PT-2025-29576 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.38 10.3.30 Description: A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the usb folder parameter. Recommendations: Update to a...

PT-2025-29565 · Nexxt Solutions · Nexxt Solutions Ncm-X1800 Mesh Router

Name of the Vulnerable Software and Affected Versions: Nexxt Solutions NCM-X1800 Mesh Router firmware versions prior to UV1.2.7 Description: Nexxt Solutions NCM-X1800 Mesh Router firmware contains an authenticated command injection issue in the firmware update feature. The /web/um fileName set.cg...

CVE-2025-53640

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-7464

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

PT-2025-29441 · Phpgurukul · Phpgurukul Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Dairy Farm Shop Management System version 1.3 Description: A critical issue exists in PHPGurukul Dairy Farm Shop Management System 1.3. The productname argument within the edit-product.php file is susceptible to SQL injection. This...

PT-2025-29435 · Phpgurukul · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue exists in PHPGurukul Online Fire Reporting System 1.2. An unknown function within the /admin/manage-site.php file is susceptible to SQL injection. Manipulation ...

PT-2025-29498 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection issue via the ID parameter at the SEMCMS InquiryView.php file. Recommendations: Address the SQL injection issue by sanitizing or validating the ID parameter within th...

PT-2025-29501

Name of the Vulnerable Software and Affected Versions: Tenda CP3 Pro firmware version 22.5.4.93 Description: The Tenda CP3 Pro firmware contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack...

PT-2025-29399 · Unknown · Sapido Rb-1802

Name of the Vulnerable Software and Affected Versions: Sapido RB-1802 version 1.0.32 Description: A cross-site scripting issue exists in the URL Filtering Page component, specifically within the urlfilter.asp file. The manipulation of the URL address argument can lead to exploitation. The exploit...

PT-2025-29466 · Unknown · Simple Php Shopping Cart

Name of the Vulnerable Software and Affected Versions: Simple Shopping Cart version 1.0 Description: A critical issue exists in the processing of the /Customers/save order.php file. Manipulation of the order price argument can lead to SQL injection. This issue may be exploited remotely, and detai...

PT-2025-29520 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.24.3 Description: Dokploy is a free, self-hostable Platform as a Service PaaS. A vulnerability in the preview deployment feature allows any user to execute arbitrary code and access sensitive environment variables ...

PT-2025-29526 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.9 Description: Directus is a real-time API and App dashboard for managing SQL database content. When using Directus Flows to handle CRUD events for users, the "Log to Console" operation with a template...

PT-2025-29446 · Apache +1 · Apache Jackrabbit +1

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 2.23.2 Description: The software contains Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core due to the use of an unsecured document build to load privileges. Recommendations: Upgrade t...

PT-2025-29521 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido versions prior to 0.49.0 Description: Caido is a web security auditing toolkit. A reflected cross-site scripting XSS issue exists in Caido’s toast UI component. Toast messages may reflect unsanitized user input in tools like Match&Repla...

PT-2025-29491 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: Mccms version 2.7.0 Description: An authenticated arbitrary file download issue exists in the /admin/Backups.php component. Attackers can download arbitrary files by sending a crafted GET request. Recommendations: Apply a fix for Mccms versio...

PT-2025-29436

Name of the Vulnerable Software and Affected Versions: Avid NEXIS E-series versions prior to 2025.5.1 Avid NEXIS F-series versions prior to 2025.5.1 Avid NEXIS PRO+ versions prior to 2025.5.1 System Director Appliance SDA+ versions prior to 2025.5.1 Description: The application is susceptible to ...

PT-2025-29517 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A Reflected Cross-Site Scripting XSS vulnerability exists in the relatorio geracao.php endpoint. Attackers can inject malicious scripts through the tipo relatorio...

PT-2025-29506

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.1.2-0 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 experience infinite lines during a specific XMP file conversion comman...