PT-2025-31849 · Unknown · Givanz Vvveb

Name of the Vulnerable Software and Affected Versions: givanz Vvveb versions up to 1.0.5 Description: A critical vulnerability exists in the Drag-and-Drop Editor component of givanz Vvveb. The vulnerability is due to server-side request forgery, which can be triggered by manipulating the url...

Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-1093)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1093 advisory. For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: fro...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-1118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1118 advisory. A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file...

CVE-2025-8510

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educarmatriculalst.php. The manipulation of the argument refcodaluno leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2024-51775

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended...

CVE-2024-52279 Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string

Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue...

PT-2025-31783 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.11.1 through 0.12.0 Description: An improper input validation issue exists in Apache Zeppelin. The fix for JDBC URL validation did not account for URL encoded input. Recommendations: Upgrade to version 0.12.0...

PT-2025-31787 · Portabilis · I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.10 Description: A problematic vulnerability exists in Portabilis i-Educar 2.10. The Gerar function within the file ieducar/intranet/educar matricula lst.php is affected. Manipulation of the ref cod aluno argument...

PT-2025-31738 · WordPress · Brave Conversion Engine

Name of the Vulnerable Software and Affected Versions: Brave Conversion Engine PRO plugin for WordPress versions through 0.7.7 Description: The Brave Conversion Engine PRO plugin for WordPress is susceptible to authentication bypass due to improper restriction of a claimed identity during Faceboo...

UBUNTU-CVE-2024-13978

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2preadtiffinit of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally...

CVE-2024-13978

CVE-2024-13978 affects LibTIFF up to 4.7.0, specifically the t2p_read_tiff_init function in fax2ps (tools/tiff2pdf.c). The flaw causes a null pointer dereference and is exploitable locally with high attack complexity; patches are available. Public docs (Debian LTS) confirm the vulnerability and p...

Vulnerabilities affecting SICK TDC-E210GC

SICK has identified multiple vulnerabilities in the SICK TDC-E210GC product. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected. At this time, SICK is not aware of any public exploits specifically targeting these vulnerabilities...

XML External Entity (XXE) Injection

Overview langchain-text-splitters is a LangChain text splitting utilities Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insecure XML parser configurations and the presence of the xsltpath parameter in the HTMLSectionSplitter class. Details XXE...

[SECURITY] [DLA 4262-1] libcommons-lang-java security update

Debian LTS Advisory DLA-4262-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert August 01, 2025 https://wiki.debian.org/LTS Package : libcommons-lang-java Version : 2.6-9+deb11u1 CVE ID : CVE-2025-48924 Debian Bug : 1109126 A vulnerability has been discovered in...

CVE-2025-24854

CVE-2025-24854 affects Apache JSPWiki’s Image plugin. A crafted request triggers a cross-site scripting (XSS) vulnerability that could allow JavaScript execution in the victim’s browser and potentially expose sensitive information. Affected component: JSPWiki Image plugin (version prior to 2.12.3...

Güralp Systems FMUS Series and MIN Series Devices (Update B)

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

CVE-2025-8345 Shanghai Lingdang Information Technology Lingdang CRM yunzhijiaApi.php delete_user sql injection

A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function deleteuser of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection...

CVE-2025-8345

CVE-2025-8345 affects Lingdang CRM up to version 8.6.4.7. The vulnerability is in the function delete_user of crm/WeiXinApp/yunzhijia/yunzhijiaApi.php, where manipulation of the function argument leads to SQL injection. The issue can be exploited remotely and exploit publicly disclosed. Remedies ...

PT-2025-31468 · Shanghai Lingdang Information Technology · Lingdang Crm

Name of the Vulnerable Software and Affected Versions: Lingdang CRM versions up to 8.6.4.7 Description: A critical issue exists in Shanghai Lingdang Information Technology Lingdang CRM. The delete user function within the crm/WeiXinApp/yunzhijia/yunzhijiaApi.php file is susceptible to SQL injecti...

Arbitrary Code Injection

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Arbitrary Code Injection via improper handling of the addname parameter in the /json/addpackage API endpoint. An attacker can inject arbitrary log entries b...