PT-2025-24343 · Unknown · Phpgurukul Employee Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Employee Record Management System version 1.3 Description: A critical issue has been found in the PHPGurukul Employee Record Management System. The problem affects an unknown function of the file /admin/allemployees.php. Manipulati...

PT-2025-24604 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5232 B20210713 Description: A critical issue has been detected in the HTTP POST Request Handler component, specifically affecting an unknown functionality of the file /boafrm/formWsc. The manipulation of this...

GHSA-CVX7-X8PJ-X2GW CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

Summary A Denial of Service DoS vulnerability was discovered in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticate...

CVE-2025-31134

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server...

CVE-2025-47950 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...

CVE-2025-29885

CVE-2025-29885 refers to an improper certificate validation vulnerability affecting QNAP File Station 5 . The issue allows remote attackers who already have user access to potentially compromise system security. Technical details in the connected PT-2025-24304 entry specify affected versions: Fil...

CVE-2025-29871 File Station 5

An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later...

SUSE-SU-2025:01569-1 Security update for libraw

This update for libraw fixes the following issues: - CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp bsc1241643 - CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phaseonecorrect function bsc1241585 - CVE-2025-43963: Fixed...

PT-2025-24054 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache versions prior to the fixed version Description: A missing protection against path traversal allows access to any file on the server. This issue affects the Apache software, allowing unauthorized access to files. Recommendations: For...

PT-2025-24040 · WordPress · Runners Log

Name of the Vulnerable Software and Affected Versions: Runners Log plugin for WordPress versions up to, and including, 3.9.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-24132 · Unknown · Email Subscribe Form

Name of the Vulnerable Software and Affected Versions: Elastic Email Subscribe Form versions 1.2.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Elastic Email Subscribe Form, which allows exploitation due to incorrectly configured access control...

PT-2025-27294

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A vulnerability was found in HDF5, affecting the function H5O fsinfo encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local...

PT-2025-24035 · WordPress · Wp Email Debug

Name of the Vulnerable Software and Affected Versions: WP Email Debug plugin for WordPress versions 1.0 to 1.1.0 Description: The issue is related to a missing capability check on the WPMDBUG handle settings function. This allows unauthenticated attackers to enable debugging, send all emails to a...

PT-2025-24071 · Unknown · Code-Projects Traffic Offense Reporting System

Name of the Vulnerable Software and Affected Versions: code-projects Traffic Offense Reporting System version 1.0 Description: A issue was found in the code-projects Traffic Offense Reporting System, affecting some unknown functionality of the file /save-reported.php. The manipulation of the...

PT-2025-24216 · Sergiotrinity · Trinity Audio

Name of the Vulnerable Software and Affected Versions: sergiotrinity Trinity Audio versions through 5.20.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-24031 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats plugin for WordPress versions up to and including 1.0.0 Description: The issue allows authenticated attackers with Editor-level access or higher to inject additional SQL queries into existing ones, potentially extracting...

PT-2025-24015 · Sourcecodester · Sourcecodester Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A vulnerability was found in the Subjects Page component, specifically in an unknown function of the file /script/academic/subjects. The manipulation of the Subject...

PT-2025-24398 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version 15.03.06.47 Description: A critical issue was found, classified as critical, affecting the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to a stack-based...

CVE-2025-48999

DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, getUrlType retrieves hostName. Since the judgment statement returns false, it will not enter the if statement and will not ...

CVE-2025-49000

InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in label-sheet plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a...