PT-2025-23591 · Timeworks · Timeworks

Name of the Vulnerable Software and Affected Versions: TimeWorks versions 10.0 through 10.3 Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This could allow a remote unauthenticated attacker to access arbitrary JSON...

PT-2025-29390

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.45 Description A problematic issue has been identified in GNU Binutils 2.45. This issue affects the bfd elf set group contents function within the bfd/elf.c file, leading to an out-of-bounds write condition. The attack c...

PT-2025-23649 · Unknown · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 5.2.1 Description: The issue allows an attacker to obtain source code via a method similar to that used to exploit a previously reported vulnerability. This is possible because webpack-dev-server always...

PT-2025-23652 · Maxkb · Maxkb

Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.10.8-lts Description: The issue allows attackers to exploit certain files with execution permissions in non-blacklisted directories to carry out attacks, as the Sandbox only restricts the execution permissions of...

PT-2025-23668 · Unknown · Jrohy Trojan

Name of the Vulnerable Software and Affected Versions: Jrohy trojan versions up to 2.15.3 Description: A critical issue affects the LogChan function in the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. This issue can be initiated remotely, but the...

PT-2025-23594 · WordPress · Woocommerce Ultimate Gift Card

Name of the Vulnerable Software and Affected Versions: Ultimate Gift Cards for WooCommerce plugin for WordPress versions prior to 3.1.5 Description: The issue is related to boolean-based SQL Injection via the default price and product id parameters. This is due to insufficient escaping of...

PT-2025-23664 · Unknown · Enilu Web-Flash

Name of the Vulnerable Software and Affected Versions: enilu web-flash version 1.0 Description: A problematic vulnerability has been found in the File Upload component of enilu web-flash. This issue affects the fileService.upload function, allowing for cross-site scripting through the manipulatio...

CVE-2025-48957

AstrBot has a documented path traversal vulnerability in versions 3.4.4–3.5.12 that can disclose sensitive data (e.g., LLM API keys and passwords) via the /api/chat/get_file endpoint. The issue is addressed in PR #1676 and included in v3.5.13. A temporary workaround is to disable the dashboard in...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

PT-2025-23440 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS versions up to 3.4.2 Description: A problematic vulnerability was found in the Profile Page component of juzaweb CMS, specifically in the /admin-cp/file-manager/upload file. The issue is related to the manipulation of the Upload...

PT-2025-23491 · Unknown · Ce Phoenix

Name of the Vulnerable Software and Affected Versions: CE Phoenix eCommerce platform versions 1.0.9.7 through 1.1.0.3 Description: The issue allows logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session...

PT-2025-23550 · Weblaudos · Weblaudos

Name of the Vulnerable Software and Affected Versions: WebLaudos version 24.2 04 Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information via the id parameter. This enables the attacker to access confidential data. Recommendations: For WebLaudos version 24...

PT-2025-23485 · Linksys · Linksys Re6300 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500 version 1.0.013.001 Linksys RE6250 version 1.0.013.001 Linksys RE6300 version 1.0.013.001 Linksys RE6350 version 1.0.013.001 Linksys RE7000 version 1.0.013.001 Linksys RE9000 version 1.0.013.001 Linksys RE6500 version 1.0.04.00...

PT-2025-23508 · Sslh +1 · Sslh +1

Name of the Vulnerable Software and Affected Versions: sslh versions prior to 2.2.4 Description: A Use of Out-of-range Pointer Offset issue in sslh leads to denial of service on some architectures. Recommendations: For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue...

PT-2025-23524 · Sitecom · Sitecom Wlx-2006

Name of the Vulnerable Software and Affected Versions: Sitecom WLX-2006 Wall Mount Range Extender N300 versions 1.5 and earlier Description: The issue concerns the use of default credentials in the Sitecom WLX-2006 Wall Mount Range Extender N300. This allows unauthorized access to the device. No...

PT-2025-23535 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.39 Description: The issue affects MyBB, free and open source forum software. It is caused by the upgrade component not validating user input properly, allowing attackers to perform local file inclusion LFI via a...

PT-2025-23559 · Unknown +1 · Kreatv Sdk +1

Name of the Vulnerable Software and Affected Versions: Arris VIP1113 devices with KreaTV SDK through 2025-05-30 Description: The issue allows file overwrite via TFTP because a remote filename with a space character enables an attacker to control the local filename. Recommendations: For Arris...

PT-2025-23463 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS versions up to 3.4.2 Description: A critical issue was found in the Plugins Page component, specifically affecting the /admin-cp/plugin/install file. This leads to improper access controls, allowing for remote attacks. The issue h...

PT-2025-23859 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.05 Description: A critical vulnerability was found in the fromadvsetlanip function of the /goform/AdvSetLanip file. The manipulation of the lanMask argument leads to a buffer overflow. The attack can be launched...

PT-2025-23470 · Roundcube · Roundcube

Name of the Vulnerable Software and Affected Versions: Roundcube versions prior to 1.6.11 Description: The issue is related to a Post-Auth RCE via PHP Object Deserialization in Roundcube. It is estimated that over 53 million hosts are potentially affected. The bug has existed undetected for 10...