PT-2025-20484 · Unknown · Imithemes Listing

Name of the Vulnerable Software and Affected Versions: IMITHEMES Listing plugin versions up to, and including, 3.3 Description: The issue is related to privilege escalation via account takeover. This is due to the plugin not properly validating a verification code value prior to updating a user's...

PT-2025-24424 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior Description: The issue is related to authenticated SQL injection in the alerts module. Recommendations: For versions 8510 and prior, consider disabling the alerts module until a patch...

PT-2025-20475 · Sparx Systems · Sparx Systems Pro Cloud Server

Name of the Vulnerable Software and Affected Versions: Sparx Systems Pro Cloud Server versions earlier than 6.0.165 Description: The issue is caused by an Improper Limitation of a Pathname, leading to a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present ...

PT-2025-20459 · Unknown · Project Worlds Car Rental Project

Name of the Vulnerable Software and Affected Versions: Project Worlds Car Rental Project version 1.0 Description: A critical vulnerability has been found in the Project Worlds Car Rental Project. The issue affects an unknown function of the file /signup.php. The manipulation of the fname argument...

PT-2025-20551

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2 Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string...

PT-2025-20477

Name of the Vulnerable Software and Affected Versions Gym Management System version 1.0 Description A critical issue was found in the Gym Management System. The problem affects an unknown function of the file "/ajax.php?action=save package". The manipulation of the ID argument leads to SQL...

PT-2025-20486 · WordPress · Frontend Login/Registration Blocks

Name of the Vulnerable Software and Affected Versions: Frontend Login and Registration Blocks plugin for WordPress versions 1.0.0 through 1.0.7 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's identi...

PT-2025-20548

Name of the Vulnerable Software and Affected Versions Apache Commons Configuration versions 1.x Description The issue is related to Uncontrolled Resource Consumption in Apache Commons Configuration 1.x, which can lead to excessive resource consumption when loading untrusted configurations or usin...

PT-2025-20603 · Retool · Retool

Name of the Vulnerable Software and Affected Versions: Retool self-hosted versions prior to 3.196.0 Description: The issue allows for Host header injection when the BASE DOMAIN environment variable is not set, enabling manipulation of the HTTP host header. Recommendations: For versions prior to...

PT-2025-20487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, related to the SMB client. The issue arises from an imbalance in the netns reference count, leading to potential leaks and...

PT-2025-20601

Name of the Vulnerable Software and Affected Versions JAdmin-JAVA JAdmin version 1.0 Description A critical vulnerability was found in the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to...

PT-2025-20547 · Unknown · Code-Projects Departmental Store Management System

Name of the Vulnerable Software and Affected Versions: code-projects Departmental Store Management System version 1.0 Description: A critical issue was found in the function bill. The manipulation of the Item Code argument leads to a stack-based buffer overflow. This issue can be exploited locall...

PT-2025-22456 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior Description: The issue concerns an authenticated SQL injection in the logon events aggregate report. Recommendations: For Zohocorp ManageEngine ADAudit Plus versions 8510 and prior,...

Debian dla-4158 : fossil - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4158 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4158-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DLA 4156-1] openssh security update

Debian LTS Advisory DLA-4156-1 [email protected] https://www.debian.org/lts/security/ Colin Watson May 08, 2025 https://wiki.debian.org/LTS Package : openssh Version : 1:8.4p1-5+deb11u5 CVE ID : CVE-2025-32728 Debian Bug : 1102603...

PT-2025-20396 · Alfa · Alfa Aip-W512

Name of the Vulnerable Software and Affected Versions: ALFA AIP-W512 version 3.2.2.2.3 Description: The issue is related to an authenticated stack overflow that can be triggered via the targetAPMac parameter in the formWsc function. Recommendations: For ALFA AIP-W512 version 3.2.2.2.3, consider...

PT-2025-20420 · Totolink · Totolink A950Rg

Name of the Vulnerable Software and Affected Versions: TOTOlink A950RG version 4.1.2cu.5204 B20210112 Description: The issue arises from improper input validation of the NoticeUrl parameter in the setNoticeCfg interface of the /lib/cste modules/system.so module. This leads to a buffer overflow...

PT-2025-20423 · Unknown · Grocery-Cms-Php-Restful-Api

Name of the Vulnerable Software and Affected Versions: Grocery-CMS-PHP-Restful-API version 1.3 Description: The issue concerns a file upload vulnerability via the "/admin/add-category.php" API endpoint. This allows for potential malicious file uploads. Recommendations: For...

PT-2025-20388 · Phpjabbers · Phpjabbers Event Booking Calendar

Name of the Vulnerable Software and Affected Versions: PHPJabbers Event Booking Calendar version 4.0 Description: The issue concerns multiple HTML injection vulnerabilities in the name, plugin sms api key, plugin sms country code, and title parameters. This allows for potential malicious code...

PT-2025-20398

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.0 Description The issue concerns the Rack::Session::Pool middleware, where simultaneous requests can restore a deleted session, allowing an unauthenticated user to occupy that session. If an attacker ca...