PT-2025-24271 · Unknown · Bp Profile As Homepage

Name of the Vulnerable Software and Affected Versions: BP Profile as Homepage versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-24194 · WordPress · Wp Shopify

Name of the Vulnerable Software and Affected Versions: WP Shopify versions 1.5.3 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24168 · Otwthemes · Otwthemes Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: OTWthemes Post Custom Templates Lite versions 1.14 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24603 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T versions 4.1.2cu.5232 B20210713 and earlier Description: A critical issue was found in the HTTP POST Request Handler component, affecting an unknown function of the file /boafrm/formReflashClientTbl. The manipulation leads to...

PT-2025-24192 · Otwthemes · Otwthemes Widgetize Pages Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widgetize Pages Light versions 3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-24174 · Unknown · Nexa Blocks

Name of the Vulnerable Software and Affected Versions: Nexa Blocks versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24324 · Unknown · Laundry Laundry System +1

Name of the Vulnerable Software and Affected Versions: code-projects Laundry System version 1.0 Description: A vulnerability was found in the Laundry System, affecting some unknown processing of the file /data/insert type.php. The manipulation of the Type argument leads to cross-site scripting. T...

PT-2025-24280 · Code Projects · Code-Projects Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /view dental.php. The manipulation of the itr no argument leads to SQL injectio...

Addressing API Security with NIST SP 800-228

According to the Wallarm Q1 2025 ThreatStats report, 70% of all application attacks target APIs. The industry can no longer treat API security as a sidenote; it’s time to treat it as the main event. NIST seems to be on board with this view, releasing the initial public draft of NIST SP 800-228, a...

PT-2025-23884 · Aerc · Aerc

Name of the Vulnerable Software and Affected Versions: aerc versions before 93bec0d Description: The issue allows directory traversal in the commands/msgview/open.go file due to direct path concatenation of the name of an attachment part. This is caused by the lack of proper validation of...

PT-2025-23931 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.7.0 and earlier Description: The issue is related to inadequate access control in the Multi-Factor Authentication MFA feature for users in Devolutions Server. This allows a user with user management permissi...

PT-2025-23984 · Microsoft +1 · Azure Entra Id +2

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.0 through 0.9.14 Himmelblau version 1.00-alpha Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. The issue arises when Entra ID group-based access restrictions are configured...

PT-2025-23878 · Campcodes · Campcodes Online Teacher Record Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Teacher Record Management System version 1.0 Description: A critical issue affects the processing of the file /search-teacher.php, where the manipulation of the searchteacher argument leads to SQL injection. This issue can be...

PT-2025-23893 · Unknown · Phpgurukul Notice Board System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Notice Board System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Notice Board System, affecting an unknown functionality of the file /admin-profile.php. The manipulation of the mobilenumber...

PT-2025-23986 · Code Projects · Code-Projects Real Estate Property Management System

Name of the Vulnerable Software and Affected Versions: code-projects Real Estate Property Management System version 1.0 Description: A critical issue was found in the code-projects Real Estate Property Management System. The problem affects an unknown function of the file /Admin/Property.php...

PT-2025-23924 · Unknown · Media Gallery

Name of the Vulnerable Software and Affected Versions: RSMediaGallery component versions 1.7.4 through 2.1.6 Description: A SQL injection issue was discovered due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker ...

PT-2025-23897 · Qt Company +1 · Qt +1

Name of the Vulnerable Software and Affected Versions: Qt versions 6.3.0 through 6.5.9 Qt versions 6.6.0 through 6.8.4 Qt version 6.9.0 Description: The issue occurs when a specifically crafted ICNS format image file is loaded in QImage, triggering a crash. Recommendations: For Qt versions 6.3.0...

PT-2025-23912 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical vulnerability was found in the PHPGurukul Complaint Management System. The issue affects an unknown function of the file /admin/between-date-complaintreport.php. The...

PT-2025-23909 · Unknown · 1000 Projects Online Notice Board

Name of the Vulnerable Software and Affected Versions: 1000projects Online Notice Board version 1.0 Description: A critical vulnerability was found in the 1000projects Online Notice Board, affecting unknown code of the file /register.php. The manipulation of the argument fname leads to SQL...

PT-2025-23887 · Unknown · Code-Projects/Anirbandutta9 Content Management System/News-Buzz

Name of the Vulnerable Software and Affected Versions: code-projects/anirbandutta9 Content Management System and News-Buzz version 1.0 Description: A critical issue was found in the code-projects/anirbandutta9 Content Management System and News-Buzz. The problem affects an unknown functionality o...