PT-2025-23407 · Unknown · Yifang Cms

Name of the Vulnerable Software and Affected Versions: Yifang CMS versions up to 2.0.2 Description: A vulnerability was found in the Article Management Module of Yifang CMS, where the manipulation of the Default Value argument leads to cross-site scripting. The attack may be launched remotely. Th...

PT-2025-23415 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS up to 20250504 Description: A critical issue was found in the File Handler component, specifically affecting the filedeal function of the /systemController/filedeal.do file. This leads to improper access controls, allowing remote...

Trust Boundary Violation

Overview Affected versions of this package are vulnerable to Trust Boundary Violation due to the Browse method using URLs provided through API responses from authenticated GitHub hosts when users execute gh commands. An attacker in control of a malicious GitHub server can execute arbitrary comman...

CVE-2024-47056

SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2025-27789)

Summary IBM Security SOAR uses an older version of the babel runtime javascript module that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.6.0 Vulnerability Details CVEID:CVE-2025-27789...

CVE-2025-27522

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it. 1...

CVE-2020-36846

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a scrip...

PT-2025-23240 · Cvat · Cvat

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions 2.4.0 through 2.37.x Description: The issue allows an authenticated user to retrieve sensitive information, including IDs and names of tasks, projects, labels, and IDs of jobs and quality reports,...

PT-2025-23297 · Unknown · 3Dexperience +1

Name of the Vulnerable Software and Affected Versions: City Referential Manager on Release 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS vulnerability in City Referential Manager allows an attacker to execute arbitrary script code in a user's browser session. This enables the...

PT-2025-23270

Name of the Vulnerable Software and Affected Versions: Airpointer version 2.4.107-2 Description: The issue concerns default credentials being present in the web portal, allowing an unauthenticated malicious actor to log in via the web portal. Recommendations: For Airpointer version 2.4.107-2,...

PT-2025-23305 · Unknown · Service Process Engineer

Name of the Vulnerable Software and Affected Versions: Service Process Engineer versions 3DEXPERIENCE R2024x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS issue affects Service Items Management in Service Process Engineer, allowing an attacker to execute arbitrary...

PT-2025-23233 · Unknown · Tinxy Wifi Lock Controller

Name of the Vulnerable Software and Affected Versions: Tinxy WiFi Lock Controller version v1 RF Description: The issue concerns the transmission of sensitive information in plaintext, including control information and device credentials. This allows attackers to possibly intercept and access...

PT-2025-23271 · Unknown · Airpointer

Name of the Vulnerable Software and Affected Versions: airpointer version 2.4.107-2 Description: The web portal on airpointer presented a local file inclusion issue. A malicious user with administrative privileges in the web portal could manipulate requests to view files on the filesystem...

PT-2025-23295 · Dassault Systèmes · 3Dexperience

Name of the Vulnerable Software and Affected Versions: Collaborative Industry Innovator versions 3DEXPERIENCE R2023x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS vulnerability in the Compare feature allows an attacker to execute arbitrary script code in a user's...

PT-2025-23301 · Dsm · Multidisciplinary Optimization Engineer

Name of the Vulnerable Software and Affected Versions: Multidisciplinary Optimization Engineer versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x Description: A stored Cross-site Scripting XSS vulnerability affects Results Analytics in Multidisciplinary Optimization Engineer, allowing an...

PT-2025-23298

Name of the Vulnerable Software and Affected Versions City Referential Manager versions 3DEXPERIENCE R2025x Description A stored Cross-site Scripting XSS issue affects City Discover within City Referential Manager. Exploitation allows an attacker to execute arbitrary script code within a user's...

PT-2025-23254 · WordPress · Gearside Developer Dashboard

Name of the Vulnerable Software and Affected Versions: Gearside Developer Dashboard WordPress plugin versions 1.0.72 and earlier Description: The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

PT-2025-23318 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue was found in the BYE Command Handler component, which can be exploited remotely. The manipulation leads to a buffer overflow. The issue has been publicly disclosed. Recommendation...

PT-2025-23296 · Unknown · Vanquish Woocommerce Orders & Customers Exporter

Name of the Vulnerable Software and Affected Versions: Vanquish WooCommerce Orders & Customers Exporter versions n/a through 5.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions n/a...

PT-2025-23278 · WordPress · Opensheetmusicdisplay

Name of the Vulnerable Software and Affected Versions: OpenSheetMusicDisplay plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the className parameter. This allo...