The vulnerability of Azure AI Document Intelligence, a cloud-based AI service, arises from an incorrect restriction on the path to the restricted access catalog. This allows attackers to escalate their privileges.

The vulnerability of Azure AI Document Intelligence cloud service is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

PT-2025-21963 · WordPress · Wpfactory Additional Custom Emails & Recipients For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Additional Custom Emails & Recipients for WooCommerce versions 3.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for...

PT-2025-22101 · WordPress · Elbisnero Wordpress Events Calendar Registration & Tickets

Name of the Vulnerable Software and Affected Versions: elbisnero WordPress Events Calendar Registration & Tickets versions 2.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for...

PT-2025-21824 · Totolink · Totolink N300Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RH version 6.1c.1390 B20191101 Description: A critical issue affects the function CloudACMunualUpdateUserdata of the file "/cgi-bin/cstecgi.cgi". The manipulation of the url argument leads to command injection. This issue can be...

PT-2025-21870 · D Link · D-Link Di-7003Gv2

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A problematic issue has been found, affecting the function sub 48F4F0 of the file /H5/versionupdate.data. This leads to information disclosure and can be exploited remotely...

PT-2025-21868 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /pages/payment.php. The manipulation of the cid argument leads to SQL injection. This issue...

PT-2025-21845 · Unknown · Phpgurukul News Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal Project version 4.1 Description: A critical issue was found in the PHPGurukul News Portal Project, affecting some unknown functionality of the file /admin/contactus.php. The manipulation of the pagetitle argument leads ...

[ASA-202505-8] nodejs-lts-iron: multiple issues

Arch Linux Security Advisory ASA-202505-8 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2025-23165 CVE-2025-23166 CVE-2025-23167 Package : nodejs-lts-iron Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2873 Summary ======= T...

PT-2025-21841 · Unknown · Sourcecodester Restaurant Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Restaurant Management System version 1.0 Description: A critical issue was found in the itsourcecode Restaurant Management System, affecting the /admin/menu save.php file. The manipulation of the menu argument leads to SQL...

PT-2025-21825 · Totolink · Totolink N300Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RH version 6.1c.1390 B20191101 Description: A critical vulnerability has been found in the TOTOLINK N300RH router. This issue affects the setUnloadUserData function of the /cgi-bin/cstecgi.cgi file. The manipulation of the plugin...

PT-2025-21851 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07.26A1 Description: A critical vulnerability affects the function ctxz asp of the file /ctxz.asp in the Connection Limit Page component. The manipulation of the argument def/defTcp/defUdp/defIcmp/defOther leads to a...

PT-2025-21863 · Sourcecodester · Sourcecodester Doctors Appointment System

Name of the Vulnerable Software and Affected Versions: SourceCodester Doctors Appointment System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Doctors Appointment System. This issue affects some unknown processing of the file /admin/delete-session.php. The...

PT-2025-21872 · D Link · D-Link Di-7003Gv2

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 version 24.04.18D1 R68125 Description: A vulnerability has been found in the D-Link DI-7003GV2, affecting the function sub 41F0FC of the file /H5/webgl.data. This issue leads to information disclosure and can be initiated...

PT-2025-21856 · Code Projects · Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A critical vulnerability was found in the code-projects Pharmacy Management System. This affects the function medicineType::take order of the component "Add Order Details". The...

PT-2025-21857 · Unknown · Code-Projects Courier Management System

Name of the Vulnerable Software and Affected Versions: code-projects Tourism Management System version 1.0 Description: A critical vulnerability has been found in the code-projects Tourism Management System. This issue affects the AddUser function of the User Registration component. The...

PT-2025-21850 · Unknown · Sourcecodester Restaurant Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Restaurant Management System version 1.0 Description: A critical issue affects an unknown part of the file /admin/team update.php. The manipulation of the team argument leads to SQL injection. It is possible to initiate the attac...

PT-2025-21867 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue affects the processing of the file /pages/transaction update.php in Campcodes Sales and Inventory System. The manipulation of the ID argument leads to SQL injectio...

PT-2025-21846 · Unknown · Campcodes Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: Campcodes Online Shopping Portal version 1.0 Description: A critical issue has been identified, affecting the /forgot-password.php file, where manipulation of the email argument leads to SQL injection. This can be initiated remotely...

PT-2025-21826 · Totolink · Totolink N300Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RH version 6.1c.1390 B20191101 Description: A critical vulnerability was found in the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack c...

CVE-2024-8031

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...