PT-2025-1459 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions = 11.0.33 Description: The issue is related to a Cross Site Scripting XSS vulnerability via the Filter/FilterEditor function. This allows for potential malicious script execution. No informatio...

PT-2025-1451 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions = 11.0.33 Description: The issue is related to a Directory Traversal vulnerability via the Attachment/DownloadTempFile function. This allows unauthorized access to sensitive files and...

PT-2025-1452 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions = 11.0.33 Description: The issue is related to Directory Traversal via the Email/SaveAttachment function. This allows unauthorized access to sensitive files and directories. Recommendations: Fo...

PT-2025-1460 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions 11.0.33 and earlier Description: The issue is related to Cross Site Request Forgery CSRF via the WSCView function. This allows for unauthorized actions to be performed on behalf of a user witho...

PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...

PT-2025-3267

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.3.8 through 1.8.2 Description The issue concerns an authorization bypass in OpenFGA under specific conditions, including calling Check API or ListObjects with a model that uses conditions, and OpenFGA being configured with...

PT-2025-3875 · Unknown · Liujianview Gymxmjpa

Name of the Vulnerable Software and Affected Versions: liujianview gymxmjpa version 1.0 Description: A critical vulnerability has been found in the CoachController function of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the coachName argument...

PT-2025-3867 · Unknown · Exelban Stats

Name of the Vulnerable Software and Affected Versions: exelban stats versions up to 2.11.21 Description: A critical issue has been found in the shouldAcceptNewConnection function of the XPC Service component, leading to command injection. This issue can be exploited locally. Recommendations: For...

PT-2025-3868 · Unknown · Reckon Sppanadmin

Name of the Vulnerable Software and Affected Versions: reckcn SPPanAdmin version 1.0 Description: A cross-site scripting issue was found in the software, allowing for remote exploitation. The manipulation of the name argument in the "/;/admin/role/edit" file leads to this issue. Other parameters...

UBUNTU-CVE-2024-57804

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a SCSI mpi3mr driver that may result in a corrupted configuration page when the PHY is quickly...

CVE-2024-57228

Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vifdisable function...

SUSE CVE-2024-56669

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove cache tags before disabling ATS The current implementation removes cache tags after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically, CACHETAGDEVTLB type cache tags may still...

Linksys E7350 安全漏洞

The Linksys E7350 is a wireless router device from Leadsys. An input validation vulnerability exists in the handling of the iface parameter by the Linksys E7350 vifdisable function, which can be exploited by a remote attacker to submit a special request that can be used in the application context...

PT-2025-3088

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.2 Description The issue is related to an authenticated Client-Side Injection vulnerability in MonicaHQ. This vulnerability can be exploited via the Reason parameter at the "/people/h:id/debts/create" API endpoint...

PT-2025-3087

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.1 Description The issue is related to an authenticated Client-Side Injection vulnerability. This vulnerability can be triggered by an authenticated user through the entry text field at the "/journal/entries/ID/edit" API...

PT-2025-3085

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.2 Description The issue is related to multiple Client-Side Injection vulnerabilities found in MonicaHQ. These vulnerabilities occur via the first name and last name parameters in the Add a new relationship feature...

PT-2025-4749 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version v15.03.05.19 Description: The issue is related to command injection in the /goform/SetSambaCfg API endpoint, which may lead to remote arbitrary code execution. Recommendations: For Tenda ac9 version v15.03.05.19, as a...

PT-2025-3418 · Linksys · Linksys E7350

Name of the Vulnerable Software and Affected Versions: Linksys E7350 version 1.1.00.032 Description: A command injection issue was discovered via the ifname parameter in the apcli do enr pbc wps function. This allows for potential exploitation. Recommendations: For Linksys E7350 version 1.1.00.03...

PT-2025-3419 · Linksys · Linksys E7350

Name of the Vulnerable Software and Affected Versions: Linksys E7350 version 1.1.00.032 Description: A command injection issue was discovered via the iface parameter in the vif disable function. This allows for potential exploitation. No information is provided about the estimated number of...