setuptools: Path Traversal Vulnerability in setuptools PackageIndex

A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of...

PT-2025-28126 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A vulnerability was found in the Function Management Module, affecting the processing of the file /intranet/educar funcao det.php?cod funcao=COD&ref cod instituicao=COD. The manipulation of the...

PT-2025-28142 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /users/check availability.php. The manipulation of the email argument leads to SQL...

PT-2025-28254 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A problematic issue has been found in the system, affecting some unknown functionality of the file /panel/search-appointment.php. This issue leads to cross site scripting an...

PT-2025-28208 · Campcodes · Campcodes Online Recruitment Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Recruitment Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file "/admin/ajax.php?action=save vacancy". The manipulation of the ID argument leads to SQ...

PT-2025-28139 · Utt · Utt Hiper 840G

Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue has been found in the processing of the file /goform/formPictureUrl. The manipulation of the importpictureurl argument leads to buffer overflow. This issue can be...

PT-2025-28272 · Unknown · Campcodes Advanced Online Voting System

Name of the Vulnerable Software and Affected Versions: Campcodes Advanced Online Voting System version 1.0 Description: A critical issue has been discovered, allowing for unrestricted file upload by manipulating the photo argument in an unknown function of the /admin/candidates add.php file. This...

PT-2025-28089 · Comodo · Comodo Internet Security Premium

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical vulnerability has been found in the Update Handler component of Comodo Internet Security Premium, leading to improper certificate validation. The attack can be...

PT-2025-28090 · Comodo · Comodo Internet Security Premium

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical vulnerability was found in the Manifest File Handler component of Comodo Internet Security Premium, affecting the file cis update x64.xml. This issue leads to improp...

PT-2025-28020

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic vulnerability was found in HDF5, affecting the function H5FS sinfo serialize node cb of the file src/H5FScache.c. This vulnerability leads to a heap-based buffer overflow. Local access is require...

PT-2025-28024 · Iroad · Iroad Dashcam Q9

Name of the Vulnerable Software and Affected Versions: IROAD Dashcam Q9 up to 20250624 Description: A vulnerability has been found in the component MFA Pairing Request Handler, affecting an unknown functionality. The manipulation leads to allocation of resources. The attack needs to be done withi...

PT-2025-27593 · WordPress · Amazon Products To Woocommerce

Name of the Vulnerable Software and Affected Versions: Amazon Products to WooCommerce plugin for WordPress versions prior to 1.2.8 Description: The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. This can be used to query an...

Buffer Under-read

Overview Affected versions of this package are vulnerable to Buffer Under-read via the gettmpfile function of glib/gfileutils.c due to improper validation of file path lengths during temporary file operations. An attacker can manipulate file paths and access unauthorized data by supplying symboli...

SUSE CVE-2025-6297

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

CVE-2025-6297

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

AZL-64641 CVE-2025-6297 affecting package dpkg 1.20.10-1

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

DEBIAN-CVE-2025-6297

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

UBUNTU-CVE-2025-6297

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

CVE-2025-6297 dpkg-deb: Fix cleanup for control member with restricted directories

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

CVE-2025-6297

The CVE-2025-6297 issue affects the dpkg-deb component, where improper sanitization of directory permissions when extracting a control member into a temporary directory can leave temporary files and lead to DoS via disk quota exhaustion or full disks. Affected: dpkg- and debian-based tooling acro...