PT-2025-14778

Name of the Vulnerable Software and Affected Versions XZ Utils versions 5.3.3alpha through 5.8.0 Description The multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null...

PT-2025-13622 · Unknown · Bluestar Micro Mall

Name of the Vulnerable Software and Affected Versions: Bluestar Micro Mall version 1.0 Description: A critical vulnerability was found in Bluestar Micro Mall, affecting an unknown functionality of the file "/api/api.php?mod=upload&type=1". The manipulation of the File argument leads to unrestrict...

CVE-2025-2713 Improper File Permission Handling in Google gVisor runsc

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork...

PT-2025-13582 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2025.1000.4047 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. This vulnerability can be exploited via the Add Article feature. Recommendations: For maccms10 version 2025.1000.4047, as a...

PT-2025-13586 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: The issue concerns Command Injection in the /bin/boa executable via the bandstr variable. This allows for potential execution of arbitrary commands. Recommendations: For TOTOLINK A3002...

PT-2025-13598 · WordPress · Soj Soundslides

Name of the Vulnerable Software and Affected Versions: SoJ SoundSlides plugin for WordPress version 1.2.2 and earlier Description: The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj soundslides options subpanel function...

PT-2025-13580 · Unknown · Sourcecodester Online Exam System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Exam System version 1.0 Description: The issue is related to SQL Injection via the dash.php file. This allows for potential exploitation. Recommendations: For Sourcecodester Online Exam System version 1.0, consider...

PT-2025-13589 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO version 6.4.0 Description: The issue is related to Server-Side Request Forgery SSRF in the Email Settings. This means an attacker could potentially forge requests from the server, leading to unauthorized access to internal systems or...

PT-2025-19963 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was found in the runtime.InternetConnection function. Recommendations: For version 1.1.0.26, consider restricting access to the runtime.InternetConnection function until a...

PT-2025-13085 · Smackcoders · Smackcoders Lead Form Data Collection To Crm

Name of the Vulnerable Software and Affected Versions: smackcoders Lead Form Data Collection to CRM versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, which allows Blind S...

PT-2025-13060 · Wpguppy · Wpguppy

Name of the Vulnerable Software and Affected Versions: WPGuppy versions 1.1.3 and earlier Description: The issue is related to an SQL Injection vulnerability, which allows attackers to exploit the system. This is due to the improper neutralization of special elements used in an SQL command...

PT-2025-13036

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 4.1.2 Description The issue concerns a privilege escalation problem in the User Registration & Membership WordPress plugin. This problem allows unauthenticated users to gain adm...

PT-2025-13426 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13241 · Code Projects · Payroll Management System

Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue was found in the Payroll Management System. The problem affects an unknown functionality of the file update employee.php. The manipulation of the emp type...

PT-2025-13385 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A SQL Injection issue was identified in the "/WeGIA/html/socio/sistema/controller/query geracao auto.php" endpoint, specifically in the query parameter. This issue allows the execution of arbitrary S...

PT-2025-12858 · WordPress · Booknetic

Name of the Vulnerable Software and Affected Versions: Booknetic WordPress plugin versions prior to 4.1.5 Description: The issue concerns a lack of CSRF check when creating Staff accounts, which could allow attackers to make logged-in admins add arbitrary Staff members via a CSRF attack. This cou...

PT-2025-12869 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions up to and including 2024.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the advanced iframe shortcode. This allows...

PT-2025-12998

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.52 Description An issue was discovered in Appsmith where an incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must...

PT-2025-13006 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: An issue was discovered where users invited as "App Viewer" incorrectly have access to development information of a workspace, specifically a list of datasources in a workspace they're a member of...

PT-2025-13440 · Unknown · Choco Tei Watcher Mini

Name of the Vulnerable Software and Affected Versions: CHOCO TEI WATCHER mini IB-MCT001 all versions Description: A Direct request 'Forced Browsing' issue exists, allowing a remote attacker to send a specially crafted HTTP request to obtain or delete product data, and/or alter product settings...