CVE-2024-52509

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients...

CVE-2024-47123

The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and update to the current...

CVE-2024-32034

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admi...

CVE-2024-31453

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability...

CVE-2024-26018

Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a...

CVE-2023-32744

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Product Recommendations plugin = 2.3.0 versions...

CVE-2023-5407

Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2023-24480

Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2023-30539

Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Serv...

CVE-2023-5406

Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2022-31014

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...

CVE-2022-45589

All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2022-09-RT or a later release and use ...

CVE-2022-24706

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...

PT-2025-22716 · Intellian Technologies · Iridium Certus 700

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The SSID field is not parsed correctly, allowing it to be used for command injection into the hostpad.conf file. This issue can be exploited by an attacker to gain more knowledge of the syst...

PT-2025-22773 · Unknown · Mojoomla Hospital Management System

Name of the Vulnerable Software and Affected Versions: mojoomla Hospital Management System versions 47.020 through 11 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further...

PT-2025-22770 · Unknown · Psw Front-End Login & Registration

Name of the Vulnerable Software and Affected Versions: Gilblas Ngunte Possi PSW Front-end Login & Registration versions n/a through 1.13 Description: The issue is related to a Weak Password Recovery Mechanism for Forgotten Password, which allows Password Recovery Exploitation in the PSW Front-end...

PT-2025-22822 · Thehive · Thehive

Name of the Vulnerable Software and Affected Versions: TheHive versions 5.2.0 through 5.2.15 TheHive versions 5.3.0 through 5.3.10 TheHive versions 5.4.0 through 5.4.9 TheHive versions 5.5.0 Description: A Server-Side Request Forgery SSRF issue allows remote authenticated attackers with admin...

PT-2025-22763 · Unknown · Mortgage Calculator Bmi Adult & Kid Calculator

Name of the Vulnerable Software and Affected Versions: Mortgage Calculator BMI Adult & Kid Calculator versions 1.2.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This...

PT-2025-22735 · Unknown · Crossword Compiler

Name of the Vulnerable Software and Affected Versions: Crossword Compiler Puzzles versions 5.2 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-22730 · Unknown +1 · Wpfable Fable Extra +1

Name of the Vulnerable Software and Affected Versions: WPFable Fable Extra versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...