Lucene search
+L
PtsecurityMost viewed

200088 matches found

Positive Technologies
Positive Technologies
•added 2026/06/08 12:0 a.m.•31 views

PT-2026-47618

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description An authorization issue in the Scheduler API allows authenticated non-admin users to create or modify scheduled actions that are restricted to administrators. The API fails to correctly enforce...

6.3CVSS5.6AI score0.00318EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/08 12:0 a.m.•31 views

PT-2026-47251

A vulnerability was found in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminDeleteAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public an...

7.5CVSS5.3AI score0.00275EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/07 12:0 a.m.•31 views

PT-2026-47171

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev name results in command injection. It is possible to initiate the attack...

7.5CVSS7.1AI score0.01572EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/06 12:0 a.m.•31 views

PT-2026-47133

Name of the Vulnerable Software and Affected Versions EmbedPress versions prior to 4.5.4 Description The EmbedPress plugin for WordPress is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. The issue occurs due to insufficient...

6.4CVSS5.7AI score0.00331EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-47006

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub 412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used...

6.5CVSS6.3AI score0.01044EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-46977

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely...

4.8CVSS3.6AI score0.0021EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-47052

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 10.0.3 Description An SQL injection allows an unauthenticated remote attacker to execute arbitrary SQL statements. This can result in the complete compromise of the underlying database. The issue requires no...

9.8CVSS6AI score0.00479EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-48904

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final Description Before reading the first request-line, the HttpObjectDecoder function silently skips all whitespace and every byte for which Character.isISOControlb is true...

5.3CVSS5.3AI score0.00232EPSS
SaveExploits0References56
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-46917

Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function...

4.8CVSS5.4AI score0.00084EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-46952

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service TCP port 9090 and the HTTP JSON-RPC endpoint /jsonrpc.js. The query accepts a folder parameter and lists its contents with no restriction to the...

6.9CVSS5.6AI score0.00294EPSS
SaveExploits2References3
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-46905

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways...

6.1CVSS5.5AI score0.00144EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-47037

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 11.0.3 Description A flaw in the access control logic allows an attacker to submit a crafted HTTPS POST request to set a session variable used for authorization decisions. In installations including the optional Job...

5.3CVSS5.5AI score0.00236EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-46924

Name of the Vulnerable Software and Affected Versions Samsung Auto versions prior to 3.1.2.61 in Android 15 Samsung Auto versions prior to 3.2.0.38 in Android 16 Description Improper export of android application components allows a local attacker to change the audio configuration. Recommendation...

4.8CVSS5.9AI score0.00084EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/05 12:0 a.m.•31 views

PT-2026-47051

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 11.0.3 Description An authenticated attacker can inject malicious JavaScript into their user profile and abuse the password reset functionality to send a link to an HTML page. When a victim visits this page, the...

8.6CVSS5.4AI score0.00147EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46210

Joomla com jsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field 2 parameter to delete...

7.1CVSS5.9AI score0.00327EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46257

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose log js errors to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The...

8.9CVSS5.7AI score0.00207EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46599

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 149.0.7827.53 Description A use after free issue in Base allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory by using a...

9.6CVSS5.8AI score0.00493EPSS
SaveExploits4References439
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46204

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint...

5.1CVSS5.8AI score0.00887EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46221

A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage student.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be us...

6.5CVSS6.5AI score0.002EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46223

A weakness has been identified in itsourcecode Fees Management System up to 1.0. Affected is an unknown function of the file /navbar.php. This manipulation of the argument page causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to t...

5.3CVSS4.3AI score0.00273EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46254

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A mass assignment issue exists in the user edit functionality. The application fails to sufficiently filter user-supplied fields in the UsersController::edit function, allowing it to accept a...

9CVSS5.4AI score0.00239EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46895

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier Description A stored Cross-Site Scripting XSS issue exists in the YouTubeAPI plugin. The plugin retrieves the snippet.title field from the YouTube Data API and renders it into the homepage gallery markup withou...

4.7CVSS6.1AI score0.00162EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46365

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

8.1CVSS5.2AI score0.00348EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46202

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to...

8.8CVSS6.1AI score0.00262EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46140

Name of the Vulnerable Software and Affected Versions FieldX MDM affected versions not specified Description The adb messaging topic passes unverified payloads directly into the Runtime.exec function, which enables command or instruction injection. Recommendations At the moment, there is no...

10CVSS5.9AI score0.00387EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46145

Name of the Vulnerable Software and Affected Versions ai cmd affected versions not specified Description The ai cmd utility executes with full root permissions and pipes socket inputs directly to the popen function. This allows unauthenticated users to execute arbitrary commands with root...

9.8CVSS6.1AI score0.00317EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46151

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet. Recommendations At the moment...

8.7CVSS5.9AI score0.00245EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46458

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description A heap buffer overflow exists in ANGLE, which is a compatibility layer that translates OpenGL ES calls to other graphics APIs. This issue allows a remote attacker who has...

9.6CVSS6.2AI score0.00493EPSS
SaveExploits2References437
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46238

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An issue in the dashboard widgets allows an authenticated user to manipulate the fields option to influence the data returned by the New Users and New Organisations widgets. When a requested fie...

5.3CVSS5.4AI score0.00176EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46182

Name of the Vulnerable Software and Affected Versions Forcepoint VPN Client versions prior to 6.11.4 Description A local privilege escalation issue in Forcepoint VPN Client for Windows allows a non-administrative user to gain SYSTEM privileges...

8.5CVSS5.9AI score0.00104EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46883

Name of the Vulnerable Software and Affected Versions stata-mcp affected versions not specified Description The stata do API and CLI contain a flaw where the log file name parameter is interpolated into a Stata command string without proper sanitization. This allows an attacker to break out of th...

9.3CVSS6.2AI score0.00302EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
•added 2026/06/04 12:0 a.m.•31 views

PT-2026-46396

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This...

6.9CVSS5.4AI score0.00282EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46014

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs file system where the block group tree dirty list can become corrupted. When the EXTENT TREE V2 incompat flag is set, the block group tree is unconditionally...

8.4CVSS5.8AI score0.00132EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46000

Mercusys AC12G EU V1 with firmware AC12GEU V1 200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...

5.8AI score0.00139EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-45956

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch...

7CVSS5.9AI score0.00346EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-45985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/panthor component where the memory subsystem can become blocked, causing flush operations to never complete. This state can be triggered by buggy GPU jobs...

6.8CVSS5.4AI score0.00147EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2026/06/03 12:0 a.m.•31 views

PT-2026-46085

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

8.1CVSS5.9AI score0.00416EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45867

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260227.0 Description An issue exists in the rendering of email-message observable body data where the content of the body field is not appropriately sanitized. This allows for Cross-Site Scripting XSS, a technique...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45763

Name of the Vulnerable Software and Affected Versions Progress Sitefinity versions 8.0.5700 through 13.3.7652 Description Insufficiently protected credentials in web services allow a remote authenticated attacker to obtain plain-text credentials used to connect to the Sitefinity Insight service...

8.7CVSS5.8AI score0.00319EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45754

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1...

8.1CVSS5.8AI score0.00255EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46492

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An integer overflow in V8 allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source high-performance JavaScript a...

9.6CVSS6.4AI score0.00456EPSS
SaveExploits2References438
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45789

Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations...

5.8AI score0.00138EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45877

Name of the Vulnerable Software and Affected Versions openSeaChest version 25.05.3 Description An out-of-bounds write exists in the --showSupportedFormats command. This occurs when a maliciously crafted NVMe device provides a bogus value in the namespace FLBAS byte, allowing one extra byte to be...

1.8CVSS5.8AI score0.00102EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45683

A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm state security mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an...

3.1CVSS5AI score0.00224EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45854

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.3 Description The WS-Federation provider in this open-source identity provider validates the user-supplied wreply parameter using a raw string prefix check instead of proper URL parsing. An attacker can craft...

6.9CVSS5.8AI score0.0019EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46834

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description A use after free issue in PDFium allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted PDF file. Use after free is a memory corruption flaw th...

9.6CVSS6.4AI score0.00985EPSS
SaveExploits2References441
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46665

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An uninitialized use in ANGLE Almost Native Graphics Layer Engine, a compatibility layer between OpenGL ES and native graphics APIs, allows a remote attacker to leak cross-origin data...

9.6CVSS5.8AI score0.00493EPSS
SaveExploits1References437
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-46493

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An integer overflow in V8 allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source high-performance JavaScript a...

9.6CVSS6.4AI score0.00456EPSS
SaveExploits2References438
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45710

Name of the Vulnerable Software and Affected Versions DeMomentSomTres Shortcodes versions prior to 1.1.2 Description The DeMomentSomTres Shortcodes plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the st callout function fails to properly sanitize input and...

6.4CVSS6AI score0.00181EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/06/02 12:0 a.m.•31 views

PT-2026-45684

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions prior to 0.8.3 Description A weakness exists in the Message.check instruct content function within the metagpt/schema.py file. Manipulation of the mapping argument can lead to deserialization, which is the...

5.3CVSS6.2AI score0.00122EPSS
SaveExploits0References14
Total number of security vulnerabilities5000