PT-2025-27569 · Ullu · Ullu

Name of the Vulnerable Software and Affected Versions: Ullu versions 2.9.929 Android and 2.8.0 IOS Description: The issue is related to incorrect access control, allowing attackers to bypass the parental pin feature via unspecified vectors. Recommendations: For Ullu version 2.9.929 Android and...

CVE-2025-6297: Uncontrolled Resource Consumption

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and...

PT-2025-27548 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue has been discovered, affecting the file /process/eprocess.php, where the manipulation of the mailuid argument leads to SQL injection. This issue can be exploited...

PT-2025-27455

Name of the Vulnerable Software and Affected Versions: string-math version 1.2.2 Description: The issue is a Regex Denial of Service ReDoS that can be exploited via a crafted input. Recommendations: For string-math version 1.2.2, consider validating and sanitizing all inputs to prevent crafted...

PT-2025-27404 · Unknown · Phpgurukul Teachers Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teachers Record Management System version 2.1 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the tid argument leads to SQL...

PT-2025-27481 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the ID argument leads to SQL injection. This...

Insecure Temporary File Handling Vulnerability in llama-index-core

Description The getcachedir function in llama-index-core uses a predictable, hardcoded directory path /tmp/llamaindex on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct...

Directory Traversal

Overview langchain-chatchat is a Langchain-Chatchat formerly langchain-ChatGLM, local knowledge based LLM like ChatGLM, Qwen and Llama RAG and Agent app with langchain Affected versions of this package are vulnerable to Directory Traversal via the parsefile function in the...

PT-2025-27380

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue was found in the software, affecting an unknown functionality of the file /admin/testimonials/manage.php. The manipulation of the ID argument leads to SQL...

PT-2025-27357

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic issue was found in the function H5FL reg gc list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. Recommendations: For HDF5 version 1.14.6, as...

PT-2025-27382 · Unknown · Sourcecodester Simple Company Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Company Website version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /classes/Login.php. The manipulation of the Username argument leads to SQL injection. This issue can be...

PT-2025-27360

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A null pointer dereference issue was found in the function H5C flush single entry of the file src/H5Centry.c. The manipulation leads to this issue, and the attack needs to be approached locally. Recommendation...

PT-2025-27333

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207 Description: A critical issue was found in the outAddress function of the External Address Book Handler component, leading to SQL injection. The attack can be initiated...

PT-2025-27318

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue was found in the function H5O chunk protect of the file /src/H5Ochunk.c. This issue can be exploited locally. Recommendations: For HDF5 version 1.14.6, as a temporary...

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data...

PT-2025-27165 · Wow Company · Hover Effects

Name of the Vulnerable Software and Affected Versions: Wow-Company Hover Effects versions n/a through 2.1.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27145 · Hikvision · Hikvision Ds-2Cd1321-I

Name of the Vulnerable Software and Affected Versions: Hikvision DS-2CD1321-I version 5.7.21 build 230819 Description: The issue allows attackers to cause a Denial of Service DoS via sending a crafted POST request to the endpoint "/ISAPI/Security/challenge". Recommendations: For Hikvision...

PT-2025-27063 · WordPress · A/B Testing For Wordpress

Name of the Vulnerable Software and Affected Versions: A/B Testing for WordPress plugin versions up to and including 1.18.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on the id parameter in the...

PT-2025-27147 · Unknown · Sfturing Hosp Order

Name of the Vulnerable Software and Affected Versions: sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description: A critical issue was found in the getOfficeName function of the OfficeServiceImpl.java file, which is vulnerable to SQL injection through the manipulatio...

PT-2025-27043

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A heap-based buffer overflow issue has been found in the function H5O mtime new encode of the file src/H5Omtime.c. The manipulation leads to this issue, and attacking locally is a requirement. The exploit has...