PT-2025-26239 · Unknown · Brilliance Golden Link Secondary System

Name of the Vulnerable Software and Affected Versions: Brilliance Golden Link Secondary System versions up to 20250609 Description: A critical issue has been found in the Brilliance Golden Link Secondary System, affecting an unknown part of the file /storagework/custTakeInfoPage.htm. The...

The vulnerability in the ZendTo web application for transferring files involves an incorrect restriction on the path to the restricted directory. This allows a malicious actor to gain read and write access to data, or cause a service failure.

The vulnerability in the web application for transferring files via ZendTo is related to an incorrect restriction on the path to the restricted directory during the processing of the tmpname parameter. Exploiting this vulnerability can allow an attacker to gain read and modify access to data, or...

PT-2025-26209 · WordPress · Football-Pool

Name of the Vulnerable Software and Affected Versions: Football Pool plugin for WordPress versions up to, and including, 2.12.4 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-26563 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 1.1.1-B20200824.0128 Description: A critical issue affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to...

PT-2025-26203 · Pypi · Pgai

Name of the Vulnerable Software and Affected Versions: pgai versions prior to 8eb3567 Description: The issue concerns the pgai Python library, which transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to a specific commit, the library was vulnerable to an attack...

PT-2025-26218 · Unknown · Zhilink Adp Application Developer Platform

Name of the Vulnerable Software and Affected Versions: zhilink ADP Application Developer Platform version 1.0.0 Description: A critical issue affects the processing of the file /adpweb/a/base/barcodeDetail/. The manipulation of the argument barcodeNo/barcode/itemNo leads to SQL injection. The...

PT-2025-26231 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions prior to 6.7.2 Description: The issue concerns an XML external entity XXE attack and a server-side request forgery SSRF attack in certain places of powsybl-core XML parsing. This allows an attacker to elevate their privileges...

PT-2025-26212 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 4.3.0 Description: The issue allows authenticated attackers with Contributor-level access and above to view or delete fundraising campaigns, view donors' data, a...

PT-2025-26213 · WordPress · Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder for WordPress versions up to, and including, 8.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Grid Builder feature due to insufficient input sanitization and output escaping on...

PT-2025-26217

Name of the Vulnerable Software and Affected Versions Yirmibes Software MY ERP versions prior to 1.170 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendatio...

PT-2025-26211 · WordPress · Ai Engine Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: WordPress AI Engine plugin affected versions not specified Description: A critical flaw in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled. Recommendations: Update the...

CVE-2025-23173

The CVE-2025-23173 entry concerns Versa Director SD-WAN, where the websockify service is exposed on port 6080 via the Director GUI, allowing internet-accessible, direct web-based access to uCPE VMs. Public sources describe this as a risk vector with known weaknesses in websockify that could enabl...

CVE-2025-23173

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known...

CVE-2025-47869

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to...

CVE-2022-50078

In the Linux kernel, the following vulnerability has been resolved: tracing/eprobes: Do not allow eprobes to use $stack, or % for regs While playing with event probes eprobes, I tried to see what would happen if I attempted to retrieve the instruction pointer %rip knowing that event probes do not...

CVE-2022-50001

The CVE-2022-50001 issue affects the Linux kernel netfilter component nft_tproxy. The root cause was that TPROXY could be used from non-prerouting paths, leading to a null dereference crash. The fix restricts nft_tproxy to the prerouting hook, requiring a check that it runs only in prerouting. Th...

CVE-2022-50001 netfilter: nft_tproxy: restrict to prerouting hook

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfttproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nfttproxy doesn't check this. This fixes a crash null dereference when using tproxy from e.g. output...

PT-2025-26136 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.19-rc5+ 1052 Description: A warning has been fixed in the Linux kernel for MIPS architecture when CONFIG CPUMASK OFFSTACK and CONFIG DEBUG PER CPU MAPS are selected. The issue generated a runtime warning while...

PT-2025-25769 · Lychee · Lychee

Name of the Vulnerable Software and Affected Versions: Lychee versions 6.6.6 through 6.6.9 Description: The issue affects Lychee, a free photo-management tool. An attacker can exploit a path traversal vulnerability in SecurePathController.php to leak local files, including environment variables,...

PT-2025-26183 · Unknown · Cloudclassroom-Php Project

Name of the Vulnerable Software and Affected Versions: CloudClassroom-PHP-Project version 1.0 Description: The issue allows unauthenticated attackers to bypass authentication and gain administrative access due to SQL Injection in the loginlinkadmin.php file. The application fails to properly...