CVE-2025-48461

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

CVE-2025-48467

Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability...

CVE-2025-48469

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation...

PT-2025-26843 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical issue has been identified, affecting the file /php action/createBrand.php. The manipulation of the brandStatus argument leads to SQL injection. This issue can be...

CVE-2025-48470

CVE-2025-48470 is a stored cross-site scripting (XSS) vulnerability affecting Advantech devices (notably WISE-4010LAN, WISE-4050LAN, WISE-4060LAN per CNNVD). The issue allows an attacker to inject malicious scripts into device fields, which can execute in other users’ browsers and potentially lea...

CVE-2025-48469

CVE-2025-48469 is an unauthenticated firmware upload vulnerability widely described across multiple feeds. The initial entry states that a successful exploit could allow an unauthenticated attacker to upload firmware through a public update page, potentially enabling backdoor installation or priv...

CVE-2025-48468

CVE-2025-48468 centers on an open JTAG debug port that, with physical access, lets an attacker inject or modify firmware. Multiple connected sources tie this to Advantech industrial controllers (e.g., WISE-4010LAN, WISE-4050LAN, WISE-4060LAN) and describe the root cause as reliance on a JTAG inte...

CVE-2025-48461 Weak Session Cookie Entropy

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

Exploit for Allocation of Resources Without Limits or Throttling in Openbsd Openssh

CVE-2025-26466 Metasploit module OpenSSH versions 9.5p1 to...

QNAP File Station 5 Resource Management Error Vulnerability

QNAP File Station 5 is a file management system from Taiwan, China-based QNAP Technology QNAP. A resource management error vulnerability exists in QNAP File Station 5, which arises from an unrestricted resource allocation and can be exploited by an attacker to prevent other systems from accessing...

PT-2025-26607

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...

PT-2025-26654 · Unknown · Sifusm/Mzzyg Bd S1

Name of the Vulnerable Software and Affected Versions: SIFUSM/MZZYG BD S1 up to 20250611 Description: A vulnerability was found in the component RTSP Live Video Stream Endpoint, leading to improper access controls. Access to the local network is required for this attack to succeed. The exploit ha...

CVE-2025-6457

A vulnerability, which was classified as critical, was found in code-projects Online Hotel Reservation System 1.0. This affects an unknown part of the file /reservation/demo.php. The manipulation of the argument Start leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-6401 TOTOLINK N300RH HTTP POST Message formFilter denial of service

A vulnerability was found in TOTOLINK N300RH 6.1c.1390B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message Handler. The manipulation of the argument url leads to denial of service. The exploit has been...

PT-2025-26344 · Unknown · Wanotifier

Name of the Vulnerable Software and Affected Versions: WANotifier versions through 2.7.7 Description: The issue is related to a Missing Authorization vulnerability in WANotifier, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For versions...

Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the Cisco AnyConnect service on an affected device. This vulnerability is due to...

CVE-2025-4820

CVE-2025-4020 (CVE-2025-4820) affects the Cloudflare quiche library. The issue is an incorrect congestion window growth caused by an opportunistic ACK attack (RFC 9000, §21.4) that can allow a victim to send more data in flight than the path supports. An unauthenticated remote attacker can comple...

CVE-2025-30642

A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service DoS situation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

Dover Fueling Solutions ProGauge MagLink LX consoles

RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker gaining control of the monitoring device, manipulating fueling operations, deleting system configurations, or deploying malware. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

Various ABB products information leakage vulnerability

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...