CVE-2025-59385

An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication. We have already fixed the...

EUVD-2025-203863

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the getinstagramaccesstokencallback, googlemapapikeysavecallback and getsiteinfo functions in all...

PT-2025-51953

Name of the Vulnerable Software and Affected Versions Zenphoto version 1.6 Description An authenticated attacker can inject malicious scripts by inserting HTML content into album descriptions. Attackers can create albums with malicious iframe or script tags in the description field, which execute...

PT-2025-51965

Name of the Vulnerable Software and Affected Versions PHPJabbers Simple CMS version 5.0 Description The software contains a stored cross-site scripting issue. Authenticated attackers can inject malicious scripts through section name parameters. Attackers can create sections with embedded JavaScri...

Portrait Displays Dell Color Management 安全漏洞

Portrait Displays Dell Color Management is a color management software from Portrait Displays, Inc. A security vulnerability exists in Portrait Displays Dell Color Management version 3.3.8, which stems from an improperly set permissions on a temporary folder created when using a custom installati...

PT-2025-51971

Name of the Vulnerable Software and Affected Versions Serendipity version 2.4.0 Description An authenticated attacker can upload malicious PHP files with a .phar extension, leading to remote code execution. Attackers can upload files containing system command payloads to the media upload endpoint...

PT-2025-51848

A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone number parameter...

PT-2025-51962

Name of the Vulnerable Software and Affected Versions UliCMS version 2023.1-sniffing-vicuna Description The software contains a remote code execution issue that allows authenticated attackers to upload PHP files with a .phar extension during profile avatar uploads. Attackers can execute code by...

CVE-2025-66923

A Cross-site scripting (XSS) vulnerability exists in Open Source Point of Sale v3.4.1 within the Create/Update Customer(s) functionality. The root cause is an unvalidated phone_number parameter, which allows remote attackers to inject arbitrary web script or HTML. While specific remediation steps...

ROS-20251217-7318

A vulnerability in the V8 JavaScript script handler of Google Chrome browser is related to data type mixing errors. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality, integrity and availability of protected information using a specially crafted HTML pag...

ROS-20251217-7305

A vulnerability in the Omnibox component of the Google Chrome browser is related to the implementation of an incorrect control flow. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information...

PT-2025-51950

Name of the Vulnerable Software and Affected Versions USB Flash Drives Control version 4.1.0.0 Description USB Flash Drives Control version 4.1.0.0 contains an unquoted service path vulnerability in its service configuration. This allows local attackers to potentially execute arbitrary code. The...

PT-2025-51806

Name of the Vulnerable Software and Affected Versions ListCheck.exe affected versions not specified Description ListCheck.exe, developed by Acer, has a Local Privilege Escalation issue. An authenticated local attacker can replace ListCheck.exe with a malicious executable sharing the same name. Th...

PT-2025-51948

Name of the Vulnerable Software and Affected Versions WBCE CMS version 1.6.1 Description WBCE CMS version 1.6.1 has a stored cross-site scripting issue. Authenticated attackers can inject malicious JavaScript by inserting script tags into page content using the WYSIWYG editor. Attackers can submi...

python-jose 安全漏洞

python-jose is a JOSE implementation in Python by the individual developer Michael Davis. A security vulnerability exists in python-jose version 3.3.0, which stems from an attacker being able to construct malicious JSON Web Encryption tokens with extremely high compression rates, potentially...

PT-2025-51947

Name of the Vulnerable Software and Affected Versions WBCE CMS version 1.6.1 Description WBCE CMS version 1.6.1 has a stored cross-site scripting issue. Authenticated attackers can inject malicious JavaScript by uploading specially crafted SVG files. This is achieved through the media manager by...

The vulnerability of the FactoryTalk Linx automation system’s software, related to incorrect privilege assignment, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the FactoryTalk Linx automation system’s software is related to the improper assignment of privileges. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability in the web interface of the Juniper Networks Junos Space Security Director allows a attacker to gain unauthorized access to and modify protected information.

The vulnerability of the Juniper Networks Junos Space Security Director web interface interface is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to and modify the protected information...

The vulnerability of the software for providing secure remote access to data in Palo Alto Networks’ GlobalProtect App is related to errors in the certificate validation process. This allows a malicious actor to create malicious certificates.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to create malicious certificates from a remote location...

The vulnerability of the Qsync Central file synchronization application, related to unlimited distribution of resources, allows a hacker to cause a service failure.

The vulnerability of the Qsync Central file synchronization application is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service failures...