PT-2025-25369 · WordPress · Irm Newsroom

Name of the Vulnerable Software and Affected Versions: IRM Newsroom plugin for WordPress versions 1.2.17 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode due to insufficient input sanitization and output escaping on user-suppli...

PT-2025-25414 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue allows attackers to execute a directory traversal in the "/script-api/scripts/" endpoint. Recommendations: For OpenC3 COSMOS version 6.0.0, consider restricting access to the...

PT-2025-25415 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS allows attackers to execute arbitrary code via uploading a crafted .txt file. Recommendations: For OpenC3...

PT-2025-25413 · Unknown · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue allows attackers to execute a directory traversal in the "openc3-api/tables" endpoint. Recommendations: For OpenC3 COSMOS version 6.0.0, consider restricting access to the "openc3-api/tables"...

PT-2025-25455 · Ibm · Ibm Backup

Name of the Vulnerable Software and Affected Versions: IBM Backup, Recovery and Media Services for i versions 7.4 through 7.5 Description: The issue allows a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS...

PT-2025-29183 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.backupDatabase function. An authenticated attacker with user-level privileges can...

PT-2025-25444 · Unknown · Conda-Forge-Ci-Setup

Name of the Vulnerable Software and Affected Versions: conda-forge-ci-setup versions prior to 4.15.0 Description: The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An...

PT-2025-25449

Name of the Vulnerable Software and Affected Versions: Dell ControlVault3 versions prior to 5.15.10.14 Dell ControlVault3 Plus versions prior to 6.2.26.36 Description: A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality. A specially crafted ControlVaul...

PT-2025-25410 · Unknown +1 · Solon-Faas-Luffy +1

Name of the Vulnerable Software and Affected Versions: solon version 3.1.2 Description: A Directory Traversal issue allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component. Recommendations: For solon version 3.1.2, consider restricting access to the solon-faas-luffy...

CVE-2025-5982

An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information...

PT-2025-25280 · WordPress · Workreap

Name of the Vulnerable Software and Affected Versions: Workreap plugin for WordPress versions up to, and including, 3.3.1 Description: The issue arises from the plugin's failure to properly verify a user's identity before logging them in when verifying an account with an email address. This allow...

PT-2025-25328

Name of the Vulnerable Software and Affected Versions go-pg pg version 10.13.0 Description A SQL injection issue was discovered in the component /types/append value.go. This allows for potential SQL injection attacks. Recommendations For go-pg pg version 10.13.0, consider restricting access to th...

PT-2025-25342 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.55 Description: The issue is related to insufficient input validation in the warehouse component. Attackers with system administrator permissions can impair the availability of the Secure Access...

PT-2025-25279 · Unknown · Kicode111 Like-Girl

Name of the Vulnerable Software and Affected Versions: kiCode111 like-girl version 5.2.0 Description: A critical issue was found in the file /admin/ipAddPost.php, where the manipulation of the bz/ipdz argument leads to SQL injection. This issue can be exploited remotely. The exploit has been...

PT-2025-25346 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: MediaWiki Citizen Skin versions prior to 3.3.1 Description: The issue concerns the Citizen MediaWiki skin, which allows extensions to be part of a cohesive experience. Specifically, the citizen-search-noresults-title and...

PT-2025-25337 · Euroinformation · Euroinformation Moneticopaiement

Name of the Vulnerable Software and Affected Versions: EuroInformation MoneticoPaiement module for PrestaShop version 1.1.1 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to "transaction.php",...

PT-2025-25276 · Unknown · Kicode111 Like-Girl

Name of the Vulnerable Software and Affected Versions: kiCode111 like-girl version 5.2.0 Description: A critical issue has been found in the processing of the file /admin/ImgUpdaPost.php. The manipulation of the argument id, imgText, imgDatd, or imgUrl leads to SQL injection. The attack may be...

PT-2025-25329 · Unknown · Uptrace Pgdriver

Name of the Vulnerable Software and Affected Versions: uptrace pgdriver version 1.2.1 Description: The issue is related to a SQL injection vulnerability. It is caused by the appendArg function in /pgdriver/format.go. Recommendations: For uptrace pgdriver version 1.2.1, consider disabling the...

PT-2025-25332

Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.05.16 Description A Buffer Overflow issue allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an improper access restriction vulnerability. The vulnerability arises due to improperly set API access rights. An attacker could use this vulnerability to gain unauthorized...