PT-2025-22664 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Medical Card Generation System version 1.0 Description: The issue concerns stored cross-site scripting XSS vulnerabilities in the /mcgs/admin/contactus.php component. Attackers can execute arbitrary web scripts or HTML by injecting...

PT-2025-22676 · Woocommerce · Bus Ticket Booking With Seat Reservation For Woocommerce

Name of the Vulnerable Software and Affected Versions: Bus Ticket Booking with Seat Reservation for WooCommerce versions 1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for S...

PT-2025-22638 · Cyberdava · Cyberdava

Name of the Vulnerable Software and Affected Versions: CyberDAVA versions prior to 1.1.20 Description: A privilege escalation issue allows a low-privileged user to escalate their privilege by abusing the API endpoint "/api/v2/users/user//role/ROLE/" due to the lack of access control, potentially...

PT-2025-22641 · Unknown · Nexus Series +2

Name of the Vulnerable Software and Affected Versions: ASPECT-Enterprise versions through 3. NEXUS Series versions through 3. MATRIX Series versions through 3. Description: The issue is related to Stored Absolute Path Traversal vulnerabilities in ASPECT, which could expose sensitive data if...

PT-2025-22793 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: zongzhige ShopXO version 6.5.0 Description: A critical issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The...

PT-2025-22743 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal versions n/a through 2.3.1 Description: The issue affects WP Job Portal, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...

PT-2025-22807 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3.4 Description: A stored cross-site scripting XSS vulnerability allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads i...

PT-2025-22824 · Strangebee · Thehive

Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 5.2.0 through 5.2.15 StrangeBee TheHive versions 5.3.0 through 5.3.10 StrangeBee TheHive versions 5.4.0 through 5.4.9 Description: A Broken Access Control issue allows remote, authenticated, and unprivileged users ...

PT-2025-22751 · WordPress · Experto Cta Widget

Name of the Vulnerable Software and Affected Versions: Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin versions 1.1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control...

PT-2025-22802

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.18 Description The issue is related to a heap-based buffer over-read in the parse string function of the cJSON library. This occurs when cJSON ParseWithLength is called with a JSON string that has no trailing newlin...

PT-2025-22825 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.5.11 Description: A critical issue has been discovered, affecting the /include/controller/api controller.php file. The manipulation of the tag argument leads to SQL injection. This issue can be exploited remotely...

CVE-2025-22157

This High severity PrivEsc Privilege Escalation vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc Privilege Escalation vulnerability, wi...

CVE-2025-3944

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before...

CVE-2025-3945

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara...

CVE-2025-3937

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niaga...

CVE-2025-3937

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niaga...

CVE-2025-3943

CVE-2025-3943 affects Tridium Niagara Framework and Tridium Niagara Enterprise Security. The issue is use of GET with sensitive query strings allowing parameter injection, with affected versions before 4.14.2, before 4.15.1, and before 4.10.11 (Framework) and before 4.14.2, before 4.15.1, and bef...

CVE-2025-3936

CVE-2025-3936 involves an Incorrect Permission Assignment for Critical Resource in Tridium Niagara Framework (Windows) and Tridium Niagara Enterprise Security (Windows) . The root cause is misconfigured access control that could enable an attacker to exploit permissions on critical resources. Aff...

Scammers are using AI to impersonate senior officials, warns FBI

The FBI has issued a warning about an ongoing malicious text and voice messaging campaign that impersonates senior US officials. The targets are predominantly current or former US federal or state government officials and their contacts. In the course of this campaign, the cybercriminals have use...

CVE-2019-10073

The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616...