PT-2025-17649 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description: A buffer overflow issue was discovered in the downloadFile.cgi endpoint through the v25 parameter. This allows for potential exploitation. Recommendations: For TOTOLINK A800R version...

PT-2025-17648 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description: A buffer overflow vulnerability was found in the downloadFile.cgi component. This issue affects the TOTOLINK A800R router. Recommendations: For version 4.1.2cu.5137 B20200730, as a...

PT-2025-17607 · WordPress · Wordpress Simple Shopping Cart

Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to and including 5.1.2 Description: The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the...

PT-2025-17674 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further...

PT-2025-17676 · Nih · Nih Brics

Name of the Vulnerable Software and Affected Versions: NIH BRICS aka Biomedical Research Informatics Computing System versions 14.0.0 through 14.0.0-67 Description: The issue allows unauthenticated users with a Common Access Card CAC to escalate privileges and compromise any account, including...

PT-2025-17653 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A buffer overflow issue was discovered in the downloadFile.cgi, specifically through the v14 and v3 parameters. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as ...

CVE-2025-32952

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files...

CVE-2025-32952 io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files...

GO-2025-3609 Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server...

CVE-2025-23250

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary file write. A successful exploit of this vulnerability might lead to code execution and data tampering...

Dust: Race Condition in Folder Creation Allows Bypassing Folder Limit

The application enforced a hard limit of 10 folders per user under a specific space. However, due to a race condition, it was possible to bypass this limit by sending multiple folder creation requests simultaneously after deleting one folder. This allowed creating more than 10 folders, breaking t...

CVE-2024-11299

CVE-2024-11299 (Memberpress for WordPress) affects WordPress Memberpress plugin versions up to and including 1.11.37. The issue is an unauthenticated content-restriction bypass via WordPress core search, enabling attackers to exfiltrate sensitive data from restricted posts (e.g., those limited to...

PT-2025-17565 · Unknown · Sacco Management System

Name of the Vulnerable Software and Affected Versions: Sacco Management system version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the password parameter at the "/sacco/ajax.php" API endpoint. Recommendations: For Sacco Management system version...

PT-2025-17578 · Tcpwave · Tcpwave Ddi

Name of the Vulnerable Software and Affected Versions: TCPWave DDI version 11.34P1C2 Description: The issue allows for Remote Code Execution via Unrestricted File Upload combined with Path Traversal. Recommendations: For TCPWave DDI version 11.34P1C2, consider restricting access to file upload...

PT-2025-17476 · H3C · H3C Gr-3000Ax

Name of the Vulnerable Software and Affected Versions: H3C GR-3000AX versions up to V100R006 Description: A critical vulnerability was found in the HTTP POST Request Handler component of H3C GR-3000AX. The affected function is EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit Li...

PT-2025-17518 · Unknown · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.10.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables attackers to...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

PT-2025-17583 · Labvantage · Labvantage

Name of the Vulnerable Software and Affected Versions: LabVantage versions prior to 8.8.0.13 HF6 Description: The issue allows local file inclusion, enabling authenticated users to retrieve arbitrary files from the environment. This is achieved via the objectname request parameter. Recommendation...

PT-2025-17506 · Codepeople · Codepeople Appointment Booking Calendar

Name of the Vulnerable Software and Affected Versions: codepeople Appointment Booking Calendar versions 1.3.92 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows SQL Injection in the codepeople Appointment Booking Calendar...

PT-2025-17585 · Unknown · Volmarg Personal Management System

Name of the Vulnerable Software and Affected Versions: Volmarg Personal Management System version 1.4.65 Description: A stored cross-site scripting XSS issue exists in the New Goal Creation section, allowing authenticated attackers to execute arbitrary web scripts or HTML by injecting a crafted...