DuraComm DP-10iN-100-MU

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities,...

CVE-2025-7953

Sanluan PublicCMS

CVE-2025-7949 Sanluan PublicCMS preview.html redirect

A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url lead...

[SECURITY] [DLA 4245-1] libcommons-fileupload-java security update

Debian LTS Advisory DLA-4245-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 22, 2025 https://wiki.debian.org/LTS Package : libcommons-fileupload-java Version : 1.4-1+deb11u1 CVE ID : CVE-2023-24998 CVE-2025-48976 Debian Bug : 1031733 1108120 Two security...

PT-2025-30411 · Etq · Etq Reliance

Name of the Vulnerable Software and Affected Versions: ETQ Reliance versions prior to SE.2025.1 ETQ Reliance versions prior to 2025.1.2 Description: An authorization bypass allows an unauthenticated attacker to retrieve limited sensitive resources by appending a specific URI suffix to certain API...

PT-2025-30390 · WordPress · Orion Login With Sms

Name of the Vulnerable Software and Affected Versions: Orion Login with SMS plugin for WordPress versions up to and including 1.0.5 Description: The Orion Login with SMS plugin for WordPress is susceptible to authentication bypass due to insufficient security measures in the olws handle verify...

Debian dla-4245 : libcommons-fileupload-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4245 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4245-1 [email protected]...

PT-2025-30393 · Arm · Arm Development Studio

Name of the Vulnerable Software and Affected Versions: Arm Development Studio versions prior to 2025 Description: An uncontrolled search path element exists in Arm Development Studio that may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrar...

PT-2025-30449

Name of the Vulnerable Software and Affected Versions Ollama version 0.6.7 Description A cross-domain token exposure exists in the server.auth.getAuthorizationToken function. This allows remote attackers to steal authentication tokens and bypass access controls by exploiting a malicious realm val...

GHSA-JQ2C-M8GG-MQCM Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

GHSA-XG9P-P463-3QJP Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-49656 Apache Jena: Administrative users can create files outside the server directory space via the admin UI

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

PT-2025-30350 · Unknown · Phpgurukul Time Table Generator System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Time Table Generator System version 1.0 PHPGurukul Taxi Stand Management System version 1.0 Description: A problematic vulnerability exists due to cross site scripting. Manipulation of the adminname argument in the /admin/profile.p...

PT-2025-30359 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJS versions 11.0.9 and below Description: HAX CMS NodeJS is distributed with hardcoded default credentials for user and superuser accounts and default private keys for JWTs. Users are not prompted to change these credentials or...

CVE-2025-7864

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to unrestricted upload. It is possible to initiate the attack...

CVE-2025-7864

Thinkgem JeeSite (versions up to 5.12.0) has a vulnerability in the Upload function of FileUploadController.java that allows unrestricted file uploads. The issue can be exploited remotely and exploitation has been disclosed publicly. A patch is available with identifier 3585737d21fe490ff6948d913f...

CVE-2025-7863

Summary: CVE-2025-7863 affects thinkgem JeeSite up to version 5.12.0. The vulnerability resides in the redirectUrl function of ServletUtils.java, where manipulation of the url parameter can lead to an open redirect. The issue may be exploited remotely. A patch is available, identified by the patc...

PT-2025-30217 · Westermo · Westermo Weos

Name of the Vulnerable Software and Affected Versions: Westermo WeOS versions 5.24 through 5.24.4 Description: An issue was discovered that allows a threat actor to potentially gain unauthorized access to sensitive information via system logging information, specifically through verbose syslog...

PT-2025-30193

Name of the Vulnerable Software and Affected Versions Dunamu StockPlus App versions up to 7.62.10 Description A vulnerability exists in Dunamu StockPlus App on Android. The issue involves improper export of android application components due to manipulation of an unknown functionality within the...

PT-2025-30124

Name of the Vulnerable Software and Affected Versions Front End Editor plugin for WordPress versions prior to 2.3 Description The Front End Editor plugin for WordPress is susceptible to arbitrary file uploads due to missing file type validation via the upload.php file. This allows unauthenticated...