CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled

Mattermost versions 10.1.x = 10.1.3, 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access ...

CVE-2025-1629: Improper Restriction of Excessive Authentication Attempts

A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vend...

PT-2025-7700

Name of the Vulnerable Software and Affected Versions vTiger CRM version 6.4.0 Description A problematic issue has been identified, affecting the /modules/Mobile/index.php file. The manipulation of the operation argument leads to cross-site scripting. This issue can be exploited remotely...

PT-2025-7689 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version 1.0 Description: A vulnerability was found in the Add Role Page component, specifically in the file /admin/Operations/Role.php. The issue is related to the manipulation of the assign...

CVE-2024-13818

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This...

PT-2025-16809 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: A SQL injection vulnerability has been identified in the affected application through the internally used Authenticate method. This could allow an unauthenticated remote attacker...

CVE-2024-12276: Improper Neutralization of Special Elements used in an SQL Command

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection via filenames in all versions up to, and including, 2.9.2 due to insufficient escaping on the user supplied parameter...

PT-2025-26483

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions 7.0.0 through 10.0.0 Description: The issue allows a specially crafted request or proxy to bypass the design of DNN Login IP Filters, enabling login attempts from IP addresses not in the allow list. This has...

PT-2025-7439 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.2.2 Description: The issue is a stored Cross-Site Scripting XSS vulnerability in the Tools page of Nagios XI. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored an...

PT-2025-7539 · Dell · Dell Recoverpoint For Virtual Machines

Name of the Vulnerable Software and Affected Versions: Dell Recover Point for Virtual Machines version 6.0.X Description: The issue is related to weak file system permissions. A low-privileged local attacker could potentially exploit this, impacting only non-sensitive resources in the system...

PT-2025-7442 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.2.2 Description: The issue allows unauthenticated users to access multiple pages that display the usernames and email addresses of all current users. This is an Information Disclosure vulnerability. Recommendations: F...

PT-2025-7600 · Libming · Libming

Name of the Vulnerable Software and Affected Versions: libming version 0.4.8 Description: A memory leak has been identified in the parseSWF DEFINESCENEANDFRAMEDATA function in util/parser.c, which allows attackers to cause a denial of service via a crafted SWF file. Recommendations: For libming...

WordPress Yoast SEO Plugin < 22.7 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...

PT-2025-7591

Name of the Vulnerable Software and Affected Versions DDSN Interactive cm3 Acora CMS version 10.1.1 Description The issue concerns an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the...

PT-2025-7623 · Unknown · Oxyno-Zeta/S3-Proxy

Name of the Vulnerable Software and Affected Versions: oxyno-zeta/s3-proxy versions prior to 4.18.1 Description: A Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session...

PT-2025-6950 · Unknown · Age Verification For Your Checkout Page

Name of the Vulnerable Software and Affected Versions: Age Verification for your checkout page Verify your customer's identity version 1.20.0 Description: The web application dynamically generates web content without validating the source of potentially untrusted data. This issue is located in th...

Authelia 安全漏洞

Authelia is an open source single sign-on multi-factor portal for web applications by Authelia. A security vulnerability exists in Authelia versions prior to 4.38.19, which stems from a flaw in the login restriction mechanism, leading to an increased risk of brute force break-in...

PT-2025-16978 · D Link · D-Link Dir 832

Name of the Vulnerable Software and Affected Versions: D-Link DIR 832x version 240802 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the target addr key value and the 0x41710c function. Recommendations: For D-Link DIR 832x version 240802, as a...

The vulnerability of the Mobile Security Framework (MobSF) for mobile application security research lies in an incorrect pathname limitation, which allows a malicious actor to gain unauthorized access for reading, deleting protected information, and executing arbitrary code.

The vulnerability of the Mobile Security Framework MobSF for mobile application security research is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to read, delete protected information...

PT-2025-7484 · Openvsx · Openvsx

Name of the Vulnerable Software and Affected Versions: OpenVSX versions v0.9.0 through v0.20.0 Description: The issue allows a user to edit all namespace details, including name, description, website, support link, and social media links, even if the user is not a namespace Owner or Contributor...