CVE-2025-42961

CVE-2025-42961 involves SAP NetWeaver Application Server for ABAP, where a missing authorization check allows an authenticated user with high privileges to read sensitive data from database tables. The underlying issue is improper validation of user permissions leading to confidentiality impact (...

WordPress ads pro SQL injection vulnerability (CNVD-2025-15420)

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability that stems...

Ivanti Endpoint Manager SQL注入漏洞

Ivanti Endpoint Manager is a comprehensive endpoint management solution developed by Ivanti to manage all endpoint devices in an enterprise network. Ivanti Endpoint Manager suffers from a SQL injection vulnerability that originates from improperly filtered submitted SQL statements, which can be...

TencentOS Server 3: idm:DL1 (TSSA-2025:0505)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0505 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

ROS-20250703-12

A vulnerability in the HTTP Requests library of the Python Requests programming language is related to the fact that the library passes .netrc credentials to third parties for certain malicious URLs. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data...

CVE-2025-34052

Rejected reason: An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

PT-2025-27217 · Unknown · Raise The Money

Name of the Vulnerable Software and Affected Versions: Raise The Money versions n/a through 5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. Specifically, it is a DOM-Based XSS vulnerability, which allows...

PDF-XChange Editor Information Disclosure Vulnerability (CNVD-2025-16295)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An information disclosure vulnerability exists in PDF-XChange Editor, which is caused by a lack of proper validation of user-supplied data. An attacker could exploit this vulnerabilit...

Amazon Linux 2 : ipa (ALAS-2025-2901)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2901 advisory. A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default,...

CVE-2025-52474

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as...

CVE-2025-1987 Stored XSS in Psono-Client via Malicious Vault Entry URLs

A Cross-Site Scripting XSS vulnerability has been identified in Psono-Client’s handling of vault entries of type websitepassword and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious...

CVE-2025-1987

CVE-2025-1987 describes a stored XSS in Psono-Client via malicious vault entries (website_password and bookmark) with un sanitised URL fields, used in Bitdefender SecurePass. A crafted javascript: URL can execute in the browser when a user interacts with the entry, potentially accessing the user’...

CVE-2025-52474 WeGIA SQL Injection Vulnerability in id Parameter on control.php Endpoint

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as...

CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-4404 Freeipa: idm: privilege escalation from host to domain admin in freeipa

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-4404

CVE-2025-4404/7493 describe a privilege-escalation in FreeIPA: failure to validate the uniqueness of krbCanonicalName (admin@REALM, later root@REALM in some advisories) allows creation of services with the realm admin name and obtaining a Kerberos ticket that authenticates as admin, enabling admi...

CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...