-2025-25265 concerns an unauthenticated file read via the web interface of WAGO Device Manager. The connected sources confirm a web application endpoint that can be accessed remotely by a high-privilege attacker to read files from the system’s file structure. The description across multiple fe...

FlatPress <= 1.3.1 Information Disclosure Vulnerability

FlatPress is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

TencentOS Server 4: mod_security (TSSA-2024:0265)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0265 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-49192

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...

CVE-2025-49185

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source...