Voltronic Power and PowerShield UPS monitoring software

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker remotely to make configuration changes, resulting in shutting down UPS connected devices or execution of arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures...

MAL-2025-5492 Malicious code in cors-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8939034e252aec0a1bb8e90a23fa9e524d966682283a461f00204f8bedf29c33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-27566 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.7.7 Description: The issue concerns the exposure of a PHP phpinfo debug page to unauthenticated users, potentially containing sensitive data useful for an attacker. Recommendations: For versions...

PT-2025-27538

Name of the Vulnerable Software and Affected Versions: AVTECH DVR devices affected versions not specified Description: An unauthenticated command injection issue exists in AVTECH DVR devices. This is due to the lack of input sanitization when using wget in the "Search.cgi?action=cgi query"...

PT-2025-27520 · Asr190X +3 · Asr190X +4

Name of the Vulnerable Software and Affected Versions: ASR180x versions prior to v1536 ASR190x versions prior to v1536 Description: The issue is related to an Improper Resource Shutdown or Release, which can lead to Resource Leak Exposure. This problem is associated with the tr069 modules,...

PT-2025-27578 · Unknown · Linjiashop

Name of the Vulnerable Software and Affected Versions: Linjiashop versions =0.9 Description: The issue concerns Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted password and salt. The password can the...

PT-2025-27550 · Onelogin · Onelogin Ad Connector

Name of the Vulnerable Software and Affected Versions: OneLogin AD Connector versions prior to 6.1.5 Description: An information disclosure issue exists via the "/api/adc/v4/configuration" endpoint. An attacker with access to a valid directory token can retrieve a plaintext response disclosing...

PT-2025-27506 · Konica Minolta · Konica Minolta Bizhub 227

Name of the Vulnerable Software and Affected Versions: Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier Description: The issue concerns insufficiently protected credentials in LDAP, allowing an attacker to reconfigure the target device to use an external LDAP service...

PT-2025-27616

Name of the Vulnerable Software and Affected Versions Model Context Protocol Servers Filesystem versions prior to 0.6.4 Model Context Protocol Servers Filesystem versions prior to 2025.7.01 Description An issue exists in the server-filesystem implementation of the Model Context Protocol MCP due t...

PT-2025-27542

Name of the Vulnerable Software and Affected Versions: Dahua Smart Cloud Gateway Registration Management Platform affected versions not specified Description: An SQL injection issue exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the...

PT-2025-27515

Name of the Vulnerable Software and Affected Versions: juju/utils affected versions not specified Description: The issue concerns the generation of certificates in juju/utils using the cert.NewLeaf function, which could potentially include private information. If such a certificate is transferred...

PT-2025-27500 · Sunshine · Sunshine

Name of the Vulnerable Software and Affected Versions: Sunshine versions prior to 2025.628.4510 Description: The issue is related to a lack of protection against Cross-Site Request Forgery CSRF attacks in the web UI of Sunshine. This allows an attacker to create a malicious web page that can...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to Tampering (CVE-2025-36056)

Summary The IBM TS7700 virtualization solution has a vulnerability CVE-2025-36056 that makes it susceptible to tampering, as an attacker could exploit a Cross-Site Scripting flaw in its management interface. This security gap could enable unauthorized access to sensitive information through socia...

PT-2025-27459

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.3 Frappe versions prior to 15.58.0 Description: The issue is related to a SQL injection vulnerability that could be achieved via a specially crafted request, potentially allowing malicious individuals to gain...

PT-2025-27463 · Code Projects · Code-Projects Online Hotel Booking

Name of the Vulnerable Software and Affected Versions: code-projects Online Hotel Booking version 1.0 Description: A critical vulnerability has been found in the code-projects Online Hotel Booking software. This issue affects unknown code of the file /admin/registration.php. The manipulation of t...

PT-2025-27452 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 3.2 Description: A critical issue was found in the PHPGurukul Student Record System, affecting an unknown functionality of the file /edit-student.php. The manipulation of the fmarks2 argument leads to...

PT-2025-27491 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions 30.0.0-alpha.1 through 30.0.5 Electron versions 31.0.0-alpha.1 through 31.0.0-beta.1 Description: The issue is an ASAR Integrity bypass, which only impacts applications that have the embeddedAsarIntegrityValidation and...

PT-2025-27598 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.44.2 Description: The Forminator plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file...

PT-2025-27464 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 28.3.2 Electron versions prior to 29.3.3 Electron versions prior to 30.0.3 Description: The issue is related to heap buffer overflows in Electron's API, specifically affecting the nativeImage.createFromPath and...

PT-2025-27413 · WordPress · Contact-Form-Plugin

Name of the Vulnerable Software and Affected Versions: Contact Form Plugin WordPress plugin versions prior to 1.1.29 Description: The issue concerns the Contact Form Plugin WordPress plugin, where some settings are not properly sanitized and escaped, potentially allowing high-privilege users, suc...