PT-2025-25751

Name of the Vulnerable Software and Affected Versions: Sitecore PowerShell Extensions versions through 7.0 Description: Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager XM and Experience Platform XP, is vulnerable to an unrestricted file upload issue. A remote, authenticat...

PT-2025-25680 · Mapsvg · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions prior to 8.5.32 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and potential control o...

CVE-2025-40916

The Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl is vulnerable to the use of a cryptographically weak pseudo-random number generator (PRNG) . The software utilizes the built-in rand() function to generate both the captcha text and image noise , which is predictable and insecure. This fla...

PT-2025-28135 · Git +1 · Maven-Model

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The software experiences a security exception during operation. The crash state involves the java.base/java.lang.StringUTF16.newBytesFor function,...

PT-2025-25542 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System version 6.2.0 Description: A critical issue was found in the API component of the system, specifically affecting the /Reservations/Search file. The manipulation of the Value argument leads to SQL injection. This...

PT-2025-25539

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling furthe...

PT-2025-25425 · Drupal · Drupal Bookable Calendar

Name of the Vulnerable Software and Affected Versions: Drupal Bookable Calendar versions 0.0.0 through 2.2.12 Description: The issue is related to a Missing Authorization vulnerability in Drupal Bookable Calendar, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 2.2.12,...

PT-2025-25540

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows an unauthenticated remote attacker to read files from the system’s file...

PT-2025-25495 · Ibm · Ibm Mq Operator +2

Name of the Vulnerable Software and Affected Versions: IBM MQ Operator LTS versions 2.0.0 through 2.0.29 IBM MQ Operator CD versions 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3 IBM MQ Operator SC2 versions 3.2.0 through 3.2.12 Description: The issue allows t...

PT-2025-25416

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue is related to hardcoded credentials for the Service Account. Recommendations For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique, secu...

PT-2025-25373 · WordPress · The Color Palette

Name of the Vulnerable Software and Affected Versions: The Color Palette plugin for WordPress versions up to, and including, 4.3.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-25314 · Sick Ag · Sick Field Analytics

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering. Recommendations: At the moment, there is no information about ...

PT-2025-25321 · Sick Ag · Sick Media Server

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a login mechanism that does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromise the server. Recommendations...

PT-2025-25322 · Sick Ag · Sick Field Analytics

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users ...

PT-2025-25298 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A cross-site scripting issue is mentioned, but details are not provided. No information is available about the estimated number of potentially affected devices or real-world incidents...

PT-2025-25303 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: General information about the issue is not available. No details are provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue wa...

PT-2025-25311

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue is related to insufficient measures to prevent multiple failed authentication attempts within a short time frame, making the product susceptible to brute-force attacks. Recommendatio...

PT-2025-25319 · Sick Ag · Sick Field Analytics +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The application fails to implement several security headers, which are crucial for increasing the overall security level of the web application. These headers help prevent Clickjacking attac...

PT-2025-25342 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.55 Description: The issue is related to insufficient input validation in the warehouse component. Attackers with system administrator permissions can impair the availability of the Secure Access...

PT-2025-25287 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.7 through 17.10.8 GitLab CE/EE versions 17.11 through 17.11.4 GitLab CE/EE versions 18.0 through 18.0.2 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11...