PT-2025-5363 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.55417 Description: The issue is related to the exposure of permanent tokens in logs, potentially allowing an attacker to obtain encrypted user credentials. This could be exploited through the...

PT-2025-1498 · Homarr · Homarr

Name of the Vulnerable Software and Affected Versions: Homarr versions prior to 0.14.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Notebook widget. Recommendations: For versions prior to 0.14.0, update to versio...

PT-2025-3860 · Hashicorp +1 · Go-Slug +1

Name of the Vulnerable Software and Affected Versions: HashiCorp go-slug versions prior to 0.16.3 Description: The go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This occurs because the unpacking step improperly...

PT-2025-4256 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The vulnerability in the MySQL Server product of Oracle MySQL, specifically in the Server: Performance Schema...

PT-2025-3857 · WordPress · Jetelements

Name of the Vulnerable Software and Affected Versions: JetElements plugin for WordPress versions up to, and including, 2.7.2.1 Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output...

PT-2025-4277 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the InnoDB component of MySQL Server, allowing an attacker with elevated privileges and...

PT-2025-4275 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.25 Oracle Database Server versions 21.3 through 21.16 Oracle Database Server versions 23.4 through 23.6 Description: The issue is related to the Java VM component of Oracle Database Server, wher...

The vulnerability of the LibreOffice office software package arises from incorrect restrictions on the path to the restricted access directory. This allows attackers to gain read, modify, or delete access to data.

The vulnerability of the LibreOffice office software package is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

PT-2025-4280 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the InnoDB component of MySQL Server, allowing an attacker with high privileges and networ...

PT-2025-4253 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to a component called InnoDB in MySQL Server, which can be exploited by an attacker with high...

The vulnerability of the Mitel MiCollab collaboration platform, related to an incorrect restriction on the path name to the restricted access catalog, allows a hacker to read arbitrary files.

The vulnerability of the Mitel MiCollab collaboration platform lies in an incorrect restriction on the path name used to access the restricted catalog. Exploiting this vulnerability could allow an attacker to read arbitrary files...

CVE-2025-21632 x86/fpu: Ensure shadow stack is active before "getting" registers

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace...

IBM Jazz for Service Management 安全漏洞

IBM Jazz for Service Management is an integrated service management product from International Business Machines IBM that provides visibility into the service management environment. An Access Control Error vulnerability exists in IBM Jazz for Service Management that stems from improper access...

PT-2025-1233 · Spagobi · Spagobi

Name of the Vulnerable Software and Affected Versions: SpagoBI version 3.5.1 Description: The issue is related to the script input feature of SpagoBI, which allows arbitrary code execution. This is due to the lack of measures to neutralize special elements used in the command input field...

PT-2025-3394 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.0 Description: The issue is related to Cross Site Scripting XSS via the dados addInfo parameter of the "documentos funcionario.php" endpoint. This allows for potential malicious script injection. Recommendations: F...

PT-2025-3938 · Unknown · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical issue has been found in the system, allowing for remote SQL injection attacks. The manipulation of the m id argument in the file /dashboard/admin/new submit.php leads to this...

PT-2025-3934 · Code Projects · Admission Management System

Name of the Vulnerable Software and Affected Versions: code-projects Admission Management System version 1.0 Description: A critical issue was found in the Admission Management System. The problem affects an unknown functionality of the file /signupconfirm.php. The manipulation of the in eml...

The vulnerability of the Ivanti EPM endpoint management software lies in the improper restriction of path names in the catalog, which allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Ivanti EPM endpoint management software is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2025-3941 · Codezips · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical vulnerability has been found in Codezips Gym Management System. This affects an unknown part of the file /dashboard/admin/edit mem submit.php. The manipulation of the argument...

PT-2025-1626 · Unknown · Truefiling

Name of the Vulnerable Software and Affected Versions: TrueFiling versions prior to 3.1.112.19 Description: TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters, and self-represented filers collect public legal documentation into cases. Th...