CVE-2025-53840

Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not b...

CVE-2025-53840

Icinga DB Web contains an exposure in versions 1.2.0–1.2.1 where users with access to Dependency Views could see hosts and services they should not, due to improper access control on dependency views (filter/hosts and filter/services). The object name is not revealed and access to a host or servi...

PT-2025-29714 · Scati · Scati Vision Web

Name of the Vulnerable Software and Affected Versions: SCATI Vision Web versions 4.8 through 7.2 Description: A SQL injection issue exists in SCATI Vision Web. This vulnerability allows an attacker to exfiltrate data from the database via the login parameter in the /scatevision...

PT-2025-29856 · Cisco · Cisco Ise +1

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description: A flaw exists in the IP Access Restriction feature that may allow an authenticated, remote attacker to bypass configured IP access restrictio...

PT-2025-29771 · Eclipse · Eclipse Glassfish

Name of the Vulnerable Software and Affected Versions: Eclipse GlassFish versions 6.2.5 and later Description: Eclipse GlassFish is susceptible to a Server Side Request Forgery SSRF attack affecting specific endpoints. SSRF occurs when an attacker can induce the server to make requests to...

Cisco Identity Services Engine (cisco-sa-ise-multi-3VpsXOxO)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a...

PT-2025-30152 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the fromqossetting function of the /goform/qossetting file. Manipulation of the page argument results in a stack-based buffer overflow, allowing for remote exploitation...

PT-2025-29578 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.38 10.3.30 Description: A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the share name parameter. Recommendations: Apply update...

PT-2025-29542 · WordPress · Restrict File Access

Name of the Vulnerable Software and Affected Versions: Restrict File Access plugin for WordPress versions up to and including 1.1.2 Description: The Restrict File Access plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2025-30062 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the formWebTypeLibrary function within the /goform/webtypelibrary file. Manipulation of the webSiteId argument can lead to a stack-based buffer overflow, allowing for remote...

The vulnerability of the NetMRI network monitoring program lies in the improper restriction of the path name to the restricted access directory, allowing attackers to read arbitrary files.

The vulnerability of the NetMRI network monitoring program lies in the improper restriction of the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

PT-2025-29464 · Avl Rooms · Avl Rooms

Name of the Vulnerable Software and Affected Versions: AVL Rooms version 1.0 Description: A critical issue exists in AVL Rooms that allows for SQL injection. The vulnerability is located in the /city.php file, where manipulation of the city argument can trigger the attack remotely. The exploit fo...

PT-2025-29472 · Code Projects · Mobile Shop

Name of the Vulnerable Software and Affected Versions: code-projects Mobile Shop version 1.0 Description: A critical issue exists in code-projects Mobile Shop 1.0, affecting unknown code within the /login.php file. The email parameter is susceptible to SQL injection, allowing for remote...

PT-2025-29434 · Phpgurukul · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue exists in PHPGurukul Online Fire Reporting System version 1.2 related to SQL injection. The vulnerability is located in the processing of the /admin/add-team.ph...

PT-2025-29497 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection issue via the lgid parameter at the SEMCMS Link.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Link.php file to...

The vulnerability of the graphical SFTP and SCP client for the Windows operating system, WinSCP, arises from incorrect path name restrictions for access-controlled directories. This allows attackers to create a special file and control its path on a remote server.

The vulnerability of the graphical SFTP and SCP client programs for the Windows operating system is related to incorrect path name restrictions for access to restricted directories. Exploiting this vulnerability allows an attacker to create a special file and control its path on a remote server...

PT-2025-29470 · Code Projects · Electricity Billing System

Name of the Vulnerable Software and Affected Versions: code-projects Electricity Billing System version 1.0 Description: A critical issue exists in code-projects Electricity Billing System version 1.0. The vulnerability is due to a SQL injection flaw within the /user/change password.php file...

The vulnerability of the PHP Snappy library relates to incorrect restrictions on the path to the restricted directory. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the PHP Snappy library is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to local files and directories on the server when...

PT-2025-29495 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability. The vulnerability is located in the pid parameter at the SEMCMS Quanxian.php file. Recommendations: As a mitigation, restrict access to the SEMCMS...

PT-2025-29496 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the ID parameter at the SEMCMS Link.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Link.php fil...