CVE-2025-41667 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script

A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device...

CVE-2025-41666 Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

PT-2025-28118 · Unknown · Threatsonar Anti-Ransomware

Name of the Vulnerable Software and Affected Versions: ThreatSonar Anti-Ransomware affected versions not specified Description: The issue allows remote attackers with intermediate privileges to inject arbitrary OS commands and execute them on the server, gaining administrative access to the remot...

CVE-2025-27460 CVE-2025-27460

The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker ca...

CVE-2025-38142

The CVE-2025-38142 issue affects the Linux kernel hwmon path (asus-ec-sensors) where read_string() could read a non-existent sensor because find_ec_sensor_index() returned a negative value (for example -ENOENT) and was used without validation. The fix introduces a check to ensure sensor_index is ...

PT-2025-27815 · Abb · Abb Rmc-100 Lite +1

Name of the Vulnerable Software and Affected Versions: ABB RMC-100 versions 2105457-043 through 2105457-045 ABB RMC-100 LITE versions 2106229-015 through 2106229-016 Description: The issue allows an attacker to gain access to salted information, which can be used to decrypt MQTT information. This...

CVE-2025-34076 Microweber CMS Authenticated Local File Inclusion via Backup API

An authenticated local file inclusion vulnerability exists in Microweber CMS versions = 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By...

CVE-2025-27025 Improper File Access in Infinera G42

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root...

PT-2025-27353 · Unknown · Code-Projects Simple Forum

Name of the Vulnerable Software and Affected Versions: code-projects Simple Forum version 1.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file "/forum1.php". The manipulation of the File argument leads to SQL injection. This issue can be exploited...

CVE-2023-28907

CVE-2023-28907 describes a lack of memory isolation between CPU cores in the VW MIB3 infotainment, enabling an attacker with access to the main OS to compromise the core handling CAN message processing. The issue was first reported in Skoda Superb III with OEM part 3V0035820; a list of affected M...

PT-2025-27285 · WordPress · Beeteam368 Extensions Pro

Name of the Vulnerable Software and Affected Versions: BeeTeam368 Extensions Pro plugin for WordPress versions up to, and including, 2.3.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform actions on files outside of the originally intended...

CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

(0Day) Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the decryptFile method. The issue results from the lack o...

(0Day) Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QLogicDownloadImpl class. The issue...

CVE-2025-45729

D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services...

CVE-2025-6694 LabRedesCefetRJ WeGIA Adicionar Unidade adicionar_unidade.php cross site scripting

A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/adicionarunidade.php of the component Adicionar Unidade. The manipulation of the argument Insira a nova unidade leads to cross site...

PT-2025-28088 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical issue affects the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey in the component webs. The manipulation of the argument submit-url-ok leads to a stack-based buffer...

CVE-2025-52936 Improper Link Resolution Before File Access vulnerability in yrutschle/sslh

Improper Link Resolution Before File Access 'Link Following' vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2...

CVE-2025-52936

CVE-2025-52936 affects the sslh package (yrutschle sslh) prior to 2.2.2. Debian’s DLA-4238-1 and related advisories disclose a link-following vulnerability and fix it in Debian 11 bullseye with package version 1.20-1+deb11u1 . The vulnerability is described as an “Improp­er Link Resolution Before...