PT-2025-18277 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A SQL injection issue was found in the /add-foreigners-ticket.php file. This allows remote attackers to execute arbitrary code via the cprice POST request parameter...

PT-2025-18316 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions 1.3.6 through 1.8.10 Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. The issue concerns an authorization bypass when certain Check...

PT-2025-18319 · Xwiki · Xwiki Contrib'S Syntax Markdown

Name of the Vulnerable Software and Affected Versions: XWiki Contrib's Syntax Markdown versions 8.2 through 8.8 Description: The issue allows any user to embed Javascript code using Markdown syntax, which can be executed on the browser of other users visiting the document or comment containing it...

PT-2025-18278 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A SQL Injection issue was discovered in the normal-bwdates-reports-details.php file. This issue allows remote attackers to execute arbitrary SQL code via the todate paramete...

Google Chrome Security Update (stable-channel-update-for-desktop_29-2025-04) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

MSP360 Backup insecure filesystem permissions

RISK EVALUATION MSP360 Backup is a data backup and recovery solution. An insecure default permissions vulnerability allows a lower privileged user to execute commands with root level privileges in the 'Online Backup' folder. An attacker could exploit this vulnerability to obtain user...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to OpenSSL (CVE-2022-0778)

Summary OpenSSL is used by DataStage on Cloud Pak for Data as part of secure network communication. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificates. By using a specially-craft...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to server-side request forgery (CVE-2025-27907)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to server-side request forgery. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|---...

PT-2025-18133 · Snowflake · Libsnowflakeclient

Name of the Vulnerable Software and Affected Versions: libsnowflakeclient versions 0.5.0 through 2.2.0 Description: The issue concerns local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the targ...

PT-2025-18166 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file /admin/viewenquiry.php, leading to improper access controls. The manipulation can be initiated remotely...

PT-2025-18210 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: The issue allows a malicious user to create and download site backups without authentication. This could result in a malicious attacker making numerous requests to create archives and fill up the...

PT-2025-18142 · Dnsdist +1 · Dnsdist +1

Name of the Vulnerable Software and Affected Versions: DNSdist versions prior to 1.9.9 Description: When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash...

PT-2025-18201 · Unknown · Code-Projects School Billing System

Name of the Vulnerable Software and Affected Versions: code-projects School Billing System version 1.0 Description: A critical vulnerability was found in the code-projects School Billing System. This issue affects the searchrec function. The manipulation of the Name argument leads to a stack-base...

PT-2025-18228 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue is related to a denial of service. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

PT-2025-22645

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions prior to 3.8.4-2.1 Description A UNIX Symbolic Link Symlink Following issue in cyrus-imapd allows escalation from cyrus to root. This issue affects openSUSE Tumbleweed. Recommendations For versions prior to 3.8.4-2.1, upda...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18211

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.4 Description The issue allows an attacker to use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies enable the attacker to...

PT-2025-18209 · Auth0 · Auth0 Next.Js Sdk

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions 4.0.1 through 4.5.0 Description: The issue arises from the failure to invoke .setExpirationTime when generating a JWE token for the session in the Auth0 Next.js SDK. This results in the JWE not containing an interna...

PT-2025-18164 · Unknown · Theater Seat Booking System

Name of the Vulnerable Software and Affected Versions: Theater Seat Booking System version 1.0 Description: A critical issue has been found in the Theater Seat Booking System, affecting the cancel function. The manipulation of the cancelcustomername argument leads to a stack-based buffer overflow...