PT-2025-28269 · Unknown · Campcodes Advanced Online Voting System

Name of the Vulnerable Software and Affected Versions: Campcodes Advanced Online Voting System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /admin/candidates delete.php. The manipulation of the ID argument leads to SQL injection. This issue...

PT-2025-28204 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS comman...

PT-2025-28185 · Twilio +1 · Twilio Api +1

Name of the Vulnerable Software and Affected Versions: Paxton10 versions prior to 4.6 SR6 Description: A vulnerability has been discovered in the firmware of Paxton10, where the firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy ...

PT-2025-30226 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.06.50 Description: A critical vulnerability exists in Tenda AC6 due to a buffer overflow in the setparentcontrolinfo function of the httpd component. The issue is exploitable remotely. Recommendations: Update Tenda AC6...

PT-2025-28212

Name of the Vulnerable Software and Affected Versions: LuaJIT versions prior to 2.1 Description: The issue is an out-of-bounds read in the stack-overflow handler in lj state.c. Recommendations: For versions prior to 2.1, update to a version that contains a fix for this issue...

PT-2025-28098 · Curl +1 · Curl +1

Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20 Description: A critical issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl, leading to server-side request forgery. The attack may be initiated remotely...

PT-2025-28146 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file, where manipulation of the Username argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-28125 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A vulnerability has been found in the component Course Module, affecting the file /intranet/educar curso det.php?cod curso=ID. The manipulation of the Curso argument leads to cross-site scripting...

PT-2025-28148

Name of the Vulnerable Software and Affected Versions: llama index versions up to v0.12.22.post1 Description: A vulnerability in the ArxivReader class allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but...

PT-2025-28129 · Unknown · Nimesa Backup/Recovery

Name of the Vulnerable Software and Affected Versions: Nimesa Backup and Recovery affected versions not specified Description: A server-side request forgery SSRF issue exists, which may allow unintended requests to be sent to internal servers if exploited. Recommendations: At the moment, there is...

PT-2025-28124 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic vulnerability was found in the School Module component, specifically affecting the /intranet/educar escola lst.php file. The manipulation of the Escola argument leads to cross-site...

PT-2025-28217 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.1 Description: A Time-Based Blind SQL Injection issue was discovered in the almox parameter of the "/controle/relatorio geracao.php" endpoint. This allows an attacker to inject arbitrary SQL queries, potentially...

PT-2025-28241 · Robocode +1 · Robocode +1

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.22.6 Description: Roo Code is an AI-powered autonomous coding agent. If the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and...

PT-2025-28221 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.3.0 Description: The WeGIA server has a vulnerability that allows excessively long HTTP GET requests to a specific URL, resulting from the lack of validation for the length of the fid parameter. This issue can cause...

PT-2025-28198 · Samsung · Exynos 2400 +1

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor and Modem Exynos 2400 Samsung Mobile Processor and Modem Modem 5400 Description: An issue was discovered in L2, where the lack of a length check leads to a Denial of Service via a malformed PDCP packet. Recommendation...

PT-2025-28175 · Jobcenter · Jobcenter

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header...

Exploit for CVE-2025-4403

CVE-2025-4403 : Unauthenticated Arbitrary File Upload Vulnerab...

CVE-2025-27446

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

CVE-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

PT-2025-28065 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIXjava-plugin-runner versions 0.2.0 through 0.5.0 Description: The issue is related to incorrect permission assignment for critical resources in the Apache APISIX java-plugin-runner, allowing a local attacker to elevate privileges...