PT-2025-17755 · Unknown · License For Envato

Name of the Vulnerable Software and Affected Versions: License For Envato versions 1.0.0 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or 'PHP Local File Inclusion'. This...

PT-2025-17865 · Albedo Telecom · Albedo Telecom Net.Time

Name of the Vulnerable Software and Affected Versions: ALBEDO Telecom Net.Time - PTP/NTP clock Serial No. NBC0081P version 1.4.4 Description: The issue is related to an insufficient session expiration, which could allow an attacker to transmit passwords over unencrypted connections, resulting in...

PT-2025-17858 · Itc Systems · Itc Systems Multiplan/Matrix Onecard

Name of the Vulnerable Software and Affected Versions: ITC Systems Multiplan/Matrix OneCard platform version 3.7.4.1002 Description: The issue is related to a SQL injection vulnerability. It affects the Forgotpassword.aspx component. Recommendations: For version 3.7.4.1002, consider restricting...

PT-2025-17714 · WordPress · Elex Woocommerce Advanced Bulk Edit Products

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress versions up to, and including, 1.4.9 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform SQL Injection...

PT-2025-17820 · Unknown · Milat Jquery Automatic Popup

Name of the Vulnerable Software and Affected Versions: Milat jQuery Automatic Popup versions 1.3.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-17711 · WordPress · Xelion Webchat

Name of the Vulnerable Software and Affected Versions: Xelion Webchat plugin for WordPress versions up to and including 9.1.0 Description: The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability...

PT-2025-17703 · WordPress · My Tickets

Name of the Vulnerable Software and Affected Versions: My Tickets – Accessible Event Ticketing plugin for WordPress versions up to and including 2.0.16 Description: The issue arises from the mt save profile function not properly restricting access to unauthorized users to update roles. This allow...

PT-2025-17760 · Unknown · M A Vinoth Kumar Frontend Dashboard

Name of the Vulnerable Software and Affected Versions: M A Vinoth Kumar Frontend Dashboard versions 2.2.5 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attack...

CVE-2024-10306

CVE-2024-10306 affects the mod_proxy_cluster module (Apache HTTP Server). The issue arises because the Directory directive does not enforce access restrictions as strongly as the Location directive, enabling unauthorized MCMP requests that could add/remove/update balancer nodes. Public exploit de...

PT-2025-17632 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 5.7 before version 05.70.50 Description: An issue was discovered in the InsydeH2O kernel, where the SmmUpdateVariablePropertySmi function, a SMM callback function in the VariableRuntimeDxe driver,...

PT-2025-17607 · WordPress · Wordpress Simple Shopping Cart

Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to and including 5.1.2 Description: The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the...

PT-2025-17648 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description: A buffer overflow vulnerability was found in the downloadFile.cgi component. This issue affects the TOTOLINK A800R router. Recommendations: For version 4.1.2cu.5137 B20200730, as a...

PT-2025-17649 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description: A buffer overflow issue was discovered in the downloadFile.cgi endpoint through the v25 parameter. This allows for potential exploitation. Recommendations: For TOTOLINK A800R version...

PT-2025-17650 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A buffer overflow issue was discovered in the downloadFile.cgi endpoint through the v25 parameter. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, avoid using the...

PT-2025-17676 · Nih · Nih Brics

Name of the Vulnerable Software and Affected Versions: NIH BRICS aka Biomedical Research Informatics Computing System versions 14.0.0 through 14.0.0-67 Description: The issue allows unauthenticated users with a Common Access Card CAC to escalate privileges and compromise any account, including...

PT-2025-17674 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further...

PT-2025-17476 · H3C · H3C Gr-3000Ax

Name of the Vulnerable Software and Affected Versions: H3C GR-3000AX versions up to V100R006 Description: A critical vulnerability was found in the HTTP POST Request Handler component of H3C GR-3000AX. The affected function is EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit Li...

PT-2025-17565 · Unknown · Sacco Management System

Name of the Vulnerable Software and Affected Versions: Sacco Management system version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the password parameter at the "/sacco/ajax.php" API endpoint. Recommendations: For Sacco Management system version...

PT-2025-17484 · WordPress · Wp Import Export Lite

Name of the Vulnerable Software and Affected Versions: WP Import Export Lite plugin for WordPress versions up to, and including, 3.9.27 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the wpiePreviewData function. This...

PT-2025-17506 · Codepeople · Codepeople Appointment Booking Calendar

Name of the Vulnerable Software and Affected Versions: codepeople Appointment Booking Calendar versions 1.3.92 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows SQL Injection in the codepeople Appointment Booking Calendar...