PT-2025-30250 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: versions prior to 2.3 Description: A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command. Recommendations:...

PT-2025-30345 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJs versions 11.0.7 and below Description: HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. The NodeJS version of HAX CMS has a disabled Content Security Policy CSP in versions 11.0.7 and below...

PT-2025-30341

Name of the Vulnerable Software and Affected Versions Starlette versions 0.47.1 and below Description Starlette is a lightweight ASGI framework/toolkit for building async web services in Python. When parsing multi-part forms with large files exceeding the default maximum spool size, Starlette...

PT-2025-30291 · Unknown +1 · Strongswan +1

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-WLC100P version 2.03b03 Description: The i dont care about security and use aggressive mode psk option is enabled in the strongSwan configuration file, allowing IKE Responders to use IKEv1 Aggressive Mode with Pre-Shared Keys. Th...

Malicious code in grayavatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a840f69e770a8a7f48a5cd9ce41432db11d5c5f9f0cc48c3d64dda80c93fad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

PT-2025-30168 · Portabilis · I-Educar 2.9.0

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic issue exists due to cross site scripting. The manipulation of the argument Deficiência ou Transtorno within the file /intranet/educar deficiencia lst.php of the Disabilities Module...

PT-2025-30156 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.20-dev Description: Pluck CMS contains a flaw that allows an authenticated attacker to upload or create a crafted PHP file within the albums module directory. This file can then be accessed through the module routing log...

PT-2025-30132

Name of the Vulnerable Software and Affected Versions Work The Flow File Upload plugin for WordPress versions up to and including 2.5.2 Description The Work The Flow File Upload plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

PT-2025-30047 · Xuxueli · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in Xuxueli xxl-job. The commandJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to OS command injection. This...

PT-2025-30044 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in xxl-job. The httpJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to server-side request forgery SSRF. This...

PT-2025-30045 · Unknown · File Manager

Name of the Vulnerable Software and Affected Versions: Filemanager version 2.5.0 Description: An arbitrary file upload vulnerability exists in the /rsc/filemanager.rsc.class.php component. Attackers can execute arbitrary code by uploading a crafted SVG file. Recommendations: Filemanager version...

PT-2025-30093 · Unknown +1 · Qbittorrent +1

Name of the Vulnerable Software and Affected Versions: qBittorrent versions prior to 5.1.2 Description: qBittorrent does not prevent access to a local file referenced in a link URL. This issue affects the rsswidget.cpp and searchjobwidget.cpp files. Recommendations: Update qBittorrent to version...

PT-2025-30001 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions up to and including 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection due to a missing capability check on the b1 run query API endpoint. This allows authenticated attackers...

PT-2025-29943 · Lenovo · Lenovo Vantage

Name of the Vulnerable Software and Affected Versions: Lenovo Vantage affected versions not specified Description: Lenovo Vantage contains an improper validation issue that may allow a local attacker to execute code with elevated permissions by modifying an application configuration file...

PT-2025-29966 · Unknown +1 · Goldendict +1

Name of the Vulnerable Software and Affected Versions: GoldenDict versions 1.5.0 through 1.5.1 Description: GoldenDict versions 1.5.0 and 1.5.1 contain a dangerous method that allows reading and modifying files. This occurs when a user adds a crafted dictionary and then searches for any term...

CVE-2025-53640

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...

PT-2025-29827

Name of the Vulnerable Software and Affected Versions Vue I18n versions 9.0.0 through 9.14.4 Vue I18n versions 10.0.0 through 10.0.7 Vue I18n versions 11.0.0 through 11.0.9 Description Vue I18n, an internationalization plugin for Vue.js, contains a flaw in the escapeParameterHtml: true option. Th...

PT-2025-29731 · Yaysmtp · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP versions n/a through 1.5 Description: YaySMTP contains a SQL injection flaw. The flaw is due to improper neutralization of special elements used in an SQL command. Recommendations: Versions prior to 1.6 are affected...