PT-2025-30425 · Code Projects · Food Ordering Review System

Name of the Vulnerable Software and Affected Versions: code-projects Food Ordering Review System version 1.0 Description: A critical vulnerability exists in an unknown functionality of the file /user/reservation page.php. Manipulation of the argument reg Id leads to a SQL injection. The attack ca...

PT-2025-30418 · Unknown · Deepfiction Ai

Name of the Vulnerable Software and Affected Versions: Deepfiction AI versions prior to June 3, 2025 Description: An Insecure Direct Object Reference IDOR vulnerability exists in Deepfiction AI. This allows attackers to access and utilize other users' credits for interacting with the Large Langua...

CVE-2025-54122

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

The vulnerability of the automated system for emulating intruder actions in Caldera, related to an incorrect restriction on the path name to the restricted catalog, allows an intruder to execute arbitrary code.

The vulnerability of the automated system for emulating intruder actions in Caldera is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows an intruder operating remotely to execute arbitrary code by sending a specially crafted HTTP...

The vulnerability of the IP Access Restriction function of the Cisco Identity Services Engine (ISE) management interface and the Cisco ISE Passive Identity Connector (ISE-PIC) virtual authentication data collection device allows a perpetrator to circumvent existing IP access restrictions.

The vulnerability of the IP Access Restriction function of the Cisco Identity Services Engine ISE and the Cisco ISE Passive Identity Connector ISE-PIC, a virtual device for collecting user authentication data, relates to bypassing authentication using data that is assumed to be unchangeable...

PT-2025-30290 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A critical issue exists in the processing of the /members/edit user.php file. Manipulation of the firstname argument can lead to SQL injection. The exploit has been publicly disclosed and may be...

PT-2025-30286 · Phpgurukul · Phpgurukul Online Banquet Booking System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Banquet Booking System version 1.0 Description: A critical issue exists in PHPGurukul Online Banquet Booking System 1.0. The vulnerability is located in the /admin/view-user-queries.php file. Manipulation of the viewid...

PT-2025-30158 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A critical vulnerability exists in Church Donation System 1.0. The vulnerability is due to a SQL injection flaw within the /members/update password admin.php file. Manipulation of the new passwo...

PT-2025-30206

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi versions up to 4.8.1 Description A problematic issue exists in yangzongzhuan RuoYi related to the processing of the /swagger-ui/index.html file within the Swagger UI component. Manipulation of the configUrl argument can lea...

PT-2025-30139 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A vulnerability exists in Church Donation System 1.0. The issue is a SQL injection affecting an unknown functionality of the file /login.php. Manipulation of the Username argument can lead to...

PT-2025-30131 · Phpgurukul · Phpgurukul Apartment Visitors Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Apartment Visitors Management System version 1.0 Description: A cross site scripting issue exists due to the manipulation of the visname argument within the HTTP POST Request Handler in the /bwdates-reports.php file. The attack can...

PT-2025-30151 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the fromVirtualSer function within the /goform/VirtualSer file. Manipulation of the page argument can trigger a stack-based buffer overflow, allowing for remote exploitation...

CVE-2025-20285

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to improper enforcement of access controls...

PT-2025-30084 · Agorum Software Gmbh · Agorum Core

Name of the Vulnerable Software and Affected Versions: agorum Software GmbH Agorum core open versions 11.9.2 and 11.10.1 Description: A Server-Side Request Forgery SSRF exists in the TunnelServlet component. This allows attackers to initiate connections to arbitrary internal and external resource...

PT-2025-30060 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the formSafeEmailFilter function of the /goform/SafeEmailFilter file. Manipulation of the page argument leads to a stack-based buffer overflow, potentially allowing for remot...

The vulnerability in the web interface of the microprogramming software for Digital Optical Network Systems Infinera G42 allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web interface of Microprogramming Software for Digital Optical Network Systems Infinera G42 is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

PT-2025-30009 · WordPress · Malcure Malware Scanner

Name of the Vulnerable Software and Affected Versions: Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress versions prior to 16.9 Description: The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary...

CVE-2025-53927

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the shutil.copy2 method in Python to copy the command they...

CVE-2025-53927 MaxKB sandbox bypass

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the shutil.copy2 method in Python to copy the command they...

RUSTSEC-2025-0045 ConstStaticCell could have been used to pass non-Send values to another thread

ConstStaticCell could have been used to pass non-Send values to another thread, because T was not required to be Send while ConstStaticCell is Send. This was corrected by introducing a T: Send bound...