PT-2025-37183

In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known...

PT-2025-37137

The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2025-37123

The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-9979 Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export

The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspikspamlogdownloadcsv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download...

CVE-2025-9463

CVE-2025-9463 concerns the PeachPay Payments plugin for WooCommerce (and related Payments Plugin for WooCommerce) with a time-based SQL Injection via the order_by parameter. Wordfence’s details specify that all versions up to 1.117.5 are affected due to insufficient escaping and query preparation...

PT-2025-37041

Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One versions prior to 2.0.3 Description: Insufficient session expiration in the Web Admin Panel allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session...

CVE-2025-9065

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash...

CVE-2025-9058

The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-leve...

CVE-2025-52389

An Insecure Direct Object Reference IDOR in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other users via a crafted HTTP request...

PT-2025-36502

Name of the Vulnerable Software and Affected Versions: Envasadora H2O Eireli - Soda Cristal version 40.20.4 Description: An Insecure Direct Object Reference IDOR exists in Envasadora H2O Eireli - Soda Cristal version 40.20.4. Authenticated attackers can access sensitive data belonging to other...

CVE-2025-52389

Envasadora H2O Eireli - Soda Cristal version v40.20.4 is vulnerable to an Insecure Direct Object Reference (IDOR) . This flaw allows authenticated attackers to access sensitive data belonging to other users by submitting a crafted HTTP request . While the vulnerability is confirmed, there is curr...

PT-2025-36359

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor plugin for WordPress versions prior to 3.8 Description: The SKT Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and...

PT-2025-36350

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to and including 1.5.5.1 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple widgets. Th...

PT-2025-36108

Name of the Vulnerable Software and Affected Versions: Flatsome Theme for WordPress versions prior to 3.20.0 Description: The Flatsome Theme for WordPress is susceptible to Stored Cross-Site Scripting through its shortcodes. This is due to inadequate input sanitization and output escaping of...

Linux Distros Unpatched Vulnerability : CVE-2022-21713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle use...

PT-2025-45525

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.0.0 through 8.9.0 Description SuiteCRM is an open-source Customer Relationship Management CRM software application. A time-based blind SQL Injection flaw exists in versions 8.9.0 and below. This issue allows an authenticate...

CVE-2025-20287 Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based...

CVE-2025-55373

Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights...

PT-2025-35581

Name of the Vulnerable Software and Affected Versions: Beakon Application versions prior to 5.4.3 Description: An incorrect access control issue exists in Beakon Application. Authenticated attackers with low-level privileges can escalate their privileges and execute commands with Administrator...

CVE-2025-55373

The Beakon Application (versions prior to v5.4.3 ) is affected by an incorrect access control vulnerability. An authenticated attacker with low-level privileges can escalate their privileges to Administrator rights by sending crafted requests to create rogue higher-privileged users (e.g., by usin...