PT-2025-28153 · Langgenius · Dify

Name of the Vulnerable Software and Affected Versions: langgenius/dify versions 1.1.0 through 1.1.2 Description: The issue arises from unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. This is due to the ability to override global functions in...

PT-2025-28098 · Curl +1 · Curl +1

Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20 Description: A critical issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl, leading to server-side request forgery. The attack may be initiated remotely...

PT-2025-28148

Name of the Vulnerable Software and Affected Versions: llama index versions up to v0.12.22.post1 Description: A vulnerability in the ArxivReader class allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but...

PT-2025-28125 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A vulnerability has been found in the component Course Module, affecting the file /intranet/educar curso det.php?cod curso=ID. The manipulation of the Curso argument leads to cross-site scripting...

PT-2025-28146 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file, where manipulation of the Username argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-28163

Name of the Vulnerable Software and Affected Versions: run-llama/llama index versions 0.12.27 through 0.12.40 Description: A path traversal vulnerability exists, specifically within the encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read...

PT-2025-28173 · Hashview · Hashview

Name of the Vulnerable Software and Affected Versions: Hashview version 0.8.1 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header. Recommendations: For...

PT-2025-28223 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to 1.2.10 Description: An open redirect issue has been found in the originCheck middleware function of Better Auth, an authentication and authorization library for TypeScript. The affected routes include...

PT-2025-28165 · Unknown · Campcodes Payroll Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Payroll Management System version 1.0 Description: A critical issue affects the processing of the file "/ajax.php?action=delete employee attendance single". The manipulation of the ID argument leads to SQL injection. The attack may ...

PT-2025-28217 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.1 Description: A Time-Based Blind SQL Injection issue was discovered in the almox parameter of the "/controle/relatorio geracao.php" endpoint. This allows an attacker to inject arbitrary SQL queries, potentially...

PT-2025-28221 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.3.0 Description: The WeGIA server has a vulnerability that allows excessively long HTTP GET requests to a specific URL, resulting from the lack of validation for the length of the fid parameter. This issue can cause...

PT-2025-28175 · Jobcenter · Jobcenter

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header...

PT-2025-28241 · Robocode +1 · Robocode +1

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.22.6 Description: Roo Code is an AI-powered autonomous coding agent. If the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and...

PT-2025-28198 · Samsung · Exynos 2400 +1

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor and Modem Exynos 2400 Samsung Mobile Processor and Modem Modem 5400 Description: An issue was discovered in L2, where the lack of a length check leads to a Denial of Service via a malformed PDCP packet. Recommendation...

PT-2025-28124 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic vulnerability was found in the School Module component, specifically affecting the /intranet/educar escola lst.php file. The manipulation of the Escola argument leads to cross-site...

PT-2025-28129 · Unknown · Nimesa Backup/Recovery

Name of the Vulnerable Software and Affected Versions: Nimesa Backup and Recovery affected versions not specified Description: A server-side request forgery SSRF issue exists, which may allow unintended requests to be sent to internal servers if exploited. Recommendations: At the moment, there is...

Exploit for CVE-2025-4403

CVE-2025-4403 : Unauthenticated Arbitrary File Upload Vulnerab...

CVE-2025-27446

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

CVE-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

PT-2025-28065 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIXjava-plugin-runner versions 0.2.0 through 0.5.0 Description: The issue is related to incorrect permission assignment for critical resources in the Apache APISIX java-plugin-runner, allowing a local attacker to elevate privileges...