PT-2025-23332 · Unknown · Phpgurukul/Campcodes Cyber Cafe Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul/Campcodes Cyber Cafe Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /bwdates-reports-details.php. The manipulation of the fromdate and todate arguments leads to SQL...

PT-2025-23298

Name of the Vulnerable Software and Affected Versions City Referential Manager versions 3DEXPERIENCE R2025x Description A stored Cross-site Scripting XSS issue affects City Discover within City Referential Manager. Exploitation allows an attacker to execute arbitrary script code within a user's...

Tenable Nessus Network Monitor < 6.5.1 Multiple Vulnerabilities (TNS-2025-10)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-30466

A security vulnerability in Safari allows a website to bypass the Same Origin Policy . The underlying cause was addressed through improved state management . This issue is fixed in Safari 18.4 , iOS 18.4 , iPadOS 18.4 , macOS Sequoia 15.4 , and visionOS 2.4 .

CVE-2025-31263

A memory handling issue in macOS (versions prior to 15.4 ) could allow an application to corrupt coprocessor memory . This vulnerability is addressed in macOS Sequoia 15.4 through improved memory handling. No specific exploit details or attack vectors are provided in the documentation. Users are ...

CVE-2025-47288 Discourse Policy plugin private group members visible

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1....

CVE-2025-47288 Discourse Policy plugin private group members visible

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1....

CVE-2025-46823 OpenMRS has Vulnerability in FHIR2 Module Privileges

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

CVE-2025-48057

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate function can be tricked into incorrectly treating certificates as vali...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...

CVE-2025-48475

CVE-2025-48475 affects FreeScout prior to version 1.8.180. The issue arises from missing checks on which "clients" an authorized user can view or edit, allowing a user without access to any mailboxes or conversations to view/edit the System’s clients. The root cause is the absence of enforcement ...

CVE-2025-48474

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with showonlyassignedconversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have...

CVE-2025-48389

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the ge...

CVE-2025-48473

CVE-2025-48473 affects FreeScout prior to v1.8.179: when creating a conversation from a message in another conversation, the system does not validate that the user has view permissions, allowing access to arbitrary messages across mailboxes/conversations. The restriction enforced by show_only_ass...

CVE-2025-48473 FreeScout Vulnerable to Insufficient Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other...

CVE-2025-48472 FreeScout Vulnerable to Insufficient Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have...

CVE-2025-48389 FreeScout Vulnerable to Deserialization of Untrusted Data

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the ge...

CVE-2025-48389

CVE-2025-48389 affects FreeScout prior to version 1.8.178. The issue arises from deserialization of untrusted data when using the set function to pass a serialized object string, and deserialization occurs when retrieving an option via the get method, enabling arbitrary code execution. This vulne...

CVE-2025-37998

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in outputuserspace This patch replaces the manual Netlink attribute iteration in outputuserspace with nlaforeachnested, which ensures that only well-formed attributes are processed...