PT-2025-16237 · Veal98 · Veal98

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2 Description: A vulnerability was found in the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The...

PT-2025-16222 · Unknown · Ghostxbh Uzy-Ssm-Mall

Name of the Vulnerable Software and Affected Versions: ghostxbh uzy-ssm-mall version 1.0.0 Description: A critical vulnerability was found in ghostxbh uzy-ssm-mall, affecting an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the File argument leads to unrestricted...

PT-2025-16268 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For IBM...

PT-2025-16217 · Veal98 · Veal98

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2 Description: A critical issue has been found in the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be...

PT-2025-16245 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.1 Mattermost versions 9.11.x through 9.11.9 Description: The issue allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation, as the software fails to...

PT-2025-16269 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue could disclose sensitive information in HTTP headers, which could be used in further attacks against the system. Recommendations: For IBM Aspera Console versions 3.4.0...

PT-2025-16259 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify version 1.0 Description: The issue is related to a Server-Side Request Forgery SSRF via the component controllers.console.remote files.RemoteFileUploadApi. This allows for potential unauthorized access to internal resources...

PT-2025-16277 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in AutoGPT, which is caused by DNS Rebinding in the requests wrapper. This allows an attacker to bypass the validation of th...

PT-2025-16949 · Opensuse +1 · Govulncheck-Vulndb

Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20250409T170536 Description: This update addresses multiple issues within govulncheck-vulndb. The update includes fixes for GO-2025-3591, GO-2025-3594, GO-2025-3598, GO-2025-3599, GO-2025-3553, and...

PT-2025-16175 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 9.5.21 Description: A vulnerability has been found in YouDianCMS, affecting an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross-site scripting...

PT-2025-16180 · Unknown · Powercreator Cms

Name of the Vulnerable Software and Affected Versions: PowerCreator CMS version 1.0 Description: A critical issue was found in PowerCreator CMS, affecting an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the cid argument leads to sql injection. It is possible to launch...

Exploit for Cross-site Scripting in Moodle

PoC for CVE-2025-26529 – Moodle XSS to RCE Exploit This is a...

PT-2025-16378 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK N600R version 4.3.0cu.7647 B20210106 Description: A stack overflow issue was discovered via the pin parameter in the setWiFiWpsConfig function. Recommendations: For TOTOLINK N600R version 4.3.0cu.7647 B20210106, consider disabling th...

PT-2025-25408 · Blink · Bl-X10 Ac8 +7

Name of the Vulnerable Software and Affected Versions: Blink routers BL-WR9000 version 2.4.9 Blink routers BL-AC2100 AZ3 version 1.0.4 Blink routers BL-X10 AC8 version 1.0.5 Blink routers BL-LTE300 version 1.2.3 Blink routers BL-F1200 AT1 version 1.0.0 Blink routers BL-X26 AC8 version 1.2.8 Blink...

SurrealDB no JavaScript script function default timeout could facilitate DoS

Through enabling the scripting capability. SurrealDB allows for advanced functions with complicated logic, by allowing embedded functions to be written in JavaScript. These functions are bounded for memory and stack size, but not in time. An attacker could launch a number of long running function...

PT-2025-16119 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 macOS versions prior to Sonoma 14 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access sensitive user data. Recommendations: Fo...

PT-2025-16158 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue involves an out-of-bounds read in Microsoft Edge Chromium-based, allowing an unauthorized attacker to execute code over a network. This can potentially enabl...

ABB MV Drives

SUMMARY Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System v.3.5.15.0 is utilized in the firmware of ABB MV ACS6080 and ACS5000 drives to provide IEC 61131 programming capabilities. These vulnerabilities could lead...

PT-2025-16011 · Mediawiki +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.12 MediaWiki versions prior to 1.42.6 MediaWiki versions prior to 1.43.1 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. It is associated with program files...

PT-2025-16014 · Mediawiki +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.12 MediaWiki versions prior to 1.42.6 MediaWiki versions prior to 1.43.1 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting...