PT-2025-29327 · Unknown · Simple Car Rental System

Name of the Vulnerable Software and Affected Versions: Simple Car Rental System version 1.0 Description: A critical vulnerability exists in the Simple Car Rental System. The vulnerability affects unknown code within the /admin/approve.php file. Manipulation of the ID argument results in a SQL...

CVE-2025-48924 Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass... can throw StackOverflowError on very long input...

CVE-2025-48924 Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass... can throw StackOverflowError on very long input...

CVE-2025-7435

A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /siteadmin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue...

CVE-2025-7208

A vulnerability was found in 9fans plan9port up to 9da5b44. It has been classified as critical. This affects the function edump in the library /src/plan9port/src/libsec/port/x509.c. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used...

PT-2025-29217 · WordPress · Wpgym - Wordpress Gym Management System

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions prior to 67.8.0 Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation...

PT-2025-29270 · Unknown · Hax Cms Php +1

Name of the Vulnerable Software and Affected Versions: haxcms-nodejs versions prior to 11.0.6 haxcms-php versions prior to 11.0.6 Description: The logout function does not properly terminate user sessions or clear cookies. A refresh token is issued during logout, potentially allowing continued...

PT-2025-29215 · WordPress +7 · Openai Plugin For Wordpress +8

Name of the Vulnerable Software and Affected Versions: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress versions through 26.0.8 Description: The WordPress plugin is susceptibl...

PT-2025-29218 · WordPress · Broken Link Notifier For Wordpress

Name of the Vulnerable Software and Affected Versions: Broken Link Notifier for WordPress versions prior to 1.3.1 Description: The plugin is susceptible to CSV injection through broken links that are exported. This allows authenticated attackers with Contributor-level access or higher to embed...

PT-2025-29230

Name of the Vulnerable Software and Affected Versions JGM Pandoc version 3.6.4 Description A Server-Side Request Forgery SSRF issue exists in JGM Pandoc version 3.6.4. This flaw allows attackers to potentially compromise the entire infrastructure by injecting a crafted iframe. Reports indicate...

PT-2025-29266 · Immich · Immich

Name of the Vulnerable Software and Affected Versions: immich versions prior to 1.132.0 Description: immich is a self-hosted photo and video management solution. A flaw exists in the OAuth2 implementation where the state parameter is not validated. This parameter, functioning similarly to a...

PT-2025-29861 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open-source web manager designed for Portuguese-speaking users and charitable organizations. A Reflected Cross-Site Scripting XSS vulnerability exists in the cadastro adotante.php endpoin...

PT-2025-29214 · WordPress · Foogallery

Name of the Vulnerable Software and Affected Versions: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress versions through 2.4.31 Description: The FooGallery plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient...

PT-2025-29265 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic versions prior to 2.5.1 Description: Meshtastic, an open source mesh networking solution, does not rate limit traceroute responses from remote nodes in versions prior to 2.5.1. This allows an attacker to reliably and continuously...

PT-2025-29210 · WordPress · Wp Register Profile With Shortcode

Name of the Vulnerable Software and Affected Versions: WP Register Profile With Shortcode versions up to and including 3.6.2 Description: The WP Register Profile With Shortcode plugin for WordPress is susceptible to sensitive information exposure via the rp user data shortcode. Authenticated...

PT-2025-29864 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A Reflected Cross-Site Scripting XSS vulnerability exists in the personalizacao selecao.php endpoint. This vulnerability allows attackers to inject malicious...

PT-2025-29282 · Unknown · Campcodes Online Movie Theater Seat Reservation System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Movie Theater Seat Reservation System version 1.0 Description: A critical vulnerability exists in Campcodes Online Movie Theater Seat Reservation System version 1.0. The vulnerability is due to SQL injection in the...

Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2025-1813)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-3947 Integer underflow during processing of short network packets in CDA FTEB responder

The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access CDA. An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a...

CVE-2025-2520 Dereferencing of an uninitialized pointer leads to denial of service.

The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer EPA communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to...