PT-2025-17904 · Andamiro · Andamiro Pump It Up 20Th Anniversary

Name of the Vulnerable Software and Affected Versions: Andamiro Pump It Up 20th Anniversary aka Double X or XX/2019 versions 1.00.0 through 2.08.3 Description: The issue allows a physically proximate attacker to cause a denial of service, resulting in an application crash, via certain deselect...

PT-2025-17942 · Unknown · Ngeniusone

Name of the Vulnerable Software and Affected Versions: nGeniusONE versions prior to 6.4.0 b2350 Description: The issue is related to Stored Cross-Site Scripting XSS that can be triggered via a certain POST parameter. This allows an attacker to inject malicious scripts into the application...

PT-2025-17939 · Netscout · Ngeniusone

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE versions prior to 6.4.0 b2350 Description: The issue allows local users to leverage Insecure Permissions for the nGeniusCLI File, potentially leading to unauthorized access or modifications. Recommendations: For versions...

PT-2025-17872 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows an authenticated user to perform multiple time-based blind SQL injections. This affects several API endpoints, including "api/gui/asset/list", "api/gui/files/export/csv/",...

PT-2025-18080 · Dell · Dell Powerprotect Data Manager Reporting

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect Data Manager Reporting versions 19.17 through 19.18 Description: The issue is related to improper encoding or escaping of output, which could be exploited by an attacker with high privileges and local access to inject...

PT-2025-22270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the pds core's adminq. The adminq is protected by the adminq lock, but completions happen in a different context, allowi...

PT-2025-17795 · Unknown · Michael Cannon Flickr Shortcode Importer

Name of the Vulnerable Software and Affected Versions: Michael Cannon Flickr Shortcode Importer versions n/a through 2.2.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 2.2.3, update to a version...

PT-2025-17848 · Vestel · Vestel Ac Charger

Name of the Vulnerable Software and Affected Versions: Vestel AC Charger version 3.75.0 Description: The issue allows an attacker to access files containing sensitive information, such as credentials, which could be used to further compromise the device. This vulnerability could enable remote...

PT-2025-17720 · WordPress · Buddypress Force Password Change

Name of the Vulnerable Software and Affected Versions: Buddypress Force Password Change plugin for WordPress versions up to, and including, 0.1 Description: The issue allows for authenticated account takeover due to improper validation of a user's identity prior to updating their password through...

PT-2025-17702 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.10 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0 Description: The issue arises from the failure to properly validate the props used by the RetrospectivePost custom...

PT-2025-17638 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version V15.03.05.14 multi Description: The issue is a stack overflow vulnerability in the "/goform/WifiWpsStart" API endpoint, which may lead to remote arbitrary code execution. Recommendations: For Tenda ac9 version V15.03.05.14...

PT-2025-17659 · Drupal · Ueditor

Name of the Vulnerable Software and Affected Versions: Drupal UEditor versions . Description: The issue affects UEditor - 百度编辑器, a component of Drupal. Recommendations: For Drupal UEditor version . , update to a version that includes a fix for this issue, as no specific workaround is provided...

CVE-2025-32960

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code ...

CVE-2025-32961

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name...

CVE-2025-32961 CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name...

CVE-2025-32951 io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends...

CVE-2025-32964 ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension would be automatically disabled even if the user did not hold the ManageWiki-restricted right. This issue has been patched in commit 00bebea. ...

CVE-2025-32964

CVE-2025-32964 affects the ManageWiki MediaWiki extension. The root cause: before commit 00bebea, enabling a conflicting extension could cause a restricted extension to be auto-disabled even if the user lacked the ManageWiki-restricted right. The issue has been patched in commit 00bebea. Practica...

CVE-2025-32950 io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server...

GHSA-HG25-W3VG-7279 XSS in the /download Endpoint of the JPA Web API

Impact The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be...