PT-2025-25505 · Unknown · Uyanki Board-Stm32F103Rc-Berial

Name of the Vulnerable Software and Affected Versions: uYanki board-stm32f103rc-berial affected versions not specified Description: A critical vulnerability was found in the uYanki board-stm32f103rc-berial. This issue affects the heartrate1 i2c hal write function in the file heartrate1 hal.c. The...

📄 Microsoft Excel Remote Code Execution

Microsoft Excel appears to suffer from a remote code execution vulnerability via a malicious macro. Titles: Microsoft Excel Local Code Execution Vulnerability Author: nu11secur1ty Date: 06/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

Omise: Cache Pollution via Unkeyed GET Parameters on www.omise.co

The CDN serving the website appeared to cache pages based on the full URL, including arbitrary query parameters, without normalizing or properly keying them. This behavior resulted in cache pollution, where the cache was filled with redundant versions of the same page...

New Supply Chain Malware Operation Hits npm and PyPI Ecosystems, Targeting Millions Globally

Cybersecurity researchers have flagged a supply chain attack targeting over a dozen packages associated with GlueStack to deliver malware. The malware, introduced via a change to "lib/commonjs/index.js," allows an attacker to run shell commands, take screenshots, and upload files to infected...

CVE-2025-49239

Cross-Site Request Forgery CSRF vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through = 5.5.0...

CVE-2025-49239

CVE-2025-49239 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Print Invoice & Delivery Notes for WooCommerce ≤ 5.5.0. The issue affects the plugin’s ability to perform actions without proper user interaction, enabling unauthorized requests via CSRF. The CVSSv3...

CVE-2025-49239 WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through = 5.5.0...

WordPress plugin Print Invoice & Delivery Notes for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Malicious code in pizza-delivery (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32883280f27dee6f08c25f84fa750e17fad3b3193488b14da6a77cddf52ef582 Any computer that has this package installed or running should be considered...

MAL-2025-4757 Malicious code in pizza-delivery (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32883280f27dee6f08c25f84fa750e17fad3b3193488b14da6a77cddf52ef582 Any computer that has this package installed or running should be considered...

nextjs-auth0 安全漏洞

nextjs-auth0 is an Auth0 open source Next.js SDK for logging in using Auth0. A security vulnerability exists in nextjs-auth0 versions 4.0.1 through 4.6.0 and earlier, which stems from a missing Cache-Control header that could result in session cookies being cached by a CDN...

CVE-2025-5544

A vulnerability was found in aaluoxiang oasystem up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversa...

CVE-2025-5544 aaluoxiang oa_system UserpanelController.java image path traversal

A vulnerability was found in aaluoxiang oasystem up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversa...

CVE-2025-5544

CVE-2025-5544 affects aaluoxiang oa_system up to version 5b445a6227b51cee287bd0c7c33ed94b801a82a5. The vulnerability is in the image function of src/main/java/cn/gson/oasys/controller/user/UserpanelController.java, enabling path traversal. Exploitation is remote and has been publicly disclosed. N...

The Role of Continuous Integration and Continuous Deployment (CI/CD) in DevOps

Modern software development demands rapid delivery of high-quality applications that can adapt to changing business requirements and user…...

CVE-2025-5380

A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This issue affects some unknown processing of the file /upload/ of the component Image File Upload. The manipulation of the argument File lead...

Citrix Director Infrastructure Monitoring – License Server Connection status is not available

When admin checks Delivery Controller data in Citrix Director - Infrastructure Monitoring, the license server related information is not available. All other metrics are displayed correctly. License Server is configured correctly and there are no issues with licenses. CVAD Site is functioning...

CVE-2025-5388

A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes the approach of...

CVE-2025-5388 JeeWMS generateController.do dogenerate sql injection

A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes the approach of...

Fake AI video generator tools lure in Facebook and LinkedIn users to deliver malware

Cybercriminals are taking advantage of the public’s interest in Artificial Intelligence AI and delivering malware via text-to-video tools. According to researchers at Mandiant, the criminals are setting up websites claiming to offer “AI video generator” services, and then using those fake tools t...