Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

Summary field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a where clause with multiple...

PT-2025-19776 · Xinguan · Xinguan

Name of the Vulnerable Software and Affected Versions: Xinguan version 0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the "/system/user/findUserList" API endpoint, which allows attackers to access sensitive information by sending a crafted payload. Recommendations...

PT-2025-19782 · One · One

Name of the Vulnerable Software and Affected Versions: One version 1.0 Description: The issue is related to incorrect access control in the component "/api/user/manager" that allows attackers to access sensitive information via a crafted payload. Recommendations: For version 1.0, as a temporary...

PT-2025-19328 · Unknown · Newbee-Mall

Name of the Vulnerable Software and Affected Versions: newbee-mall version 1.0 Description: A critical vulnerability has been found in the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The...

PT-2025-19887 · Dell · Dell Storage Center +1

Name of the Vulnerable Software and Affected Versions: Dell Storage Center - Dell Storage Manager version 20.0.21 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This could allow an unauthenticate...

PT-2025-19781 · Unknown · Shiro-Action

Name of the Vulnerable Software and Affected Versions: Shiro-Action version 0.6 Description: The issue is related to incorrect access control in the component /user/list of Shiro-Action, allowing attackers to access sensitive information via a crafted payload. Recommendations: For Shiro-Action...

PT-2025-19759

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The ckpt path0 variable takes user input, such as a path to a model, and...

PT-2025-19771 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.31.0 through 2025.4.0 Description: The issue is related to missing validation in Mk:api, which allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. This is achieved by...

PT-2025-19747 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The variables exp dir1, among others, take user input and pass it to the cli...

PT-2025-19785 · Unknown · Production Ssm

Name of the Vulnerable Software and Affected Versions: production ssm version v0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the component /user/list, which allows attackers to access sensitive information via a crafted payload. Recommendations: For production ss...

PT-2025-19735 · Beyondtrust · Beyondtrust Privileged Remote Access

Name of the Vulnerable Software and Affected Versions: BeyondTrust Privileged Remote Access PRA versions prior to 25.1 Description: A local authentication bypass issue affects BeyondTrust Privileged Remote Access PRA. This allows a local authenticated attacker to view the connection details of a...

PT-2025-18952 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teacher Subject Allocation Management System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Teacher Subject Allocation Management System. The issue affects an unknown function of the file...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2025-27365)

Summary IBM MQ has addressed a denial of service vulnerability. Vulnerability Details CVEID:CVE-2025-27365 DESCRIPTION: An IBM MQ client connecting to an IBM MQ queue manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. CWE:CWE-416: Use After Free CVSS Source: IBM CVSS Base...

PT-2025-18765 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: Buddyboss Platform plugin for WordPress versions up to and including 2.8.50 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

PT-2025-18921 · Unknown +1 · Ublock Origin +1

Name of the Vulnerable Software and Affected Versions: uBlock Origin versions up to 1.63.3b16 Description: A vulnerability was found in uBlock Origin, classified as problematic. The function currentStateChanged of the file src/js/1p-filters.js of the component UI is affected. The manipulation lea...

PT-2025-18913 · Unknown · Phpgurukul Online Birth Certificate System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Birth Certificate System version 1.0 Description: A critical issue has been discovered, affecting the /admin/search.php file. The manipulation of the searchdata argument leads to SQL injection. This issue can be exploited...

PT-2025-18749 · WordPress +1 · Full – Cliente +2

Name of the Vulnerable Software and Affected Versions: FULL – Cliente plugin for WordPress versions 3.1.5 through 3.1.25 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform SQL Injection via the formId parameter due to insufficient escaping and...

PT-2025-18728 · Wangshen · Wangshen Secgate 3600

Name of the Vulnerable Software and Affected Versions: Wangshen SecGate 3600 version 2024 Description: A critical vulnerability was found in Wangshen SecGate 3600. The issue affects an unknown function of the file /?g=route ispinfo export save. The manipulation of the file name argument leads to...

PT-2025-18927 · Openvm · Openvm

Name of the Vulnerable Software and Affected Versions: OpenVM version 1.0.0 Description: The issue is related to an overflow vulnerability in the AUIPC instruction decomposition of the OpenVM framework. A typo in the code results in incorrect range checking of the highest limb of pc, leading to a...

PT-2025-18915 · Unknown · Phpgurukul Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: PHPGuruku Online DJ Booking Management System version 1.0 Description: A critical issue affects the processing of the file /admin/booking-bwdates-reports-details.php, where the manipulation of the fromdate argument leads to SQL injection. The...