PT-2025-7776 · Unknown +1 · Xone Web Monitor +1

Name of the Vulnerable Software and Affected Versions: XOne Web Monitor version 02.10.2024.530 XOne Web Monitor framework version 1.0.4.9 Description: The issue is a SQL injection vulnerability located in the login page, allowing attackers to extract all usernames and passwords via a crafted inpu...

PT-2025-28156

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to 1.9.24 Description: The issue allows an unauthenticated attacker to inject malicious JavaScript into the "v1/runs/ingest" endpoint by adding an empty citations field. This triggers a code path where...

PT-2025-7291 · Phpjabbers · Phpjabbers Car Park Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Car Park Booking System version 3.0 Description: The issue concerns multiple HTML injection vulnerabilities in the name, plugin sms api key, plugin sms country code, and title parameters. This allows for potential malicious code...

PT-2025-7440 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.2.2 Description: The issue concerns a Cross-Site Request Forgery CSRF attack through the Favorites component, which enables POST-based Cross-Site Scripting XSS. This allows for malicious actions to be performed on...

PT-2025-7602 · Libming · Libming

Name of the Vulnerable Software and Affected Versions: libming version 0.4.8 Description: Multiple memory leaks have been identified in the clip actions parsing functions, specifically parseSWF CLIPACTIONS and parseSWF CLIPACTIONRECORD, in util/parser.c of libming. These leaks allow attackers to...

PT-2025-7604

Name of the Vulnerable Software and Affected Versions Erlang OTP versions prior to 25.3.2.18 Erlang OTP versions prior to 26.2.5.9 Erlang OTP versions prior to 27.2.4 Description The issue arises from improper verification of packet size for SFTP packets. When multiple SSH packets are received,...

PT-2025-6703 · Unknown +1 · Fluent-Bit +1

Name of the Vulnerable Software and Affected Versions: Fluent Bit version 3.1.9 Description: An issue was discovered in Fluent Bit when the OpenTelemetry input plugin is running and listening on an IP address and port. A user with access to the endpoint can send a packet with Content-Length: 0 an...

PT-2025-6737 · Tp Link · Tp-Link Wr840N V6

Name of the Vulnerable Software and Affected Versions: TP-Link WR840N versions 0.9.1 4.16 and earlier Description: The issue is related to a lack of proper authentication procedure in the TP-Link WR840N router's firmware, allowing unauthorized individuals to bypass security restrictions. This can...

PT-2025-6917

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 135.0.1 Description: Memory safety bugs are present in Firefox, with some showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary...

PT-2025-6821 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM versions 5.13.0 and prior Description: A time-based blind SQL Injection vulnerability exists in the EditEventTypes functionality, allowing an attacker to execute arbitrary SQL queries. The newCountName parameter is directly...

PT-2025-7224 · Unknown · Alexvtn Content Snippet Manager

Name of the Vulnerable Software and Affected Versions: alexvtn Content Snippet Manager versions 1.1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-6764

Name of the Vulnerable Software and Affected Versions libarchive versions 3.7.7 and earlier Description The issue is a heap-based buffer over-read in the header gnu longlink function in archive read support format tar.c via a TAR archive. This occurs because the software mishandles truncation in...

PT-2025-6876

Name of the Vulnerable Software and Affected Versions jsonpath-plus versions prior to 10.3.0 Description The issue is caused by improper input sanitization, allowing an attacker to execute arbitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. This is a result of...

CVE-2023-26269

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX...

PT-2025-7122 · Unknown · Feminer Wms

Name of the Vulnerable Software and Affected Versions: FeMiner wms version 1.0 Description: The issue allows a remote attacker to obtain sensitive information through the parameters date1, date2, and id. This is due to a SQL injection vulnerability. Recommendations: For FeMiner wms version 1.0,...

PT-2025-25284

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs DocumentServer version 8.3.1 and earlier Description The issue is a reflected cross-site scripting XSS problem that occurs when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST...

PT-2025-7051

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.11, 3.0.12, and 3.1.11 Description Rack provides an interface for developing web applications in Ruby. The issue occurs when a server intentionally or unintentionally allows a user creation with the username containi...

PT-2025-6257 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.4 through 7.2.8 FortiOS versions 7.4.0 through 7.4.4 Description: A stack-based buffer overflow vulnerability in the implementation of the Control and Provisioning of Wireless Access Points CAPWAP protocol in FortiOS is...

PT-2025-6260 · Fortinet · Forticlient

Name of the Vulnerable Software and Affected Versions: FortiClient versions 7.4.0 through 7.0.13 and earlier Description: The issue is related to improper access control, which may allow a local user to escalate their privileges via the FortiSSLVPNd service pipe. This could potentially be exploit...

PT-2025-6254 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: FortiSIEM versions 6.7 through 7.1 Description: The issue is related to multiple improper neutralization of input during web page generation, also known as cross-site scripting. This may allow an authenticated attacker to perform a cross-site...