PT-2025-12656 · Uguu · Uguu

Name of the Vulnerable Software and Affected Versions: Uguu versions 1.8.9 and earlier Description: The issue allows Cross Site Scripting XSS via JavaScript in XML files. Recommendations: For versions 1.8.9 and earlier, consider disabling JavaScript execution in XML files as a temporary workaroun...

PT-2025-12573 · Zhijiantianya · Ruoyi-Vue-Pro

Name of the Vulnerable Software and Affected Versions: zhijiantianya ruoyi-vue-pro version 2.4.1 Description: A critical issue has been found in the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the path argument leads to path traversal. The attac...

PT-2025-12703 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problem was found in the processing of the file /menu.jsp. The manipulation of the argument flag leads to cross-site scripting. The attack may be initiated remotely. Recommendations: For Yonyou...

PT-2025-12708 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: onos version 2.7.0 Description: The issue is related to limited secret space in LLDP packets, which can be exploited by attackers to obtain the private key via a brute force attack. Attackers can leverage this to create crafted LLDP packets...

PT-2025-12697 · Unknown · Phpgurukul Old Age Home Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Old Age Home Management System, affecting an unknown functionality of the file /admin/add-services.php. The...

The vulnerability of the _request_firmware() function in the drivers/base/firmware_loader/main.c kernel of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the requestfirmware function in the drivers/base/firmwareloader/main.c kernel of the Linux operating system is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2025-12698 · Unknown · Phpgurukul Old Age Home Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A critical vulnerability was found in PHPGurukul Old Age Home Management System, affecting some unknown functionality of the file /admin/bwdates-report-details.php. The...

PT-2025-12696 · Unknown · Phpgurukul Old Age Home Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A critical vulnerability was found in PHPGurukul Old Age Home Management System. The issue affects an unknown function of the file /admin/aboutus.php. The manipulation of the...

PT-2025-12528 · Unknown · Phpgurukul Art Gallery Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Art Gallery Management System version 1.0 Description: A vulnerability was found in the PHPGurukul Art Gallery Management System. It has been classified as problematic and affects an unknown function of the file /product.php. The...

PT-2025-12717

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to v1.11.5 ingress-nginx versions from v1.12.0-beta.0 through v1.12.1 Description A security issue exists in ingress-nginx where the auth-url Ingress annotation can be exploited to inject configuration into nginx...

PT-2025-12541

Name of the Vulnerable Software and Affected Versions SourceCodester AC Repair and Services System version 1.0 Description A critical issue has been identified, affecting the save users function in the /classes/Users.php file. The manipulation of the ID argument leads to SQL injection. This issue...

PT-2025-12544 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical vulnerability was found in Project Worlds Online Time Table Generator. This affects an unknown part of the file /student/index.php. The manipulation of the argumen...

PT-2025-12505 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: JIZHICMS versions up to 1.7.0 Description: A problematic issue was found in JIZHICMS, affecting an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 leads to...

Updated expat packages fix security vulnerability

Improper restriction of xml entity expansion depth in libexpat. CVE-2024-8176 NOTE: upstream deemed this fix incomplete after it was initially pushed. The complete fix was submitted along with the fix for CVE-2025-59375...

Apache Oozie Cross-Site Scripting (XSS)

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2024-9612

In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end doe...

CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796

Apache Oozie is vulnerable to Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. The root cause is a lack of effective filtering and escaping of user-supplied data, which allows an attacker to inject and execute malicious scripts or HTML. This vulne...

CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...