The vulnerability of the LockDatabaseSettings method in the software for managing and monitoring deleted objects in telemetry and telemechanics systems, allowing a hacker to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the LockDatabaseSettings method in software for managing and monitoring deleted objects in telemetry and telemechanics systems related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass security...

The vulnerability of the UnlockTcmSettings method in the software for managing and monitoring deleted objects in telemetering and telemechanics systems allows a perpetrator to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the UnlockTcmSettings method in the software for managing and monitoring removed objects in Telemetry and Telemechanics systems is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass securi...

PT-2025-18002 · Unknown · Scriptandtools Ecommerce-Website-In-Php

Name of the Vulnerable Software and Affected Versions: ScriptAndTools eCommerce-website-in-PHP version 3.0 Description: A vulnerability was found in the processing of the file /admin/subscriber-csv.php, which can lead to information disclosure. The attack may be initiated remotely. Recommendation...

CVE-2025-28233

Incorrect access control in BW Broadcast TX600 14980, TX300 32990 31448, TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking...

CVE-2025-37087

A vulnerability in the cmdb service of the HPE Performance Cluster Manager HPCM could allow an attacker to gain access to an arbitrary file on the server host...

CVE-2025-32950

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server...

CVE-2025-24911

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-1565

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remotedl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

🛡️ SOC287 - Arbitrary File Read on Checkpoint Security Gateway...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-32986

NETSCOUT nGeniusONE vulnerable prior to version 6.4.0 b2350. The issue is a sensitive file accessible without proper authentication to an endpoint, indicating an access-control weakness in the affected component. Affected product/version: NETSCOUT nGeniusONE before 6.4.0 b2350. Reported impact: e...

PT-2025-17944 · Netscout · Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue concerns a Sensitive File Accessible Without Proper Authentication to an endpoint. No information is provided about the estimated number of potentially affected devices...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-3300

The WPMasterToolKit WPMTK – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on...

CVE-2025-3300 WPMasterToolKit (WPMTK) – All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write

The WPMasterToolKit WPMTK – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on...

XML External Entity (XXE) Injection

RichText is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper input validation due to unsafe XML elements being processed in user-editable RichText fields, allowing attackers with edit permissions to read server files...

PT-2025-17715 · Unknown · Wpmastertoolkit

Name of the Vulnerable Software and Affected Versions: WPMasterToolKit WPMTK versions up to, and including, 2.5.2 Description: The issue allows authenticated attackers with Administrator-level access and above to read and modify the contents of arbitrary files on the server, potentially containin...

CVE-2025-37087

A vulnerability in the cmdb service of the HPE Performance Cluster Manager HPCM could allow an attacker to gain access to an arbitrary file on the server host...

CVE-2025-37087

CVE-2025-37087 affects HPE Performance Cluster Manager (HPCM) cmdb service. Multiple connected sources confirm a vulnerability that could allow an attacker to access an arbitrary file on the server host. The initial entry lists a high-severity CVSS 3.1 vector (9.8, NETWORK / LOW complexity / no u...