Vulnerability Summary for the ... Note

Vulnerability Summary for the Week of April 7, 2025

The listed vulnerabilities affect various software and hardware, ranging from industrial devices to web applications and plugins. Several vulnerabilities in the SENTRON 7KT PAC1260 Data Manager allow remote code execution. A Fortinet FortiSwitch GUI vulnerability allows unauthenticated password changes. Industrial Edge Device Kit versions have an authentication bypass vulnerability. A TOTVS Framework vulnerability allows multi-factor authentication bypass. Yii 2 versions before 2.0.52 have a mishandling of behavior attachment. The Simple WP Events plugin is vulnerable to arbitrary file deletion. A Mediatek software development kit has an out-of-bounds write vulnerability. Numerous vulnerabilities in RUoYi v.4.8.0 allow privilege escalation. Many other vulnerabilities were identified, including SQL injections, improper access controls, and default password issues across different products.