PT-2025-5852 · Emoncms · Emoncms

Name of the Vulnerable Software and Affected Versions: Emoncms versions 11.6.9 and later Description: A SQL Injection vulnerability exists due to improper handling of user-supplied input in the data query parameter. This allows attackers to execute arbitrary SQL commands under specific conditions...

PT-2025-5851

Name of the Vulnerable Software and Affected Versions mitmweb versions 11.1.1 and below mitmproxy versions 11.1.1 and below Description A malicious client can use mitmweb's proxy server to access mitmweb's internal API, potentially leading to remote code execution. The mitmproxy and mitmdump tool...

CVE-2022-1803

Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2...

CVE-2022-42478

An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...

CVE-2022-42341

Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction...

CVE-2022-24847

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can...

CKAN has an XSS vector in user uploaded images in group/org and user profiles

Impact Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions...

CVE-2024-1539

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API...

CVE-2024-29033

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized access to a JupyterHub. The...

CVE-2024-45049

Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying...

CVE-2024-24761

Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to...

PT-2025-5724 · Kemp · Loadmaster

Name of the Vulnerable Software and Affected Versions: LoadMaster versions 7.2.48.12 and earlier LoadMaster versions 7.2.49.0 through 7.2.54.12 LoadMaster versions 7.2.55.0 through 7.2.60.1 ECS versions prior to 7.2.60.1 Description: The issue is related to improper input validation, allowing OS...

PT-2025-5783 · Ibm · Ibm Aspera Shares

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6 Description: The issue allows an attacker to spoof their IP address, which is then written to log files, due to improper verification of Client-IP headers. Recommendations: For versions 1.9....

PT-2025-5722 · Kemp · Ecs +2

Name of the Vulnerable Software and Affected Versions: LoadMaster versions 7.2.55.0 through 7.2.60.1 LoadMaster versions 7.2.49.0 through 7.2.54.12 LoadMaster version 7.2.48.12 and all prior versions Multi-Tenant Hypervisor version 7.1.35.12 and all prior versions ECS versions prior to 7.2.60.1...

PT-2025-5727 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions prior to the fixed version Description: A command injection vulnerability exists in the iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands...

PT-2025-5714 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software versions prior to the fixed version Cisco IOS XE Software versions prior to the fixed version Description: A vulnerability in the SNMP subsystem could allow an authenticated, remote attacker to cause a DoS condition on an...

PT-2025-5611 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions up to and including 2.20 Description: An unrestricted project deletion vulnerability in reNgine allows attackers with specific roles, such as penetration tester or auditor, to delete all projects in the system. This can lead ...

PT-2025-2113

Name of the Vulnerable Software and Affected Versions Musicbox WordPress plugin versions 2.0.3 and earlier Description The issue arises from the Musicbox WordPress plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting...

The vulnerability of the Craft CMS content management system lies in the improper restriction on the path to the restricted catalog. This allows a hacker to execute arbitrary code or perform Server Side Template Injection (SSTI) attacks.

The vulnerability of the Craft CMS content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform Server Side Template Injection attacks...

PT-2025-4389

Name of the Vulnerable Software and Affected Versions Admiror Gallery extension for Joomla version branch 4.x Description The issue arises from improper handling of input variables, leading to multiple path traversal vulnerabilities. This allows unauthorized access to sensitive files and...