PT-2025-18197 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: The issue allows an attacker to use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies enable the attacker ...

PT-2025-18204 · Unknown · Phpgurukul Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Nurse Hiring System version 1.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /admin/view-request.php. The manipulation of the viewid argument leads to SQL injection. This...

PT-2025-18196

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.4 Description The issue is related to reflected XSS in the file upload form, allowing malicious unauthenticated users to create links that can perform arbitrary actions when clicked by a victim. Recommendations Fo...

PT-2025-18180 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: A stored cross-site scripting XSS issue was found in the comments feature of YesWiki, a wiki system written in PHP. This issue allows a malicious actor to inject JavaScript payloads that are stored...

PT-2025-18203

Name of the Vulnerable Software and Affected Versions ShowDoc versions prior to 2.8.7 Description An unrestricted file upload issue caused by improper validation of file extensions allows unauthenticated attackers to upload arbitrary PHP files, such as web shells, leading to remote code execution...

CVE-2025-31651 Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

CVE-2025-31651 Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

[SECURITY] [DLA 4141-1] poppler security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4141-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk April 28, 2025 https://wiki.debian.org/LTS -...

CVE-2025-2851

A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mang...

CVE-2025-4011

A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to...

CVE-2025-4003

CVE-2025-4003 affects RefindPlus 0.14.2.AB. The vulnerability is in InternalApfsTranslateBlock of RP_ApfsIo.c and causes a null pointer dereference, enabling an attack on the local host. A patch named 4d35125ca689a255647e9033dd60c257d26df7cb exists and should be applied to remediate. Some sources...

CVE-2025-4001 scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption

A vulnerability has been found in scipopt scip up to 9.2.1 and classified as problematic. Affected by this vulnerability is the function main of the file examples/LOP/src/genRandomLOPInstance.c of the component File Descriptor Handler. The manipulation of the argument File leads to uncontrolled...

PT-2025-18084 · Devexpress · Devexpress

Name of the Vulnerable Software and Affected Versions: DevExpress versions prior to 23.1.3 Description: The issue is related to the improper protection of XtraReport serialized data in ASP.NET web forms. This affects the security of the data, potentially allowing unauthorized access or...

PT-2025-18111 · Unknown · Phpgurukul Online Banquet Booking System

Name of the Vulnerable Software and Affected Versions: phpgurukul Online Banquet Booking System version 1.2 Description: The issue allows an attacker to execute arbitrary code via the "/obbs/change-password.php" file of the My Account - Change Password component. This could potentially lead to...

PT-2025-18106 · Gfi · Gfi Mailessentials

Name of the Vulnerable Software and Affected Versions: GFI MailEssentials versions prior to 21.8 Description: The issue is related to an XML External Entity XXE problem. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files. Recommendations: For versio...

PT-2025-18120 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: snowflake-connector-net versions 2.1.2 through 4.4.0 Description: The issue concerns a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the connector reads logging configuration from ...

PT-2025-18040 · Unknown · Refindplus

Name of the Vulnerable Software and Affected Versions: RefindPlus versions 0.14.2.AB Description: A vulnerability was found in RefindPlus, classified as problematic. The issue affects the GetDebugLogFile function of the file Library/MemLogLib/BootLog.c, leading to a null pointer dereference. Loca...

PT-2025-18070 · Unknown · Web-Arena-X

Name of the Vulnerable Software and Affected Versions: web-arena-x webarena version 0.2.0 Description: A critical vulnerability was found in the web-arena-x webarena software. This issue affects the HTMLContentEvaluator function of the file webarena/evaluation harness/evaluators.py. The...

PT-2025-18107 · Gfi · Gfi Mailessentials

Name of the Vulnerable Software and Affected Versions: GFI MailEssentials versions prior to 21.8 Description: The issue is related to a .NET deserialization problem. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET data when joining a Multi-Server...

PT-2025-18090 · Devexpress · Devexpress

Name of the Vulnerable Software and Affected Versions: DevExpress versions prior to 23.1.3 Description: The issue allows for Server-Side Request Forgery SSRF via AsyncDownloader. Recommendations: For versions prior to 23.1.3, update to version 23.1.3 or later to resolve the issue...