CVE-2025-5898

A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parsevariablesoption of the file utilities/pspp-convert.c. The manipulation leads to out-of-bounds write. The attack needs to be approached locally. The exploit has...

CVE-2025-32291

CVE-2025-32291 concerns an Unrestricted Upload of File with Dangerous Type in WordPress SUMO Affiliates Pro. The connected documents confirm a vulnerability in SUMO Affiliates Pro (versions up to 10.7.0, with references noting the plugin family) that could allow uploading malicious files. CVSSv3....

CVE-2025-47608 WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through = 2.5...

Insertion Of Sensitive Information Into Log Files

com.erudika, para-server is vulnerable to Insertion Of Sensitive Information Into Log Files. The vulnerability is due to logging full request URLs, including sensitive access tokens, in WARN-level logs during failed Facebook profile requests. It allows an attacker with access to the logs or log...

CVE-2025-5855 Tenda AC6 SetRebootTimer formSetRebootTimer stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda AC6 15.03.05.16. This affects the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely...

CVE-2024-55585

In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword...

The vulnerability of the LZ4_decompress_generic() function in the lib/lz4/lz4_decompress.c file, which is part of the lz4 compression module for Linux kernel, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the LZ4decompressgeneric function in the lib/lz4/lz4decompress.c module relates to the reutilization of previously freed memory in Linux kernel-based compression algorithms. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, an...

PT-2025-24395 · Unknown · Phpgurukul Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Maid Hiring Management System version 1.0 Description: A critical issue was found in the PHPGurukul Maid Hiring Management System. This issue affects an unknown part of the file /admin/search-booking-request.php. The manipulation o...

CVE-2025-3461 ON Semiconductor Quantenna Telnet Missing Authentication

The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This issue affects Quantenna Wi-Fi chipset through versi...

CVE-2024-56342

IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

Over 20 Malicious Apps on Google Play Target Users for Seed Phrases

Over 20 malicious apps on Google Play are stealing crypto seed phrases by posing as trusted wallets and exchanges, putting users' funds at risk...

PT-2025-24348 · Mops App +1 · Mops App +1

Name of the Vulnerable Software and Affected Versions: moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618 Description: The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in...

CVE-2025-29885

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...

CVE-2025-24776 WordPress Responsive Flipbooks <= 1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in codelobster Responsive Flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Responsive Flipbooks: from n/a through 1.0...

CVE-2025-39358

Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through = 1.3.12...

CVE-2024-22330

CVE-2024-22330 affects IBM Security Verify Governance ISVG 10.0.2 where default password policy does not require strong passwords, exposing accounts to compromise. Public metrics indicate a high-impact CVSS 3.1 base score (9.8) with network attack vector and no user interaction. IBM remediation r...

PT-2025-24321 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version 15.03.06.47 Description: A critical issue has been found in the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the list argument leads to a buffer overflow. This issue can be exploited...

CVE-2025-49599

Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account to disable ONT firewall functionality, e.g., to remove the default blocking of the SSH and TELNET TCP ports, aka HWNO-56Q3...

PT-2025-24038 · WordPress · Freemind Viewer

Name of the Vulnerable Software and Affected Versions: Freemind Viewer plugin for WordPress versions up to and including 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'freemind' shortcode. This allows authenticated...

PT-2025-24115 · Codelobster · Codelobster Responsive Flipbooks

Name of the Vulnerable Software and Affected Versions: codelobster Responsive Flipbooks versions n/a through 1.0 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For...