PT-2025-28012

Name of the Vulnerable Software and Affected Versions: MbedTLS versions 3.3.0 through 3.6.3 Description: The issue allows an attacker to bypass LMS signature verification by reusing stale stack data, resulting in the acceptance of an invalid signature. This occurs when unchecked return values in...

PT-2025-27437 · Unknown · Code-Projects Car Rental System

Name of the Vulnerable Software and Affected Versions: code-projects Car Rental System version 1.0 Description: A critical issue affects an unknown functionality of the file /admin/add cars.php. The manipulation of the car name argument leads to SQL injection. The attack can be launched remotely...

PT-2025-30052 · Unknown · Mcp-Package-Docs

Name of the Vulnerable Software and Affected Versions: mcp-package-docs versions prior to 0.1.28 node-code-sandbox-mcp versions prior to 0.1.28 mcp-server-kubernetes versions prior to 0.1.28 git-mcp-server versions prior to 0.1.28 Description: A command injection vulnerability exists in multiple...

EulerOS 2.0 SP13 : abseil-cpp (EulerOS-SA-2025-1698)

According to the versions of the abseil-cpp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve, and rehash methods of absl::flat,nodehashset,map...

PT-2025-28069 · Shenzhen Libituo Technology Co. · Lbt-T300-T310

Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology LBT-T300-T310 versions up to 2.2.3.6 Description: A critical vulnerability has been found in the affected software. This issue affects the config 3g para function of the file /appy.cgi. The manipulation of the...

PT-2025-27346 · WordPress · Db Backup +1

Name of the Vulnerable Software and Affected Versions: EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress versions up to, and including, 5.25.11 Description: The issue is related to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode due to insufficient input...

PT-2025-27398 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07.21 Description: A critical issue affects some unknown functionality of the file /pppoe base.asp of the component jhttpd. The manipulation of the mschap en argument leads to a buffer overflow. This issue can be...

PT-2025-27359

Name of the Vulnerable Software and Affected Versions: ESAPI esapi-java-legacy versions prior to 2.7.0.0 Description: A vulnerability was found in the interface Encoder.encodeForSQL of the SQL Injection Defense, leading to an improper neutralization of special elements. The attack may be initiate...

PT-2025-27347 · Unknown · Code-Projects Simple Forum

Name of the Vulnerable Software and Affected Versions: code-projects Simple Forum version 1.0 Description: A critical issue affects some unknown functionality of the file "/register1.php". The manipulation of the User argument leads to SQL injection. The attack may be launched remotely...

PT-2025-27349 · Code Projects · Code-Projects Simple Forum

Name of the Vulnerable Software and Affected Versions: code-projects Simple Forum version 1.0 Description: A critical issue was found in the code, affecting the /forum edit.php file. The manipulation of the iii argument leads to SQL injection. This issue can be exploited remotely. Recommendations...

PT-2025-27365 · Unknown · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /panel/pro sale.php. The manipulation of the fromdate and todate arguments leads to SQL injection...

Apache Seata Vulnerable to Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. The Apache...

CVE-2025-32897

CVE-2025-32897 describes a deserialization of untrusted data vulnerability in Apache Seata (incubating) affecting versions 2.0.0 up to but not including 2.3.0. The underlying issue is unsafe deserialization of serialized user data, enabling potential code execution. The CVSS v3.1 base score is 9....

CVE-2025-32897 Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. Severity...

PT-2025-27547 · Intelbras · Intelbras Rx1500 Router

Name of the Vulnerable Software and Affected Versions: Intelbras RX1500 Router versions prior to 2.2.17 Description: The vulnerability resides in the FirmwareUpload and GetFirmwareValidation functions due to improper access control. Exploitation may allow a remote attacker to gain unauthorized...

PT-2025-28160 · Unknown · Sourcecodester Employee Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Employee Management System version 1.0 Description: A critical issue was found in the itsourcecode Employee Management System. The issue affects an unknown functionality of the file /admin/editempeducation.php. The manipulation o...

PT-2025-27288 · WordPress · Pt Project Notebooks

Name of the Vulnerable Software and Affected Versions: PT Project Notebooks plugin for WordPress versions 1.0.0 through 1.1.3 Description: The issue is related to missing authorization in the wpnb pto new users add function, which allows unauthenticated attackers to elevate their privileges to th...

PT-2025-27285 · WordPress · Beeteam368 Extensions Pro

Name of the Vulnerable Software and Affected Versions: BeeTeam368 Extensions Pro plugin for WordPress versions up to, and including, 2.3.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform actions on files outside of the originally intended...

PT-2025-27326 · Totolink · Totolink A702R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A702R versions up to 4.0.0-B20230721.1521 Description: A critical vulnerability was found in the HTTP POST Request Handler component of TOTOLINK A702R, affecting an unknown functionality of the file /boafrm/formWlSiteSurvey. The...

PT-2025-27296 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts affected versions not specified Description: The issue concerns a deserialization vulnerability. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...