PT-2025-2638

Name of the Vulnerable Software and Affected Versions ECOVACS Robotics Deebot T20 OMNI and T20e OMNI versions prior to 1.24.0 Description A WiFi Remote Code Execution issue was discovered, affecting the mentioned robot vacuums. This issue allows for remote code execution via WiFi. Recommendations...

Mysiteforme security vulnerabilities

Mysiteforme is a permissions management system for wangl1989 individual developers. A security vulnerability exists in Mysiteforme versions prior to 2025.01.01, which stems from the inclusion of a fastjson deserialization vulnerability discovered via the component system/table/add...

PT-2025-3559 · Msfm · Msfm

Name of the Vulnerable Software and Affected Versions: MSFM versions prior to 2025.01.01 Description: The issue is related to a SQL injection vulnerability via the s name parameter at the "table/list" endpoint. This vulnerability allows for potential exploitation. No information is provided about...

PT-2025-2874

Name of the Vulnerable Software and Affected Versions Git versions prior to v2.48.1 Git versions prior to v2.47.2 Git versions prior to v2.46.3 Git versions prior to v2.45.3 Git versions prior to v2.44.3 Git versions prior to v2.43.6 Git versions prior to v2.42.4 Git versions prior to v2.41.3 Git...

Adobe Animate 23.x < 23.0.10 / 24.x < 24.0.7 A Vulnerability (APSB25-05)

The version of Adobe Animate installed on the remote Windows host is prior to 23.0.10 or 24.0.7. It is, therefore, affected by a vulnerability as referenced in the apsb25-05 advisory. - Integer Underflow Wrap or Wraparound CWE-191 potentially leading to Arbitrary code execution CVE-2025-21135 Not...

PT-2025-1471 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager versions prior to 4.42.2 Description: The issue is related to Cross Site Scripting XSS via the "monitor/s scheduledfile.php" endpoint. This allows for potential malicious script injection. Recommendations: For...

CVE-2025-23108

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability affects Firefox for iOS 134...

PT-2025-4832 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue concerns bugs and vulnerabilities in the Linux kernel. The estimated number of potentially affected devices and details about real-world incidents are not specified. Technical detai...

PT-2025-4835 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue concerns bugs and vulnerabilities in the Linux kernel. The estimated number of potentially affected devices and details about real-world incidents are not specified. Technical detai...

PT-2025-2387 · Gramine · Gramine

Name of the Vulnerable Software and Affected Versions: Gramine versions prior to a390e33e16ed374a40de2344562a937f289be2e1 Description: The issue is related to an interface vulnerability due to mismatching software signals versus hardware exceptions. This occurs because the software signals do not...

PT-2025-4588 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A Reflected Cross-Site Scripting XSS issue was identified in the "configuracao doacao.php" endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in the avulso...

WeGIA Cross-Site Script Vulnerabilities

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A cross-site scripting vulnerability exists in WeGIA versions prior to 3.2.8, which stems from the presence of a Stored Cross-Site Scripting XSS vulnerability that allows an attacker to inject malicious...

PT-2025-3685 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.15 Description: The issue affects websites managed by MegaBIP, where a form under the "/edytor/index.php?id=7,7,0" endpoint lacks protection mechanisms, making it vulnerable to Cross-Site Request Forgery CSRF. An...

CVE-2024-13295 Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X- before 7.X-3.3...

CVE-2024-13258 Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13...

PT-2025-2040 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.7 Description: The issue allows a remote unauthenticated attacker to bypass authentication due to a path traversal vulnerability. This vulnerability addresses incomplete fixes from a previous issue...

PHPYun security vulnerabilities

PHPYun is an efficient solution for talent and business recruitment and employment based on PHP and MySQL database by China Xinchao PHPYun. A security vulnerability exists in PHPYun versions prior to 7.0.2. An attacker can exploit the vulnerability to perform code execution via backdoor-restricte...

PT-2025-4732 · Unknown · Lucia Intelisano Live Flight Radar

Name of the Vulnerable Software and Affected Versions: Lucia Intelisano Live Flight Radar versions prior to 1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject...

Chatwoot SQL Injection Vulnerability

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A SQL injection vulnerability exists in Chatwoot versions prior to 3.16.0 that stems from improper input cleanup and allows an attacker t...

WordPress plugin Surbma | Premium WP Cross-Site Script Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...