PT-2025-17962

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3 Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in...

CVE-2025-24909

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and...

CVE-2025-0757

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and...

CVE-2025-32982

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module...

CVE-2025-32583

Improper Control of Generation of Code 'Code Injection' vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through = 2.4.0...

CVE-2025-39436

Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through = 1.0...

Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled...

GHSA-M367-445C-2XQR Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled...

GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

Summary A query cost restriction using the cost-limit can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the computeComplexity function, we have the following check for ignoreIntrospection option: ts i...

CVE-2025-32432 Craft CMS Allows Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

CVE-2025-3642 Moodle: authenticated remote code execution risk in the moodle lms equella repository

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled...

MAL-2025-3388 Malicious code in dowload_ebok_englens_spil_by_carlos_ruiz_zafon_iben_hasselbalch_lqvq8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a13704c12e7e39594e32a2fa929139780659e502c52a16c0d1e57c897b561c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by johska Patchstack Alliance in WordPress Plugin Author Box Plugin With Different Description versions = 1.3.5...

Validation Bypass

Fastify is vulnerable to validation bypass. The vulnerability is due to improper normalization and matching of the Content-Type header, allowing attackers to evade validation by altering casing or whitespace...

WordPress My Custom Widgets plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin My Custom Widgets versions = 2.0.5...

PT-2025-17922 · Jetbrains · Jetbrains Rider

Name of the Vulnerable Software and Affected Versions: JetBrains Rider versions prior to 2025.1.2 Description: The issue allows arbitrary file overwrite during a remote debug session due to a custom archive unpacker. Recommendations: For versions prior to 2025.1.2, update to version 2025.1.2 or...

PT-2025-17928 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: The issue concerns an access control flaw in Dify, an open-source LLM app development platform. This flaw allows non-admin users to make unauthorized access and changes to APPs, despite the web UI of...

PT-2025-17943 · Netscout · Netscout Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue concerns hardcoded credentials in NETSCOUT nGeniusONE that can be obtained from JAR files. Recommendations: For versions prior to 6.4.0 b2350, update to version 6.4.0...

PT-2025-29162 · Honeywell · Onewireless Wdm +1

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions 520.1 through 520.2 TCU9 Honeywell Experion PKS versions 530 through 530 TCU3 Honeywell OneWireless WDM versions 322.1 through 322.4 Honeywell OneWireless WDM versions 330.1 through 330.3 Description: The...

PT-2025-28381 · Unknown · Audio Service

Name of the Vulnerable Software and Affected Versions: LeAudioService versions prior to SMR Jul-2025 Release 1 Description: The issue is related to improper access control in LeAudioService, which allows local attackers to manipulate broadcasting Auracast. Recommendations: For versions prior to S...