PT-2025-31456 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.56 Description: Attackers with administrative access can overwrite policy rules without the necessary permissions. The issue impacts the confidentiality and availability of subsequent systems, and h...

PT-2025-31341 · Bma · Bma

Name of the Vulnerable Software and Affected Versions: BMA affected versions not specified Description: The BMA login interface allows arbitrary JavaScript or HTML to be written directly into the page’s Document Object Model DOM via the error= URL parameter. This can lead to potential cross-site...

PT-2025-31251 · Unknown · Phpgurukul Nipah Virus Testing Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Nipah virus NiV Testing Management System version 1.0 Description: phpgurukul Nipah virus NiV Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of...

PT-2025-31221 · Grandstream Networks · Gxp1628

Name of the Vulnerable Software and Affected Versions: Grandstream Networks GXP1628 versions 1.0.4.130 and earlier Description: The Grandstream Networks GXP1628 device is susceptible to incorrect access control due to directory listing being enabled. This allows unauthorized access to sensitive...

PT-2025-31124 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A reflected cross-site scripting XSS issue existed on the agentpushPreset page. Recommendations: Update to TeamCity version 2025.07 or later...

PT-2025-31096 · Beamsec · Beamsec Phishpro

Name of the Vulnerable Software and Affected Versions: Beamsec PhishPro versions prior to 7.5.4.2 Description: An incorrect use of privileged APIs allows for privilege abuse in Beamsec PhishPro. Recommendations: Update Beamsec PhishPro to version 7.5.4.2 or later...

PT-2025-31156 · Appliance · Appliance

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized access to appliance configuration import functionality, potentiall...

PT-2025-31018 · Code Projects · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical vulnerability exists due to a SQL injection issue. The vulnerability is located in an unknown functionality of the file /user/dashboard.php. Manipulation of the phone...

PT-2025-30630 · Medtronic · Mycarelink Patient Monitor

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains a built-in user account with no password. This allows an attacker with physical access to log in...

CVE-2025-8069

CVE-2025-8069 affects AWS Client VPN Windows client. The installation process reads an OpenSSL configuration file from an unprotected directory (C:\usr\local\windows-x86_64-openssl-localbuild\ssl), allowing a non-admin user to insert malicious config. If an admin starts the installer, that code c...

PT-2025-30617 · Pinokio · Pinokio

Name of the Vulnerable Software and Affected Versions: Pinokio version 3.6.23 Description: A URL redirection issue exists in Pinokio version 3.6.23, allowing attackers to redirect users to attacker-controlled pages. Recommendations: Update Pinokio to a newer version that addresses this issue...

PT-2025-30515 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop plugin for WordPress versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to unauthenticated registration bypass. The /users/register API endpoint is publicly exposed and unconditionally...

PT-2025-30533 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: The software contains an Improper Restriction of XML External Entity Reference vulnerability that allows Server Side Request Forgery. Recommendations: Update MagicINFO 9 Server to...

PT-2025-30508 · Unknown · Pcl Community Edition

Name of the Vulnerable Software and Affected Versions: PCL Plain Craft Launcher Community Edition versions 2.12.0-beta.5 through 2.12.0-beta.9 Description: PCL Plain Craft Launcher Community Edition is a Minecraft launcher. Versions 2.12.0-beta.5 through 2.12.0-beta.9 inadvertently record login...

PT-2025-30494 · Duracomm · Duracomm Spm-500 Dp-10In-100-Mu

Name of the Vulnerable Software and Affected Versions: DuraComm SPM-500 DP-10iN-100-MU affected versions not specified Description: The device lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device. Recommendation...

PT-2025-30495 · Duracomm · Duracomm Spm-500 Dp-10In-100-Mu

Name of the Vulnerable Software and Affected Versions: DuraComm SPM-500 DP-10iN-100-MU affected versions not specified Description: The device transmits sensitive data without encryption, potentially allowing attackers to intercept it. Recommendations: At the moment, there is no information about...

PT-2025-30471

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability,...

PT-2025-30394 · Typo3 · Powermail

Name of the Vulnerable Software and Affected Versions: powermail versions 12.0.0 through 12.5.2 powermail version 13.0.0 Description: The powermail extension for TYPO3 contains an Insecure Direct Object Reference issue that allows for the download of arbitrary files from the webserver...

LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

LibreNMS 25.6.0 contains an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without...

PT-2025-30308 · Unknown · @Translated/Lara-Mcp

Name of the Vulnerable Software and Affected Versions: @translated/lara-mcp versions 0.0.11 and below Description: A command injection vulnerability exists in the @translated/lara-mcp MCP Server due to the unsanitized use of input parameters within a call to child process.exec. Successful...