CVE-2025-34133 Wimi Teamwork < v7.38.17 CSRF

Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery CSRF vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrftoken' without validating the field’s value; only the presence of the field is checked. An attacker can craf...

CVE-2025-11248

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token...

EUVD-2025-36177

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token...

CVE-2025-6601 Business Logic Errors in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow...

CVE-2025-11971

GitLab EE fixed CVE-2025-11971, which allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits. Affected versions were 10.6 to before 18.3.5, 18.3.x before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1; remediation was released as patch updates (n...

CVE-2025-60982

CVE-2025-60982 is an IDOR vulnerability in Educare ERP 1.0. Affected API endpoints fail to enforce authorization, allowing authenticated users to access or modify data belonging to other users by altering object identifiers. The issue is described consistently across multiple feeds (Red Hat, ENIS...

PT-2025-44013

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 Description IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is susceptible to stored cross-site scripting. An authenticated user can inje...

PT-2025-44070

Name of the Vulnerable Software and Affected Versions IBM DB2 High Performance Unload versions 5.1.0.1 through 6.5.0.0 IF1 IBM DB2 High Performance Unload version 6.1 IBM DB2 High Performance Unload version 6.1.0.1 IBM DB2 High Performance Unload version 6.1.0.2 IBM DB2 High Performance Unload...

CVE-2025-60982

IDOR vulnerability in Educare ERP 1.0 2025-04-22 allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object...

PT-2025-44071

Name of the Vulnerable Software and Affected Versions IBM DB2 High Performance Unload versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 Description An authenticated user can cause the program to crash due to an out-of-bounds write condition. Recommendations IBM DB2 High...

PT-2025-44068

Name of the Vulnerable Software and Affected Versions IBM DB2 High Performance Unload versions 5.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 IBM DB2 High Performance Unload version 5.1.0.1 Description An authenticated user can cause the program to crash due to an incorrect calculation...

Medium: samba

Issue Overview: A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure...

Siemens SIMATIC Devices Information Exposure through Microarchitectural State after Transient Execution (CVE-2023-28746)

Information exposure through microarchitectural state after transient execution from some register files for some IntelR AtomR Processors may allow an authenticated user to potentially enable information disclosure via local access. This plugin only works with Tenable.ot. Please visit...

Linux Distros Unpatched Vulnerability : CVE-2025-9640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an...

EUVD-2025-35923

The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. Th...

CVE-2025-11875

The CVE refers to the SpendeOnline.org WordPress plugin (affected: versions up to 3.0.1) with a Stored Cross‑Site Scripting vulnerability via the spendeonline shortcode due to insufficient input sanitization and output escaping of user attributes. This could allow authenticated attackers with con...

CVE-2025-11823

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonexisttext' parameter in the 'wishsuitebutton' shortcode in all versions up to, and including, 3.2.4 due to insufficient...

FlashMQ 安全漏洞

FlashMQ is a fast and lightweight MQTT proxy server from the individual developer Wiebe Cazemier. A security vulnerability exists in FlashMQ versions prior to 1.23.2 that stems from an authenticated user being able to create sessions and collect QoS messages, potentially resulting in unreleased...

EUVD-2025-35852

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baudrate,...

CVE-2025-36361

IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization...