PT-2025-23746

Name of the Vulnerable Software and Affected Versions Samsung Cloud for Galaxy Watch versions prior to SMR Jun-2025 Release 1 Description The issue is related to an incorrect default permission setting in Samsung Cloud for Galaxy Watch, allowing local attackers to access data. This could...

CVE-2025-5520 Open5GS AMF/MME emm_state_authentication assertion

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmmstateauthentication/emmstateauthentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has be...

[SECURITY] [DLA 4199-1] tcpdf security update

Debian LTS Advisory DLA-4199-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón May 31, 2025 https://wiki.debian.org/LTS Package : tcpdf Version : 6.3.5+dfsg1-1+deb11u1 CVE ID : CVE-2024-22640 CVE-2024-22641 CVE-2024-32489 CVE-2024-51058 CVE-2024-56519...

CVE-2025-5499 slackero phpwcms image_resized.php getimagesize deserialization

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function isfile/getimagesize of the file imageresized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit ha...

CVE-2025-5497 slackero phpwcms Feedimport processing.inc.php deserialization

A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/incmodule/modfeedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnttext results in deserialization. The...

PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...

PT-2025-23658 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 DataEase version 2.10.6 through 2.10.9 Description: The issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection due to a bypass of a previous patch...

PT-2025-23675 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R version 1.0.0-B20230726.1108 Description: The issue is related to a cross-site scripting vulnerability in the Virtual Server Page of the TOTOLINK X2000R router. This vulnerability can be exploited remotely by manipulating the...

PT-2025-23593 · Unknown · Pc Time Tracer

Name of the Vulnerable Software and Affected Versions: PC Time Tracer versions prior to 5.2 Description: The issue is related to incorrect default permissions in PC Time Tracer. If exploited, a local authenticated attacker could execute arbitrary code with SYSTEM privilege on Windows systems wher...

PT-2025-23671

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10 Description DataEase is an open source business intelligence and data visualization tool. The issue arises from a flaw in the patch that allows it to be bypassed due to case insensitivity, as INIT and RUNSCRI...

PT-2025-23677 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.46.0 through 2.1.6 Description: The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks...

PT-2025-23612 · Phpcms · Phpcms

Name of the Vulnerable Software and Affected Versions: phpwcms versions 1.9.45 through 1.10.8 Description: A critical vulnerability was found in the Feedimport Module of phpwcms, affecting unknown code in the file include/inc module/mod feedimport/inc/processing.inc.php. The manipulation of the c...

PT-2025-23615 · Erupt · Erupt

Name of the Vulnerable Software and Affected Versions: erupt version 1.12.19 Description: The issue is related to an arbitrary file upload vulnerability in the /upload/GoodsCategory/image component, which allows attackers to execute arbitrary code by uploading a crafted file. Recommendations: For...

PT-2025-23598

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.1.1 build 55740 Description A privilege escalation issue exists in the Snapshot functionality of Parallels Desktop for Mac. When a snapshot of a virtual machine is taken, a root service writes to a file own...

PT-2025-23648 · Unknown · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 5.2.1 Description: The issue allows an attacker to steal users' source code when they access a malicious website. This is possible because the request for a classic script by a script tag is not subject to...

PT-2025-23654

Name of the Vulnerable Software and Affected Versions Multer versions 1.4.4-lts.1 through 2.0.0 Description A Denial of Service DoS issue is present, allowing an attacker to crash the process by sending an upload file request with an empty string field name, causing an unhandled exception...

PT-2025-23669 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 Description: A bypass of the patch for a previous issue exists, allowing for the construction of a malicious JDBC statement. In a malicious payload, the getUrlType function retrieves the hostName. Since the...

PT-2025-23587 · WordPress · Fancybox

Name of the Vulnerable Software and Affected Versions: FancyBox for WordPress versions prior to 3.3.6 Description: The issue is related to the FancyBox plugin for WordPress not escaping captions and titles attributes before using them to populate galleries' caption fields. This was initially...

PT-2025-23613

Name of the Vulnerable Software and Affected Versions slackero phpwcms versions 1.9.45 and earlier, slackero phpwcms versions 1.10.8 and earlier Description A critical issue affects the function file get contents/is file of the file include/inc lib/content/cnt21.readform.inc.php in the Custom...

PT-2025-23617 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to...