PT-2025-28224 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file /panel/schedule-staff.php. The manipulation of the staff id argument leads to SQL injection. It is...

PT-2025-28255 · Kestra · Kestra

Name of the Vulnerable Software and Affected Versions: Kestra versions prior to 0.22.0 Description: The issue concerns an event-driven orchestration platform where the error message in the execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP responses...

PT-2025-28140 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /users/index.php. The manipulation of the Username argument leads to sql injection. T...

PT-2025-28471 · Ibm · Ibm Sterling File Gateway

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.6 IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.4 Description: The issue could disclose sensitive installation directory information to an authenticated user, which could be...

PT-2025-28219 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3 Description: A critical issue was identified in WeGIA, a web manager for charitable institutions. The /html/funcionario/profile funcionario.php endpoint is vulnerable due to the id funcionario parameter not being...

PT-2025-28147 · Unknown · Gavias Halpes

Name of the Vulnerable Software and Affected Versions: Gavias Halpes versions prior to 1.2.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-28123 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic issue has been found in the Student Benefits Registration component, specifically in the file /intranet/educar aluno beneficio lst.php. The manipulation of the Benefício argument...

PT-2025-28204 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS comman...

PT-2025-28146 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file, where manipulation of the Username argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-28169 · Unknown · Campcodes Payroll Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Payroll Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /ajax.php?action=save employee attendance. The manipulation of the employee id argument lead...

PT-2025-28225

Name of the Vulnerable Software and Affected Versions: gnuboard5 version 5.5.16 Description: The issue is related to an open redirect vulnerability that allows a remote attacker to obtain sensitive information. This is due to insufficient URL parameter verification in the "bbs/logout.php" endpoin...

PT-2025-28231 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Splunk Cloud Platform versions prior to 9.3.2411.107 Splunk Cloud Platfor...

PT-2025-28227 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 version 5.5.16 Description: The issue allows a remote attacker to obtain sensitive information. This is achieved via the "bbs/member confirm.php" endpoint. Recommendations: For gnuboard5 version 5.5.16, consider restricting access t...

PT-2025-28164 · Unknown · Campcodes Payroll Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Payroll Management System version 1.0 Description: A critical issue has been found in the system, affecting the /ajax.php?action=calculate payroll file. The manipulation of the ID argument leads to SQL injection. This issue can be...

PT-2025-28272 · Unknown · Campcodes Advanced Online Voting System

Name of the Vulnerable Software and Affected Versions: Campcodes Advanced Online Voting System version 1.0 Description: A critical issue has been discovered, allowing for unrestricted file upload by manipulating the photo argument in an unknown function of the /admin/candidates add.php file. This...

PT-2025-28208 · Campcodes · Campcodes Online Recruitment Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Recruitment Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file "/admin/ajax.php?action=save vacancy". The manipulation of the ID argument leads to SQ...

PT-2025-28235 · Splunk · Splunk Enterprise +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.2 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Splunk Cloud Platform versions prior to 9.3.2411.104 Splunk Cloud Platfor...

PT-2025-28092 · Comodo · Comodo Internet Security Premium

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical issue has been found in the processing of the file cis update x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-7066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image except for...