PT-2025-32503 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 versions up to 20250801 Description: A vulnerability exists due to os command injection. The RP setBasicAuto function within the /goform/RP setBasicAuto file is affected. Manipulation ...

PT-2025-31607 · Unknown · Projectworlds Online Admission System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Admission System version 1.0 Description: A vulnerability exists in projectworlds Online Admission System version 1.0 related to SQL injection. The issue is located in an unknown functionality of the file /viewdoc.php...

PT-2025-31498 · Code Projects · Vehicle Management

Name of the Vulnerable Software and Affected Versions: code-projects Vehicle Management version 1.0 Description: A critical issue exists in code-projects Vehicle Management 1.0. The manipulation of the company argument in the /updatebal.php file leads to SQL injection. This allows for remote...

Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093

This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions hookENTITYTYPEaccess wasn't taken into account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" an...

CLSA-2025-1753799801 Fix CVE(s): CVE-2025-32462

SECURITY UPDATE: unauthorized command execution on remote hosts - debian/patches/CVE-2025-32462.patch: restrict user from setting remote host for command unless listing privileges - CVE-2025-32462...

CLSA-2025-1753799668 Fix CVE(s): CVE-2025-32462

SECURITY UPDATE: unauthorized commands execution on unintended hosts - debian/patches/CVE-2025-32462.patch: restrict user from setting remote host for command unless listing privileges - CVE-2025-32462...

CLSA-2025-1753799090 Fix CVE(s): CVE-2025-32462

SECURITY UPDATE: restrict users from executing commands on unintended machines - debian/patches/CVE-2025-32462.patch: restricts --host usage to sudo -l only, preventing bypass of host-based sudoers rules and avoiding unintended local privilege escalation - CVE-2025-32462...

PT-2025-31370 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions 13.0.0 through 13.9.2 Umbraco versions 15.0.0 through 15.4.1 Umbraco versions 16.0.0 through 16.1.0 Description: Umbraco’s content delivery API can be restricted to require an API key in a header for authorization. Output...

WebAssembly Micro Runtime 安全漏洞

WebAssembly Micro Runtime WAMR is a lightweight, standalone WebAssembly runtime open-sourced by the Bytecode Alliance. With a small footprint, high performance, and highly configurable features for applications ranging from embedded, IoT, and edge to Trusted Execution Environments TEEs, smart...

SAMSUNG DMS 安全漏洞

SAMSUNG DMS is a data management server from Samsung South Korea. A security vulnerability exists in SAMSUNG DMS that stems from an improperly restricted path that could lead to the creation of arbitrary files...

PT-2025-31035 · Unknown · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical vulnerability exists due to a SQL injection flaw. The issue is located in an unknown function of the file /admin/update s4.php. Manipulation of the credits argument allows...

The vulnerability of the Mattermost instant messaging application, related to an incorrect restriction on the path to the restricted catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Mattermost instant messaging application is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2025-31049 · Vaelsys · Vaelsys

Name of the Vulnerable Software and Affected Versions: Vaelsys version 4.1.0 Description: A critical issue exists in Vaelsys 4.1.0 related to os command injection. The execute DataObjectProc function within the /grid/vgrid server.php file is vulnerable. Manipulation of the xajaxargs argument can...

PT-2025-31062 · Code Projects · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical issue exists in code-projects Exam Form Submission 1.0. The vulnerability is located in unknown code within the /admin/delete s3.php file. Manipulation of the ID argument...

PT-2025-31042 · Code Projects · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical issue exists in code-projects Exam Form Submission 1.0. The vulnerability is due to the manipulation of the ID argument in the /admin/delete s6.php file, leading to a SQL...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Adobe Acrobat

技术文章存档 ------ Paper list： Talking About Exploit Writing Bypassing AntiVirus Detection for Malicious PDFs MBR病毒分析 使用bochs调试MBR 基于MBR的系统登录密码验证程序 PDF文件格式分析 恶意PDF文件解析思路 Win 7下定位kernel32.dll基址及shellcode编写 CVE-2009-0658漏洞分析 Firefox vulnerabilityCVE-2011-0065 Bypassing DEP CVE-2009-4324漏洞分析 Flash XSS漏洞挖...

WordPress Premium Age Verification / Restriction for WordPress Plugin <= 3.0.2 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by ch4r0n in WordPress Plugin Premium Age Verification / Restriction for WordPress versions = 3.0.2...

PT-2025-30972 · Unknown · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: ABC Courier Management System version 1.0 Description: A critical issue exists in ABC Courier Management System 1.0. The vulnerability is due to a SQL injection flaw within an unknown function of the file /getbyid.php. Manipulation of the ID...

CVE-2025-38442 block: reject bs > ps block devices when THP is disabled

In the Linux kernel, the following vulnerability has been resolved: block: reject bs ps block devices when THP is disabled If THP is disabled and when a block device with logical block size page size is present, the following null ptr deref panic happens during boot: 13.2 mK AOSAN: null-ptr-deref...

PT-2025-30718 · Unknown · Deerwms Deer-Wms-2

Name of the Vulnerable Software and Affected Versions: deerwms deer-wms-2 versions up to 3.3 Description: A vulnerability exists in deerwms deer-wms-2 that allows for SQL injection. The issue is related to the manipulation of the paramsdataScope argument within the file...