PT-2025-31647 · Unknown +1 · Ak-Nord Usb-Server-Lxl +1

Name of the Vulnerable Software and Affected Versions: AK-Nord USB-Server-LXL Firmware version 0.0.16 Build 2023-03-13 Description: Insecure permissions within the /etc/init.d/lighttpd script allow a locally authenticated low-privilege user to execute arbitrary commands with root privileges. This...

CVE-2025-42947

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on...

CVE-2025-42947

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on...

CVE-2025-49484

The CVE-2025-49484 issue affects the Joomla JS Jobs plugin (versions 1.0.0–1.4.1) from Joomsky. A SQL injection is achievable through the cvid parameter in the employee application workflow, allowing low-privilege users to execute arbitrary SQL commands. The vulnerability stems from improper hand...

CVE-2025-6236

The CVE-2025-6236 entry applies to the Hostel WordPress plugin (before 1.1.5.9). It stems from insufficient sanitization/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disabled (notably in multisite). The Red Hat and Patchstac...

CVE-2025-6759

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS...

CVE-2025-20323

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search Bucket Copy Trigger within the Splunk Archiver application. This is because of missing access controls in the saved...

CVE-2025-20300

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that...

Splunk Cloud Platform和Splunk Enterprise 安全漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A security vulnerability exists in Splunk...

CVE-2025-4879

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows...

Exploit for Cross-site Scripting in Nagios Log_Server

Stored XSS Vulnerability in Nagios Log Server Privilege Esca...

CVE-2025-1055

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected ...

CVE-2025-1055 K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected ...

CVE-2025-1055

CVE-2025-1055 affects the K7RKScan.sys driver in the K7 Security Anti-Malware suite. A missing access control in the driver’s IOCTL handler lets a local, low-privilege user craft IOCTLs to terminate a wide range of processes running with admin or system privileges (excluding OS-protected ones). C...

CVE-2025-1055 K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected ...

GO-2025-3745 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2025-42993

Summary: CVE-2025-42993 affects SAP S/4HANA (Enterprise Event Enablement). A missing authorization check allows an attacker with access to Inbound Binding Configuration to create an RFC destination and assign a high-privilege user, enabling code execution under that user’s privileges. Impact is l...

CVE-2025-42993 Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

CVE-2025-42993 Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

GHSA-JC7G-X28F-3V3H listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary The env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on the host. While this may not be a problem on single-user super admin installations, on multi-user installations, this allows non-super-admin users with campaign or template...