Withdrawn Advisory: bun vulnerable to OS Command Injection

Withdrawn Advisory This advisory has been withdrawn because it does not describe a vulnerability in Bun itself. See the following rejection message from the CVE Numbering Authority: Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with th...

PT-2025-30536 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A flaw exists in Samsung Electronics MagicINFO 9 Server that allows code injection through the unrestricted upload of files with dangerous types. Recommendations: Update MagicINFO 9...

PT-2025-30538 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A path traversal vulnerability exists in Samsung Electronics MagicINFO 9 Server, potentially allowing for code injection. The issue stems from an improper limitation of a pathname to...

PT-2025-30537 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: A code injection issue exists due to the unrestricted upload of files with dangerous types. This allows for potential code execution. Recommendations: Update to version 21.1080.0...

PT-2025-30522 · Unknown · Real-Time Bus Tracking System

Name of the Vulnerable Software and Affected Versions: Real-time Bus Tracking System versions prior to 1.1 Description: Improper validation of the specified quantity in input exists in the Real-time Bus Tracking System. If exploited, an attacker who can access the administrative page of the...

PT-2025-30609 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.10 through 18.0.5 GitLab CE/EE versions 18.1 through 18.1.3 GitLab CE/EE versions 18.2 through 18.2.1 Description: An issue exists in GitLab CE/EE that, under specific circumstances, could allow a successful attacker ...

PT-2025-30619 · Robocode · Robocode

Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.23.18 and below Description: Roo Code, an AI-powered autonomous coding agent, does not validate line breaks in its command input. This bypasses the allow-list mechanism due to a lack of parsing or validation logic,...

PT-2025-30555 · Invision Power Board · Invision Community

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The software contains a reflected cross-site scripting issue in the oauth/callback endpoint. Recommendations: Update to a version later than 5.0.7. As a temporary workaround, consid...

PT-2025-30571

Name of the Vulnerable Software and Affected Versions HotelRunner B2B versions prior to 04.06.2025 Description An open redirect issue exists in HotelRunner B2B, potentially allowing forceful browsing through URL redirection to untrusted sites. Recommendations Update HotelRunner B2B to version...

CVE-2025-54137

The CVE-2025-54137 entry pertains to HAX CMS NodeJS. Affected versions are 11.0.9 and earlier, which were shipped with hardcoded default credentials for user and superuser accounts and default JWT private keys. Installation does not prompt for credential/secret changes, and there is no UI path to...

GHSA-X9HG-5Q6G-Q3JR Ollama vulnerable to Cross-Domain Token Exposure

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint...

Powermail extension for TYPO3 allows Insecure Direct Object Reference

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0...

GHSA-RC5F-3HFV-JXP2 Femanager extension for TYPO3 allows Insecure Direct Object Reference

The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0...

WordPress Support Board <= 3.8.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Support Board versions = 3.8.0...

Regular Expression Denial Of Service (ReDoS)

@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression handling in the parseJSONLikeConfig API's input parsing, which allows an attacker to trigger excessive backtracking...

MAL-2025-6157 Malicious code in dc-dependencyv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1bceba71bc1fb5763544f1b3d59a2e3700738d0e6293319a1b3d20b3e3d3956 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6180 Malicious code in mydealer-configuration-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a6c72b4ebdfecd3ab01a485711a49a10423d88ba0231b62418227c458a78a2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-30428 · Chaindesk · Chaindesk

Name of the Vulnerable Software and Affected Versions: Chaindesk versions through 2025-05-26 Description: A stored Cross-Site Scripting XSS vulnerability exists in the agent chat component. An attacker can execute arbitrary client-side scripts by creating an AI agent with a system prompt designed...

PT-2025-30427 · Unknown · Chatplayground.Ai

Name of the Vulnerable Software and Affected Versions: ChatPlayground.ai versions through 2025-05-24 Description: A self Cross-Site Scripting XSS issue exists that allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG file contents sent through the chat...

PT-2025-30475 · Unknown · Vigi Nvr2016H-16Mp +1

Name of the Vulnerable Software and Affected Versions: VIGI NVR1104H-4P versions prior to 1.1.5 Build 250518 VIGI NVR2016H-16MP versions prior to 1.3.1 Build 250407 Description: An unauthenticated OS command injection vulnerability exists in VIGI NVR systems. Recommendations: Update VIGI...