PT-2025-22929 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions 7.4.0 through 7.4.3 Description: A critical vulnerability has been found in the Lua Admin Console component of Wing FTP Server, allowing execution with unnecessary privileges. The attack can be launched remotely and h...

PT-2025-22927 · Unknown · Summer Pearl Group Vacation Rental Management Platform

Name of the Vulnerable Software and Affected Versions: Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1 Description: A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown functionality and leading to cross-site...

FunAudioLLM InspireMusic deserialization vulnerability

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function loadstatedict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. A...

PT-2025-22862

Name of the Vulnerable Software and Affected Versions docarray versions up to 0.40.1 Description A critical issue affects the getitem function of the /docarray/data/torch dataset.py file in the Web API component. This issue leads to improperly controlled modification of object prototype attribute...

PT-2025-22871 · H3C · H3C Seccenter Smp-E1114P02

Name of the Vulnerable Software and Affected Versions: H3C SecCenter SMP-E1114P02 up to 20250513 Description: A vulnerability was found in the function Download of the file /cfgFile/1/download. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely...

PT-2025-22881 · Fess · Fess

Name of the Vulnerable Software and Affected Versions: Fess versions prior to 14.19.2 Description: The issue primarily affects environments where Fess is deployed in a shared or multi-user context, potentially leading to information disclosure. This could allow unauthorized local users to access...

PT-2025-22859

Name of the Vulnerable Software and Affected Versions FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd Description A critical issue was found in the function load state dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. This issue leads to...

PT-2025-23512 · Linksys · Linksys Re6350 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001 Description: A critical issue affects the function RP checkCredentialsByBBS of the file /goform/RP checkCredentialsByBBS. The manipulation of t...

CVE-2025-5124

A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiat...

PT-2025-22845

Name of the Vulnerable Software and Affected Versions Tmall Demo up to 20250505 Description A critical issue was found in Tmall Demo, affecting the uploadProductImage function of the file tmall/admin/uploadProductImage. The manipulation of the File argument leads to unrestricted upload. This issu...

PT-2025-22828 · Unknown · Process Lock

Name of the Vulnerable Software and Affected Versions: process lock crate version 0.1.0 Description: The issue allows data races in unlock, which can lead to unpredictable behavior. Recommendations: For process lock crate version 0.1.0, consider avoiding the use of the unlock functionality until ...

PT-2025-22848 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall Demo up to 20250505 Description: A vulnerability has been found in the Search Box component of Tmall Demo, allowing for cross-site scripting through remote attack. The manipulation of an unknown function leads to this issue. The vendor...

PT-2025-22849 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall Demo up to 20250505 Description: A problematic vulnerability was found in the Buy Item Page component of Tmall Demo, allowing for cross-site scripting through the manipulation of the Detailed Address argument. This issue can be exploite...

PT-2025-22831

Name of the Vulnerable Software and Affected Versions memory pages crate version 0.1.0 Description The issue is related to division by zero in the memory pages crate for Rust. Recommendations For memory pages crate version 0.1.0, update to a version that fixes the division by zero issue. At the...

MAL-2025-4544 Malicious code in @mc-donate/donateweb (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9325722a4b74dc591b6e7655a9bd06db9dff5b54b68de22c24fd2b38d03743ae Any computer that has this package installed or running should be considered...

CVE-2025-21610

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy a malicious javascript: URL as a link that would execute arbitrary...

CVE-2025-23045

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run...

CVE-2025-0390

A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploi...

CVE-2024-52521

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 t...

CVE-2024-52008

Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API cal...