PT-2025-12668 · Kentico · Kentico Xperience

Name of the Vulnerable Software and Affected Versions: Kentico Xperience versions through 13.0.172 Description: An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication...

PT-2025-12704 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /help/systop.jsp. The manipulation of the langcode argument leads to cross-site scripting. It is possible to...

PT-2025-12559 · WordPress · The Slider

Name of the Vulnerable Software and Affected Versions: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin versions prior to 3.95.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html...

PT-2025-12708 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: onos version 2.7.0 Description: The issue is related to limited secret space in LLDP packets, which can be exploited by attackers to obtain the private key via a brute force attack. Attackers can leverage this to create crafted LLDP packets...

PT-2025-12688 · H3C · H3C Magic Be18000 +4

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical vulnerability...

PT-2025-12693 · H3C · H3C Magic Be18000 +4

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical vulnerability...

CVE-2025-27553 Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

PT-2025-12521 · Unknown · Phpgurukul Doctor Appointment Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Doctor Appointment Management System version 1.0 Description: A critical issue affects the processing of the file /doctor/appointment-bwdates-reports-details.php in PHPGurukul Doctor Appointment Management System. The manipulation ...

PT-2025-12504 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: JIZHICMS version 1.7.0 Description: A vulnerability has been found in JIZHICMS, affecting some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the jifen argument leads to improp...

[SECURITY] [DSA 5883-1] mercurial security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5883-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 22, 2025 https://www.debian.org/security/faq -...

PT-2025-12479 · WordPress · Export/Import Users/Customers

Name of the Vulnerable Software and Affected Versions: Export and Import Users and Customers plugin for WordPress versions prior to 2.6.3 Description: The issue is related to insufficient file path validation in the admin log page function, allowing authenticated attackers with Administrator-leve...

RHEL 8 / 9 : OpenShift Container Platform 4.14.49 (RHSA-2025:2712)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2712 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

PT-2025-12493 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical issue affects the processing of the file /staff/index.php. The manipulation of the argument e leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-29927 Authorization Bypass in Next.js Middleware

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to ...

PT-2025-12414 · Unknown +2 · Hercules Augeas +2

Name of the Vulnerable Software and Affected Versions: Hercules Augeas version 1.14.1 Description: A problematic issue has been found, affecting the re case expand function in the src/fa.c file. The manipulation of the re argument leads to a null pointer dereference. Local attacks are required to...

PT-2025-12420

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A critical vulnerability has been found in Open Asset Import Library Assimp. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. Th...

[SECURITY] [DSA 5882-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5882-1 [email protected] https://www.debian.org/security/ Andres Salomon March 20, 2025 https://www.debian.org/security/faq -...

CVE-2025-29980

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.7...

CVE-2025-2557

A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the component Command API. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has...

CVE-2025-29980

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.7...