AZL-62229 CVE-2025-48866 affecting package mod_security 2.9.4-1

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

PT-2025-23528

Name of the Vulnerable Software and Affected Versions catdoc version 0.95 Description An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to...

PT-2025-23503 · Linksys · Linksys Re6300 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001 Description: A critical issue has been found, affecting the function RP pingGatewayByBBS of the file /goform/RP pingGatewayByBBS. The...

PT-2025-23489 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001 Description: A critical vulnerability has been found in the Linksys RE-series range extenders. This affects the NTP function of the file...

PT-2025-23475 · Unknown · Aem Solutions Cms

Name of the Vulnerable Software and Affected Versions: Aem Solutions CMS versions up to 1.0 Description: A critical issue affects an unknown part of the file /page.php. The manipulation of the ID argument leads to sql injection. It is possible to initiate the attack remotely. The vendor was...

PT-2025-23465 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue was found in the software. It affects an unknown function of the file /department-profile.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23496 · Unknown · Ce Phoenix

Name of the Vulnerable Software and Affected Versions: CE Phoenix versions 1.0.9.9 through 1.1.0.2 Description: A stored cross-site scripting XSS issue was found in CE Phoenix, where an attacker can inject malicious JavaScript into the testimonial description field. If the shop owner approves the...

ModSecurity -- possible DoS vulnerability

[email protected] reports: ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg -...

PT-2025-23550 · Weblaudos · Weblaudos

Name of the Vulnerable Software and Affected Versions: WebLaudos version 24.2 04 Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information via the id parameter. This enables the attacker to access confidential data. Recommendations: For WebLaudos version 24...

PT-2025-23471 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /view tender.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

CVE-2025-48883

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...

CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

PT-2025-23369 · Sourcecodester · Sourcecodester Php Display Username After Login

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP Display Username After Login version 1.0 Description: A critical vulnerability has been found in the software. The issue affects an unknown function of the file /login.php. Manipulation of the Username argument leads to SQL...

PT-2025-23410 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS up to 20250504 Description: A critical issue affects the transEditor function of the file "/cgformTransController.do?transEditor". This issue leads to SQL injection and can be initiated remotely. Recommendations: For JeeWMS up to...

PT-2025-23409 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions up to 20250504 Description: A critical issue affects the doAdd function of the /cgformTemplateController.do?doAdd API endpoint, leading to path traversal. This can be initiated remotely. Recommendations: For versions up to...

PT-2025-23368 · Unknown · Phpgurukul Daily Expense Tracker System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Daily Expense Tracker System version 1.1 Description: A critical issue affects some unknown processing of the file /expense-yearwise-reports-detailed.php. The manipulation of the argument todate leads to SQL injection. The attack m...

PT-2025-23408 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions up to 20250504 Description: A critical issue was found, affecting the function CgAutoListController of the file "/cgAutoListController.do?datagrid". This issue leads to sql injection and can be initiated remotely. The product...