PT-2025-38717

A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/mod reservation/index.php?view=view. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is...

PT-2025-38625

Name of the Vulnerable Software and Affected Versions Libraesva Email Security Gateway versions 4.5 through 5.5.x before 5.5.7 Libraesva Email Security Gateway version 5.0 through 5.0.31 Libraesva Email Security Gateway version 5.1 through 5.1.20 Libraesva Email Security Gateway version 5.2 throu...

CVE-2025-10675

CVE-2025-10675 affects fuyang_lipengjun platform 1.0, specifically the AttributeController handling /attribute/queryAll. The underlying issue is improper authorization in the AttributeController, enabling remote exploitation. Public exploit is reported across sources, indicating active risk. Conn...

CVE-2025-5914 affecting package libarchive for versions less than 3.7.7-3

CVE-2025-5914 affecting package libarchive for versions less than 3.7.7-3. A patched version of the package is available...

PT-2025-38467

Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description A security flaw exists in the AttributeController function within the /attribute/queryAll file of the fuyang lipengjun platform. Manipulation of this function leads to improper authorization...

CVE-2025-10624

A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and ma...

CVE-2025-10624

A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and ma...

PT-2025-38240

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A security flaw has been discovered in Portabilis i-Educar. The vulnerability affects unknown code within the /agenda preferencias.php file. Manipulation of the tipoacao argument can lead t...

Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Impact A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8. Patches v5.130.4 and v6.0.9 contain a fix for this issue. Referenc...

PT-2025-37428

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Grading System version 1.0 Description: A security flaw exists in SourceCodester Student Grading System 1.0. The issue is related to SQL injection within the /edit user.php file. Manipulation of the ID parameter can...

CVE-2025-10374 Shenzhen Sixun Business Management System OperatorStop improper authorization

A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the...

CVE-2025-58754

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory...

CVE-2025-10245 Display Painéis TGA Galeria rename path traversal

A security flaw has been discovered in Display Painéis TGA up to 7.1.41. Affected by this issue is some unknown functionality of the file /gallery/rename of the component Galeria Page. The manipulation of the argument currentfolder results in path traversal. The exploit has been released to the...

CVE-2025-58450

pREST PostgreSQL REST, is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a...

CVE-2025-59052

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

Security Bulletin: Security vulnerabilities in Java SE shipped with IBM CICS TX Standard (CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754)

Summary There are multiple vulnerabilities in the Java SE version shipped with IBM CICS TX Standard CVE-2025-50106, CVE-2025-30749, CVE-2025-30761, CVE-2025-30754. An update to IBM CICS TX Standard has been released to address these vulnerabilities. Vulnerability Details CVEID:CVE-2025-50106...

Photon OS 5.0: Libsoup PHSA-2025-5.0-0614

An update of the libsoup package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0614. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-58451 Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption

Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource...

CVE-2025-10102 code-projects Online Event Judging System index.php sql injection

A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown function of the file /index.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been release...