CVE-2025-52338: Authentication Bypass Using an Alternate Path or Channel

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

PT-2025-33861 · Unknown · Cicool Builder

Name of the Vulnerable Software and Affected Versions: Cicool builder version 3.4.4 Description: An issue allows attackers to reset the administrator's password. This is achieved via the /administrator/auth/reset password API endpoint. Recommendations: As a temporary workaround, consider...

PT-2025-33747

Name of the Vulnerable Software and Affected Versions: EzGED3 versions prior to 3.5.72.27183 Description: EzGED3 is susceptible to an unauthenticated arbitrary file read issue stemming from inadequate access control and insufficient input validation within a web-accessible script. An attacker can...

PT-2025-33852 · Logicdata · Logicdata Ecommerce Framework

Name of the Vulnerable Software and Affected Versions: LogicData eCommerce Framework version 5.0.9.7000 Description: An issue in the default configuration of the password reset function allows attackers to bypass authentication and compromise user accounts via a bruteforce attack. Recommendations...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

CVE-2025-51539

The enterprise document management system EzGED3 (versions prior to 3.5.72.27183 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. The root cause is improper access control and insufficient input validation in a web-exposed PHP script, which lacks secure path handling. A re...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

CVE-2025-52338

The LogicData eCommerce Framework version v5.0.9.7000 is affected by a security vulnerability involving an improperly configured default in the password reset function . This flaw allows attackers to perform a bruteforce attack to bypass authentication and compromise user accounts. No information...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-51539

EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem...

CVE-2025-52338

An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack...

Cicool Web Builder security vulnerabilities

Cicool web builder is a website builder from Cicool Inc. A security vulnerability exists in Cicool web builder version 3.4.4, which originates from allowing an attacker to reset the administrator password via the /administrator/auth/resetpassword endpoint...

LogicData eCommerce Framework security vulnerabilities

LogicData eCommerce Framework is an e-commerce middleware from LogicData Corporation. A security vulnerability exists in LogicData eCommerce Framework version v5.0.9.7000, which stems from an improperly configured default of the password reset feature, which could lead to bypassing authentication...

August 19, 2025—KB5066189 (OS Builds 22621.5771 and 22631.5771) Out-of-band

August 19, 2025—KB5066189 OS Builds 22621.5771 and 22631.5771 Out-of-band Applies To Windows 11 Enterprise and Education, version 22H2 Windows 11 version 23H2, all editions Windows Secure Boot certificate expiration Secure Boot certificates used by most Windows devices have started expiring in Ju...

Linux Distros Unpatched Vulnerability : CVE-2025-38417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ice: fix eswitch code memory leak in reset scenario Add simple eswitch mode checker in...

How to spot the latest fake Gmail security alerts

Security alerts from tech companies are supposed to warn us when something might be amiss—but what if the alerts themselves are the risk? Scammers have long impersonated tech companies' security and support staff as a way to sniff out users' login credentials, and reports suggest that they're doi...

CVE-2025-38521

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix kernel crash when hard resetting the GPU The GPU hard reset sequence calls pmruntimeforcesuspend and pmruntimeforceresume, which according to their documentation should only be used during system-wide PM...

CVE-2025-38516

In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless registered as a GPIO in the kernel. This enables the user-space to trigger a...

BIT-TOMCAT-2025-48989 Apache Tomcat: h2 DoS - Made You Reset

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0 through 11.0.9, from 10.1.0 through 10.1.43 and from 9.0.0 through 9.0.107. Older, EOL versions may also be affected. Users are...

CVE-2025-8898

The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identit...