PT-2025-17264 · Symisc · Unqlite

Name of the Vulnerable Software and Affected Versions: symisc UnQLite versions up to 957c377cb691a4f617db9aba5cc46d90425071e2 Description: A critical vulnerability was found in symisc UnQLite, affecting the jx9MemObjStore function in the /data/src/benchmarks/unqlite/unqlite.c file. This issue lea...

PT-2025-17295 · 74Cms · 74Cms

Name of the Vulnerable Software and Affected Versions: 74cms versions 3.33 and earlier Description: The issue concerns remote code execution RCE in the background interface apiadmin. Recommendations: For versions 3.33 and earlier, update to a version later than 3.33 to resolve the issue. As a...

PT-2025-20915 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A buffer overflow issue was discovered via the addrPoolEnd parameter in the "formDhcpv6s" interface. Recommendations: For TOTOLINK A3002R version 4.0.0-B20230531.1404, as a temporary...

PT-2025-17335 · Redoxos · Redoxos

Name of the Vulnerable Software and Affected Versions: redoxOS relibc versions before commit 98aa4ea5 Description: The issue allows a local attacker to cause a denial of service via the setsockopt function. Recommendations: For versions before commit 98aa4ea5, consider disabling the setsockopt...

PT-2025-17301 · Ibm · Ibm I +1

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 Description: The issue is caused by improper neutralization of HTTP header content by IBM Navigator for i, allowing an authenticated user to manipulate the host header in HTTP requests. This can lead to changing...

PT-2025-17314 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions prior to 2.1.4 Description: The issue is related to SQL injection by providing an unexpected square bracket GET parameter syntax. This syntax refers to the structure ?param0=a&param1=b&param2=c utilized by PHP, which is...

DEBIAN-CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

UBUNTU-CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

SUSE CVE-2025-2830

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...

PT-2025-17202 · Unknown · Pydio Core

Name of the Vulnerable Software and Affected Versions: Pydio Core versions 8.2.5 and earlier Description: The issue is related to Cross Site Scripting XSS via the New URL Bookmark feature. This allows for potential malicious script execution. Recommendations: For Pydio Core versions 8.2.5 and...

PT-2025-17221 · Unknown · Dragonflydb Dragonfly

Name of the Vulnerable Software and Affected Versions: DragonflyDB Dragonfly versions 1.28.2 and earlier Description: The issue allows authenticated users to cause a denial of service, resulting in a daemon crash, by utilizing a Lua library command that references a large negative integer...

CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

Nullsoft Scriptable Install System 安全漏洞

Nullsoft Scriptable Install System is a specialized open source system from the Nullsoft team for creating Windows installers. A security vulnerability exists in Nullsoft Scriptable Install System versions prior to 3.11, which stems from an improperly created temporary plug-in directory that coul...

PT-2025-17225 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Phone Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Phone Management System. This issue affects the main function of the Password Handler component. The manipulation of...

PT-2025-17083 · Unknown · Videowhisper Paid Videochat Turnkey Site

Name of the Vulnerable Software and Affected Versions: videowhisper Paid Videochat Turnkey Site versions n/a through 7.3.11 Description: The issue is related to a Weak Password Recovery Mechanism for Forgotten Password, which allows password recovery exploitation. Recommendations: For versions n/...

PT-2025-18287 · NetGear · Netgear Wnr2000V2

Name of the Vulnerable Software and Affected Versions: Netgear JWNR2000v2 version 1.0.0.11 Description: A critical issue was found in the function sub 435E04, where the manipulation of the host argument leads to command injection. This issue can be exploited remotely. The vendor was contacted abo...

PT-2025-16876 · Pgbouncer +3 · Pgbouncer +3

Name of the Vulnerable Software and Affected Versions: PgBouncer versions prior to 1.24.1 Description: The issue allows an attacker to log in with an already expired password due to PgBouncer's auth query not considering Postgres's VALID UNTIL value. This enables the use of passwords past their...

CVE-2025-3617

A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit...