Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

PT-2025-53419

Name of the Vulnerable Software and Affected Versions UTT 进取 512W versions prior to 1.7.7-171114 Description A flaw exists in UTT 进取 512W. The strcpy function within the /goform/formPictureUrl file is susceptible to a buffer overflow when handling the importpictureurl argument. This allows for...

PT-2025-53100

Name of the Vulnerable Software and Affected Versions thembay Fana versions through 1.1.35 Description An improper control of filename for include/require statement exists in thembay Fana, potentially allowing PHP Local File Inclusion. The issue is related to PHP Remote File Inclusion...

PT-2025-53294

Name of the Vulnerable Software and Affected Versions Specto CM versions prior to 17032025 Description Specto CM contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be injected into...

PT-2025-53250

Name of the Vulnerable Software and Affected Versions WP Swings Membership For WooCommerce versions through 3.0.3 Description An authorization bypass exists due to incorrectly configured access control security levels. This allows bypassing authorization through a user-controlled key. The issue...

PT-2025-53289

Name of the Vulnerable Software and Affected Versions Rustaurius Five Star Restaurant Reservations versions through 2.7.7 Description A Cross-Site Request Forgery CSRF issue exists in Rustaurius Five Star Restaurant Reservations restaurant-reservations, potentially allowing attackers to perform...

PT-2025-52746

Name of the Vulnerable Software and Affected Versions Thembay Diza versions through 1.3.15 Description An improper control of filename for include/require statement exists in Thembay Diza, leading to a PHP Local File Inclusion issue. This allows for the inclusion of local files, potentially leadi...

PT-2025-52750

Name of the Vulnerable Software and Affected Versions Hotech Software Inc. Otello versions 2.4.0 through 2.4.3 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting XSS condition. This allows for the...

PT-2025-52734

Name of the Vulnerable Software and Affected Versions WordPress Calendar plugin versions prior to 1.3.17 Description The Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the event desc parameter...

PT-2025-52677

Name of the Vulnerable Software and Affected Versions MyNET versions up to 26.08 Description The software contains a Reflected cross-site scripting XSS issue. The vulnerability is located in the msgtipo parameter. A successful exploit could allow an attacker to inject malicious scripts into a web...

Debian dla-4418 : python3-mechanize - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4418 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4418-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-52674

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 16.3.3 Description An arbitrary file upload issue exists in Umbraco CMS version 16.3.3. Attackers can potentially execute arbitrary code by uploading a specially crafted PDF file. The supplier disputes responsibility, stati...

PT-2025-52568

Name of the Vulnerable Software and Affected Versions HappyFiles Pro versions through 1.8.1 Description An authorization issue exists in HappyFiles Pro, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized access. Recommendations Update...

PT-2025-52546

Name of the Vulnerable Software and Affected Versions Pure WC Variation Swatches WordPress plugin versions through 1.1.7 Description The Pure WC Variation Swatches WordPress plugin does not perform authorization checks when updating its settings. This allows any authenticated user to modify these...

CVE-2025-14759

The CVE-2025-14759 issue affects the Amazon S3 Encryption Client for .NET. When the encrypted data key (EDK) is stored in an Instruction File instead of S3 metadata, missing cryptographic key commitment could allow a user with write access to the bucket to introduce a rogue EDK and decrypt to a d...

Improper Verification of Cryptographic Signature

Overview altcha is a The ALTCHA Python Library is a lightweight, zero-dependency library designed for creating and verifying ALTCHA challenges, specifically tailored for Python applications. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via t...

CVE-2025-14503

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-14503

CVE-2025-14503 affects Harmonix on AWS (Harmonix on AWS framework). The issue is an overly-permissive IAM trust policy in the EKS environment provisioning role that trusts the account root principal, potentially enabling any IAM principal within the same AWS account to call sts:AssumeRole and obt...

EUVD-2025-203445

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any account principal with...

PT-2025-51281

Name of the Vulnerable Software and Affected Versions Harmonix on AWS versions 0.3.0 through 0.4.1 Description An overly-permissive IAM trust policy within the Harmonix on AWS framework could allow IAM principals within the same AWS account to escalate privileges through role assumption. The EKS...