PT-2025-3088

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.2 Description The issue is related to an authenticated Client-Side Injection vulnerability in MonicaHQ. This vulnerability can be exploited via the Reason parameter at the "/people/h:id/debts/create" API endpoint...

PT-2025-4586 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A Stored Cross-Site Scripting XSS vulnerability was identified in the "cadastrarSocio.php" endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the...

PT-2025-3409 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version V1.0.1-B20201211.2000 Description: A command injection issue was discovered via the modifyOne parameter in the enable wsh function. This allows for potential exploitation. Recommendations: For TOTOLINK A6000R version...

PT-2025-2637 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.1.4 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page. This enables attackers t...

PT-2025-2059 · Wander Chu · Springboot-Blog

Name of the Vulnerable Software and Affected Versions: wander-chu SpringBoot-Blog version 1.0 Description: A critical vulnerability has been found in the Admin Attachment Handler component, specifically affecting the upload function of the AttachtController.java file. The manipulation of the file...

PT-2025-1716 · WordPress · Responsive Flipbook Plugin

Name of the Vulnerable Software and Affected Versions: Responsive FlipBook Plugin for WordPress versions up to, and including, 2.5.0 Description: The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the rfbwp save settings function...

PT-2025-2803 · Unknown · Neat Board Nfc

Name of the Vulnerable Software and Affected Versions: Neat Board NFC version 1.20240620.0015 Description: A Buffer Overflow issue exists, allowing physically proximate attackers to escalate privileges via a crafted payload to the password field. This enables local privilege escalation...

PT-2025-1819 · WordPress · Wp Database Backup

Name of the Vulnerable Software and Affected Versions: WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress versions up to, and including, 7.3 Description: The issue allows unauthenticated attackers to extract sensitive data, including all information store...

PT-2025-4375 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A Reflected Cross-Site Scripting XSS vulnerability was identified in the "configuracao geral.php" endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

PT-2025-3733 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.31 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Heading widget due to insufficient input sanitization and output escapin...

PT-2025-3239 · Unknown · Wpforms Contact Form

Name of the Vulnerable Software and Affected Versions: WPForms Contact Form versions 1.9.2.2 and earlier Description: The issue is related to a missing authorization vulnerability in the WPForms Contact Form, which allows the exploitation of incorrectly configured access control security levels...

PT-2025-4546 · Unknown · Smoothness Slider Shortcode

Name of the Vulnerable Software and Affected Versions: Smoothness Slider Shortcode versions n/a through v1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-4529 · Unknown · Ofek Nakar Virtual Bot

Name of the Vulnerable Software and Affected Versions: Ofek Nakar Virtual Bot versions n/a through 1.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge,...

PT-2025-4464 · Unknown · Wpindeed Ultimate Learning Pro

Name of the Vulnerable Software and Affected Versions: WpIndeed Ultimate Learning Pro versions prior to 3.9 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially...

PT-2025-4419 · WordPress · Wp Visitor Statistics

Name of the Vulnerable Software and Affected Versions: WP Visitor Statistics Real Time Traffic versions n/a through 7.3 Description: The issue is related to a missing authorization vulnerability in WP Visitor Statistics Real Time Traffic, which allows exploitation of incorrectly configured access...

PT-2025-1860 · Gpt4 +5 · Gpt4 +5

Name of the Vulnerable Software and Affected Versions: The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to a missing capability check and file type validatio...

PT-2025-4420 · WordPress · Hero Banner Ultimate

Name of the Vulnerable Software and Affected Versions: Hero Banner Ultimate versions 1.4.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, in WP OnlineSupport,...

PT-2025-3242 · Tips Tricks Hq · Compact Wp Audio Player

Name of the Vulnerable Software and Affected Versions: Tips and Tricks HQ Compact WP Audio Player versions 1.9.14 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. This means an attacker can potentially trick the server...

PT-2025-2743 · Elspec Engineering · Elspec Engineering G5 Digital Fault Recorder Firmware

Name of the Vulnerable Software and Affected Versions: Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12 Description: The issue is related to an XML External Entity XXE vulnerability, which allows attackers to cause a Denial of Service DoS via a crafted XML payload. This...

PT-2025-2880

Name of the Vulnerable Software and Affected Versions AdPortal version 3.0.39 Description A remote attacker can execute arbitrary code via the file upload functionality due to a File Upload Bypass issue. This allows attackers to bypass file upload checks and run arbitrary code. Recommendations Fo...