CVE-2025-0756

Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. CWE-99 Description Hitachi Vantara Pentaho Data Integration & Analytics...

UBUNTU-CVE-2025-3644

A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify...

CVE-2025-2470

The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nslregistrationstoreextrainput'...

PT-2025-17900 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6.1.3 Description: The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trust...

PT-2025-17905 · Entrust · Entrust Corp Printer Manager

Name of the Vulnerable Software and Affected Versions: Entrust Corp Printer Manager versions D3.18.4-3 and below Description: An issue in the Printer Manager System of Entrust Corp Printer Manager allows attackers to execute a directory traversal via a crafted POST request. Recommendations: For...

PT-2025-17870 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: A low-privileged user can elevate their privileges by creating new users and roles. Recommendations: For Sherpa Orchestrator version 141851, consider restricting the ability of low-privileged...

PT-2025-17871 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows for stored XSS attacks by an administrator through the name parameter when adding or updating licenses. The XSS payload can execute when the license expires. Recommendations: Fo...

PT-2025-17885 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: The Icegram Express WordPress plugin versions prior to 5.7.50 Description: The issue concerns the Icegram Express WordPress plugin, which does not properly sanitise and escape some of its Template settings. This could allow high-privilege...

PT-2025-17872 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows an authenticated user to perform multiple time-based blind SQL injections. This affects several API endpoints, including "api/gui/asset/list", "api/gui/files/export/csv/",...

PT-2025-17891 · Quantum · Quantum Stornext Web Gui Api +3

Name of the Vulnerable Software and Affected Versions: StorNext RYO versions prior to 7.2.4 StorNext Xcellis Workflow Director versions prior to 7.2.4 ActiveScale Cold Storage versions prior to 7.2.4 Quantum StorNext Web GUI API versions prior to 7.2.4 Description: The issue allows potential...

PT-2025-17940 · Netscout · Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue is related to a Broken Authorization Schema for the report module. This means that there is a flaw in how authorization is handled, potentially allowing unauthorized...

PT-2025-17944 · Netscout · Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue concerns a Sensitive File Accessible Without Proper Authentication to an endpoint. No information is provided about the estimated number of potentially affected devices...

SUSE CVE-2025-31363

Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira...

Prompt Injection

github.com/mattermost/mattermost-server is vulnerable to prompt injection. The vulnerability is due to insufficient domain restriction to the AI plugin's Jira tool, allowing authenticated users to exfiltrate data from arbitrary servers via crafted prompts...

PT-2025-17850

Name of the Vulnerable Software and Affected Versions h11 versions prior to 0.16.0 Description h11 is a Python implementation of HTTP/1.1. A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This...

PT-2025-17734 · Unknown · Code-Projects Online Class/Exam Scheduling System

Name of the Vulnerable Software and Affected Versions: Code-Projects Online Class and Exam Scheduling System version 1.0 Description: A vulnerability was found in the file /Scheduling/pages/class save.php, where manipulation of the class parameter can lead to SQL injection attacks. Recommendation...

PT-2025-17721 · WordPress · Usedesk

Name of the Vulnerable Software and Affected Versions: FuseDesk plugin for WordPress versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via the successredirect parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-17682 · WordPress · Mang Board Wp

Name of the Vulnerable Software and Affected Versions: Mang Board WP plugin versions up to, and including, 1.8.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the board header and board footer parameters. This allows...

PT-2025-17736 · Unknown · Online Class/Exam Scheduling System

Name of the Vulnerable Software and Affected Versions: Online Class and Exam Scheduling System version 1.0 Description: A vulnerability has been discovered in the code, affecting some unknown features in the file /Scheduling/pages/class sched.php. Manipulating the class parameter can lead to...

PT-2025-17769 · Animate · Animate

Name of the Vulnerable Software and Affected Versions: Animate versions n/a through 0.5 Description: A Server-Side Request Forgery SSRF issue allows for Server Side Request Forgery. This issue is related to the Animate software. Recommendations: For Animate versions n/a through 0.5, consider...