PT-2025-7581 · Itsourcecode · Itsourcecode Simple Chatbox

Name of the Vulnerable Software and Affected Versions: ITSourcecode Simple ChatBox versions up to 1.0 Description: A vulnerability was found in ITSourcecode Simple ChatBox, affecting unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data. Recommendations: For...

PT-2025-7615

Name of the Vulnerable Software and Affected Versions Exim versions 4.98 through 4.98.0 Description The issue allows remote SQL injection when SQLite hints and ETRN serialization are used. This could potentially allow a remote attacker to perform SQL injection, possibly stealing sensitive data or...

PT-2025-7471

Name of the Vulnerable Software and Affected Versions Abseil-cpp versions prior to commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 Description A heap buffer overflow issue exists due to the lack of an upper bound on size arguments in the sized constructors, reserve, and rehash methods of...

PT-2025-7470

Name of the Vulnerable Software and Affected Versions Eclipse ThreadX NetX Duo versions prior to 6.4.2 Description The issue allows an attacker to cause an integer underflow and a subsequent denial of service by writing a very large file or by sending specially crafted packets with Content-Length...

PT-2025-16808 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: The issue allows an unauthenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with "NT...

CVE-2025-25299

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting XSS vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within...

CVE-2025-25300

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile third parties to abuse window.opener, e.g. by redirection or injection on the...

DMARC for PCI DSS 4.0: A Good Practice for Securing Emails

PCI DSS 4.0 encourages the implementation of anti-phishing controls like DMARC! This highlights and reinforces the importance of preventative measures against email fraud, domain spoofing, and phishing in the financial space. While not a mandate or a requirement for PCI DSS compliance, DMARC and...

BIT-DISCOURSE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

PT-2025-26483

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions 7.0.0 through 10.0.0 Description: The issue allows a specially crafted request or proxy to bypass the design of DNN Login IP Filters, enabling login attempts from IP addresses not in the allow list. This has...

PT-2025-7442 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.2.2 Description: The issue allows unauthenticated users to access multiple pages that display the usernames and email addresses of all current users. This is an Information Disclosure vulnerability. Recommendations: F...

Debian dla-4059 : libmosquitto-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4059 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4059-1 [email protected]...

PT-2025-9191 · Tenda · Tenda Ac7 1200M

Name of the Vulnerable Software and Affected Versions: Tenda AC7 1200M version 15.03.06.44 Description: A critical vulnerability was found in the TendaTelnet function of the file /goform/telnet. The manipulation of the lan ip argument leads to os command injection. It is possible to launch the...

PT-2025-7626

Name of the Vulnerable Software and Affected Versions OpenH264 versions 2.5.0 and earlier Description OpenH264 contains a heap overflow vulnerability in its decoding functions. This issue is due to a race condition occurring between a Sequence Parameter Set SPS memory allocation and a subsequent...

PT-2025-7292 · Phpjabbers · Phpjabbers Car Park Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Car Park Booking System version 3.0 Description: A lack of rate limiting in the 'Email Settings' feature allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service DoS via a...

RHEL 8 / 9 : OpenShift Container Platform 4.14.48 (RHSA-2025:1453)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1453 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

CVE-2025-27090

CVE-2025-27090 pertains to Sliver, an open-source adversary emulation framework. The issue is in the reverse port forwarding feature of the Sliver teamserver: the implant can open a reverse tunnel without verifying operator intent. The documented impact is the exposure of the server’s IP address ...

GHSA-G4V5-6F5P-M38J OpenFGA Authorization Bypass

Overview OpenFGA v1.8.4 or previous Helm chart openfga-0.2.22, docker v.1.8.5 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Am I Affected? If you are using OpenFGA v1.8.4 or previous, specifically under the following conditions, you are affected by...

CVE-2025-25196 OpenFGA Authorization Bypass

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.4 Helm chart openfga-0.2.22, docker v.1.8.4 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA...

PT-2025-7516

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.2.0 through 4.2.10 Wireshark versions 4.4.0 through 4.4.3 Description The issue allows denial of service via packet injection or crafted capture file, specifically affecting the Bundle Protocol and CBOR dissector in...