ABUP IoT Cloud Platform

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize...

PT-2025-22140 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.50 ELTS TYPO3 versions 10.0.0 through 10.4.49 ELTS TYPO3 versions 11.0.0 through 11.5.43 ELTS TYPO3 versions 12.0.0 through 12.4.30 LTS TYPO3 versions 13.0.0 through 13.4.11 LTS Description: The backend user...

PT-2025-22577 · Opendcim · Opendcim

Name of the Vulnerable Software and Affected Versions: openDCIM versions prior to 23.05 Description: The issue allows SQL injection in people depts.php because prepared statements are not used. This could potentially lead to unauthorized access or manipulation of data. Recommendations: For openDC...

PT-2025-22296 · H3C · H3C R2+Prog

Name of the Vulnerable Software and Affected Versions: H3C R2+ProG versions up to 200R004 Description: A problematic issue was found in the HTTP POST Request Handler component, specifically in the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit BasicSSID/Edit...

PT-2025-22277

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.15 Description The issue concerns the use of pandas eval through the compute from docs function in the LanceDocChatAgent component. This allows an attacker to potentially run malicious commands, compromising the...

PT-2025-21986 · Unknown · Majestic Support

Name of the Vulnerable Software and Affected Versions: Majestic Support versions 1.1.0 and earlier Description: The issue is related to Missing Authorization, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For Majestic Support versions 1.1.0 a...

PT-2025-21941 · Engenius · Engenius Enh500 Ap 2T2R

Name of the Vulnerable Software and Affected Versions: EnGenius ENH500 AP 2T2R version 3.0 FW3.7.22 Description: The issue concerns Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change reques...

PT-2025-22049 · Checkbot · Checkbot

Name of the Vulnerable Software and Affected Versions: CheckBot versions 1.05 and earlier Description: A Cross-Site Request Forgery CSRF issue in Ref CheckBot allows for Stored XSS. This means an attacker can execute malicious scripts on the victim's browser, potentially leading to unauthorized...

PT-2025-22074

Name of the Vulnerable Software and Affected Versions: Gardener versions prior to 1.116.4 Gardener versions prior to 1.117.5 Gardener versions prior to 1.118.2 Gardener versions prior to 1.119.0 Description: A security issue was discovered in Gardener that could allow a user with administrative...

PT-2025-21933 · Hugging Face · Transformers

Name of the Vulnerable Software and Affected Versions: huggingface/transformers version v4.48.3 Description: A vulnerability in the preprocess string function of the transformers.testing utils module allows for a Regular Expression Denial of Service ReDoS attack. The regular expression used to...

PT-2025-21931 · Unknown · Phpgurukul Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Marriage Registration System version 1.0 Description: A critical issue affects an unknown part of the file /admin/between-dates-application-report.php. The manipulation of the fromdate and todate arguments leads to SQL...

PT-2025-22031 · Unknown · Aseem1234 Best Posts Summary

Name of the Vulnerable Software and Affected Versions: aseem1234 Best Posts Summary versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

PT-2025-21926 · Unknown · Phpgurukul Auto Taxi Stand Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Auto Taxi Stand Management System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Auto Taxi Stand Management System. The issue is related to an unknown function of the file...

PT-2025-22028 · Unknown · Cnilsson Icafe Library

Name of the Vulnerable Software and Affected Versions: Cnilsson iCafe Library versions 1.8.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-22103 · Mojoomla · Mojoomla Hospital Management System

Name of the Vulnerable Software and Affected Versions: mojoomla Hospital Management System versions n/a through 47.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-22082

Name of the Vulnerable Software and Affected Versions OpenPGP.js versions 5.0.1 through 5.11.2 OpenPGP.js versions 6.0.0 through 6.1.0 Description A maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature...

PT-2025-21945 · Chatgpt · Chatgpt

Name of the Vulnerable Software and Affected Versions: ChatGPT system through 2025-03-30 Description: The issue allows HTML injection within most modern graphical web browsers due to the inline rendering of SVG documents. This is instead of rendering them as text inside a code block...

PT-2025-21929 · Unknown · Phpgurukul Daily Expense Tracker System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Daily Expense Tracker System version 1.1 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the fromdate and todat...

PT-2025-22064 · Unknown · Gardener External Dns Management +1

Name of the Vulnerable Software and Affected Versions: Gardener External DNS Management versions prior to 0.23.6 gardener/gardener-extension-shoot-dns-service extension versions = v1.60.0 Description: A security issue was discovered in Gardener's External DNS Management that could allow a user wi...

PT-2025-22008 · Tiki Time · Tiki Time

Name of the Vulnerable Software and Affected Versions: Tiki Time versions 1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...