PT-2025-23748 · Samsung · Screencapture

Name of the Vulnerable Software and Affected Versions: ScreenCapture for Galaxy Watch versions prior to SMR Jun-2025 Release 1 Description: The issue is related to improper access control, allowing local attackers to take screenshots. This could potentially lead to unauthorized access to sensitiv...

PT-2025-23758 · Unknown · Phpgurukul Curfew E-Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Curfew e-Pass Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/edit-category-detail.php, where the manipulation of the editid argument leads to SQL injection. This...

PT-2025-23744 · Unknown · Phpgurukul Curfew E-Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Curfew e-Pass Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /admin/view-pass-detail.php. The manipulation of the viewid argument leads to SQL...

PT-2025-23740 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teacher Subject Allocation Management System version 1.0 Description: A critical issue affects the processing of the file /admin/changeimage.php, where the manipulation of the editid argument leads to SQL injection. This issue may ...

PT-2025-23759 · Unknown · Phpgurukul Notice Board System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Notice Board System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /search-notice.php. The manipulation of the searchdata argument leads to SQL injection. This issue can be...

PT-2025-23733 · Unknown · Chestnutcms

Name of the Vulnerable Software and Affected Versions: ChestnutCMS versions up to 15.1 Description: A critical issue has been found in the API Endpoint component, specifically affecting the /dev-api/groovy/exec file. This issue leads to deserialization and can be exploited remotely. The exploit h...

PT-2025-23850 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 2.2.0 through 2.2.4 Description: The issue allows bypassing Deno's permission read/write db permission check by using the ATTACH DATABASE statement. Recommendations: For Deno versions 2.2.0 through 2.2.4, update to version 2.2.5...

PT-2025-23811 · Unknown · Motivian Content Management System

Name of the Vulnerable Software and Affected Versions: Motivian Content Management System version 41.0.0 Description: The issue allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component. This is a result of a File Upload vulnerability. Recommendations: For Motivi...

PT-2025-23871 · Tenda · Tenda Ch22

Name of the Vulnerable Software and Affected Versions: Tenda CH22 version 1.0.0.1 Description: A critical issue has been found in the Tenda CH22, affecting the formaddUserName function of the file /goform/addUserName. The manipulation of the Password argument leads to a stack-based buffer overflo...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via TarFile.extractall and TarFile.extract functions in the tarfile module when using the filter parameter set to data or tar. An attacker can gain unauthorised access to files outside the intended extraction directo...

GHSA-8CJ5-5RVV-WF4V tar-fs can extract outside the specified dir with a specific tarball

Impact v3.0.8, v2.1.2, v1.16.4 and below Patches Has been patched in 3.0.9, 2.1.3, and 1.16.5 Workarounds You can use the ignore option to ignore non files/directories. js ignore , header // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory...

PT-2025-23642 · Audiocodes · Audiocodes Mediapack Mp-11X

Name of the Vulnerable Software and Affected Versions: Audiocodes Mediapack MP-11x versions 6.60A.369.002 and earlier Description: The issue allows an unauthenticated remote user to execute unauthorized code by sending a crafted POST request. This can result in the execution of unauthorized code...

PT-2025-23617 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to...

PT-2025-23677 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.46.0 through 2.1.6 Description: The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks...

PT-2025-23656 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function gmm state authentication/emm state authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack...

PT-2025-23883 · D Link · D-Link Dir-816

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version 1.10CNB05 Description: A critical issue has been discovered, affecting the /goform/form2lansetup.cgi file. The manipulation of the ip argument leads to a stack-based buffer overflow. This issue can be initiated remotely...

UBUNTU-CVE-2025-48387

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

CVE-2025-48387

Summary of CVE-2025-48387 (tar-fs) : A path-traversal risk in tar-fs bindings for tar-stream affects releases prior to 3.0.9, 2.1.3, and 1.16.5, where extracting certain tarballs can write outside the intended directory. The issue has been fixed in 3.0.9, 2.1.3, and 1.16.5. As a workaround, you c...

CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...