Improper Authorization

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Improper Authorization via an incorrect permission check in the token creation process. An attacker can gain elevated privileges by crafting requests to the REST API and creatin...

GHSA-XW5Q-G62X-2QJC electron ASAR Integrity bypass by just modifying the content

electron's ASAR Integrity can be bypass by modifying the content. Impact This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macO...

GHSA-373J-MHPF-84WG Janssen Config API returns results without scope verification

Impact What kind of vulnerability is it? Who is impacted? The configAPI is an internal service and hence should never be exposed to the internet. With that said, this is a serious vulnerability that has a large internal surface attack area that exposes all sorts of information from the IDP...

CVE-2025-52898

CVE-2025-52898 affects the Frappe framework (self-hosted deployments) prior to versions 14.94.3 and 15.58.0. A carefully crafted request could allow an attacker to access a user’s password reset token, with impact on confidentiality, integrity, and availability as reflected in the CVE metrics. Fr...

PT-2025-27404 · Unknown · Phpgurukul Teachers Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teachers Record Management System version 2.1 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the tid argument leads to SQL...

PT-2025-27442 · Unknown · Phpgurukul Old Age Home Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A critical issue has been discovered in the PHPGurukul Old Age Home Management System, affecting an unknown functionality of the file /admin/add-scdetails.php. The manipulatio...

PT-2025-27455 · Unknown · String-Math

Name of the Vulnerable Software and Affected Versions: string-math version 1.2.2 Description: The issue is a Regex Denial of Service ReDoS that can be exploited via a crafted input. Recommendations: For string-math version 1.2.2, consider validating and sanitizing all inputs to prevent crafted...

PT-2025-27408 · Unknown · Code-Projects Movie Ticketing System

Name of the Vulnerable Software and Affected Versions: code-projects Movie Ticketing System version 1.0 Description: A critical issue has been discovered, affecting the /logIn.php file. The manipulation of the postName argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-27481 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the ID argument leads to SQL injection. This...

PT-2025-27380

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue was found in the software, affecting an unknown functionality of the file /admin/testimonials/manage.php. The manipulation of the ID argument leads to SQL...

PT-2025-27360

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A null pointer dereference issue was found in the function H5C flush single entry of the file src/H5Centry.c. The manipulation leads to this issue, and the attack needs to be approached locally. Recommendation...

PT-2025-27357

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic issue was found in the function H5FL reg gc list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. Recommendations: For HDF5 version 1.14.6, as...

PT-2025-27382 · Unknown · Sourcecodester Simple Company Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /classes/Login.php. The manipulation of the Username argument leads to SQL injection. This issue can be...

CVE-2025-53013

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

PT-2025-27319 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical vulnerability has been found in the code-projects Inventory Management System, affecting an unknown functionality of the file /php action/removeBrand.php. The...

PT-2025-27333 · Unknown · Aaluoxiang Oa System

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207 Description: A critical issue was found in the outAddress function of the External Address Book Handler component, leading to SQL injection. The attack can be initiated...

PT-2025-27331 · Akka · Akka

Name of the Vulnerable Software and Affected Versions: Akka versions through 2.10.6 Description: The issue concerns the use of Java serialization for cluster metrics in the akka-cluster-metrics component. Recommendations: For versions through 2.10.6, consider disabling Java serialization for...

PT-2025-27318

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue was found in the function H5O chunk protect of the file /src/H5Ochunk.c. This issue can be exploited locally. Recommendations: For HDF5 version 1.14.6, as a temporary...

PT-2025-27205 · Lucidcrew · Lucidcrew Wp Forum Server

Name of the Vulnerable Software and Affected Versions: lucidcrew WP Forum Server versions 1.8.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27043

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue has been found in the function H5O mtime new encode of the file src/H5Omtime.c. The manipulation leads to this issue, and attacking locally is a requirement. The exploit has...