CVE-2025-32438 Local privilege escalation in make-initrd-ng

make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled the default a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 a...

CVE-2025-32438 Local privilege escalation in make-initrd-ng

make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled the default a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 a...

PT-2025-16557 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A critical issue affects the setScheduleCfg function of the /cgi-bin/cstecgi.cgi file, leading to improper access controls. The attack can be initiated remotely. The vendor was...

PT-2025-16562 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A critical issue affects the setL2tpServerCfg function of the file /cgi-bin/cstecgi.cgi, leading to improper access controls. The attack can be launched remotely. The exploit has been...

PT-2025-16349 · Mozilla +10 · Thunderbird +10

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 137.0.2 Thunderbird versions prior to 128.9.2 Description: The issue allows an attacker to disclose sensitive information from the victim's system by crafting a malformed file name for an attachment in a multipar...

PT-2025-18465

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue has been identified in the ICSS IEP driver of the Linux kernel. This issue occurs when disabling PPS and perout signals during the icss iep exit function...

PT-2025-16347 · Edimax · Edimax Ac1200 Wave 2 Dual-Band Gigabit Router Br-6478Ac V3

Name of the Vulnerable Software and Affected Versions: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 version 1.0.15 Description: A stack overflow issue was discovered in the Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 via the peerPin parameter in the formWsc function...

PT-2025-16554 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A critical issue has been identified, affecting the setSmartQosCfg function of the /cgi-bin/cstecgi.cgi file. This leads to improper access controls. The issue can be exploited...

PT-2025-16550 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A critical vulnerability has been found in the TOTOLINK A3700R, affecting the function setWiFiEasyCfg/setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi in the Password Handler...

PT-2025-16339 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version V4.1.2cu.5137 B20200730 Description: A buffer overflow vulnerability was found in the downloadFile.cgi of TOTOLINK A800R. The issue allows for a potential buffer overflow. Recommendations: For TOTOLINK A800R version...

PT-2025-16380 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V4.0si V16.03.10.20 Description: The issue concerns a Buffer Overflow in the AdvSetMacMtuWan function via the mac2 variable. Recommendations: For Tenda AC10 version V4.0si V16.03.10.20, as a temporary workaround, consider...

PT-2025-16284 · Unknown · Http-Proxy-Middleware

Name of the Vulnerable Software and Affected Versions: http-proxy-middleware versions 2.0.9 and earlier, 3.x versions prior to 3.0.5 Description: The issue arises when fixRequestBody proceeds even if bodyParser has failed. This can lead to potential security risks. Recommendations: For versions...

Pleezer resource exhaustion through uncollected hook script processes

Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change an...

GHSA-472W-7W45-G3W5 Pleezer resource exhaustion through uncollected hook script processes

Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change an...

PT-2025-16198

Name of the Vulnerable Software and Affected Versions: frdel Agent-Zero version 0.8.1.2 Description: A critical issue was found in the /get work dir files file, where the manipulation of the path argument leads to path traversal. This issue can be initiated remotely. Recommendations: For version...

PT-2025-16212 · Unknown · Ghostxbh Uzy-Ssm-Mall

Name of the Vulnerable Software and Affected Versions: ghostxbh uzy-ssm-mall version 1.0.0 Description: A vulnerability was found in the software, classified as problematic. It leads to cross-site request forgery and can be launched remotely. The exploit has been disclosed to the public...

PT-2025-16275 · Zhenfeng13 · My-Blog-Layui

Name of the Vulnerable Software and Affected Versions: ZHENFENG13/code-projects My-Blog-layui version 1.0 Description: A problem was found in the software, affecting an unknown part of the file /admin/v1/link/edit. This issue leads to cross site scripting and can be initiated remotely. Multiple...

CVE-2025-31362

Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available. The vendor provides the workaround information and recommends to apply it to the deployment environment...

CVE-2025-31932

Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console. The vendor provides the workaround information and recommends to apply it to the deployment environment...

PT-2025-16177 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 9.5.21 Description: A vulnerability was found in YouDianCMS, affecting unknown code of the file /App/Tpl/Member/Default/Order/index.html. The manipulation of the OrderNumber argument leads to cross-site scripting. The attac...