PT-2025-18277 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A SQL injection issue was found in the /add-foreigners-ticket.php file. This allows remote attackers to execute arbitrary code via the cprice POST request parameter...

PT-2025-18298 · Focus · Focus

Name of the Vulnerable Software and Affected Versions: Focus versions prior to 138 Description: Websites could leverage the truncating behavior of long URLs in the location view to potentially trick users into thinking they were on a different webpage. Recommendations: For versions prior to 138,...

PT-2025-18319 · Xwiki · Xwiki Contrib'S Syntax Markdown

Name of the Vulnerable Software and Affected Versions: XWiki Contrib's Syntax Markdown versions 8.2 through 8.8 Description: The issue allows any user to embed Javascript code using Markdown syntax, which can be executed on the browser of other users visiting the document or comment containing it...

PT-2025-18242 · Delta Electronics · Ispsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics ISPSoft version 3.20 Description: The issue is a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when parsing a DVP file. This vulnerability is related to the parsing of DVP...

PT-2025-18316 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions 1.3.6 through 1.8.10 Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. The issue concerns an authorization bypass when certain Check...

Google Chrome Security Update (stable-channel-update-for-desktop_29-2025-04) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

PT-2025-18281 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A HTML Injection issue was discovered in the normal-search.php file, allowing remote attackers to execute arbitrary code via the searchdata parameter. This enables attackers...

Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

MSP360 Backup insecure filesystem permissions

RISK EVALUATION MSP360 Backup is a data backup and recovery solution. An insecure default permissions vulnerability allows a lower privileged user to execute commands with root level privileges in the 'Online Backup' folder. An attacker could exploit this vulnerability to obtain user...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to OpenSSL (CVE-2022-0778)

Summary OpenSSL is used by DataStage on Cloud Pak for Data as part of secure network communication. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificates. By using a specially-craft...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to server-side request forgery (CVE-2025-27907)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to server-side request forgery. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|---...

PT-2025-18133 · Snowflake · Libsnowflakeclient

Name of the Vulnerable Software and Affected Versions: libsnowflakeclient versions 0.5.0 through 2.2.0 Description: The issue concerns local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the targ...

PT-2025-18201 · Unknown · Code-Projects School Billing System

Name of the Vulnerable Software and Affected Versions: code-projects School Billing System version 1.0 Description: A critical vulnerability was found in the code-projects School Billing System. This issue affects the searchrec function. The manipulation of the Name argument leads to a stack-base...

PT-2025-18142 · Dnsdist +1 · Dnsdist +1

Name of the Vulnerable Software and Affected Versions: DNSdist versions prior to 1.9.9 Description: When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash...

PT-2025-18228 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue is related to a denial of service. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

PT-2025-18166 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file /admin/viewenquiry.php, leading to improper access controls. The manipulation can be initiated remotely...

PT-2025-18210 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: The issue allows a malicious user to create and download site backups without authentication. This could result in a malicious attacker making numerous requests to create archives and fill up the...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18209 · Auth0 · Auth0 Next.Js Sdk

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions 4.0.1 through 4.5.0 Description: The issue arises from the failure to invoke .setExpirationTime when generating a JWE token for the session in the Auth0 Next.js SDK. This results in the JWE not containing an interna...

PT-2025-18211

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.4 Description The issue allows an attacker to use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies enable the attacker to...