PT-2025-24413 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread version 5.1.0 Description: A critical issue has been found in the function sys thread sigprocmask of the file rt-thread/components/lwp/lwp syscall.c. The manipulation of the argument how leads to improper validation of array index...

PT-2025-23902 · Radare2 · Radare2

Name of the Vulnerable Software and Affected Versions: Radare2 version 5.9.9 Description: A vulnerability has been found in the function r cons flush in the library /libr/cons/cons.c of the component radiff2. The manipulation of the argument -T leads to use after free. Local access is required to...

SUSE CVE-2025-2570

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

PT-2025-22898

Name of the Vulnerable Software and Affected Versions TCMAN's GIM version 11 Description The issue concerns time-based blind SQL injection vulnerabilities. These vulnerabilities allow an attacker to retrieve, create, update, and delete databases through the ArbolID parameter in the...

PT-2025-22933

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A vulnerability was found in the Open Asset Import Library Assimp. It has been rated as problematic and affects the SkipSpaces function in the library...

PT-2025-22826 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions prior to 2.0.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Button widget due to insufficient input sanitization an...

CVE-2025-24610

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through = 1.2...

CVE-2024-31432

Missing Authorization vulnerability in StellarWP Restrict Content.This issue affects Restrict Content: from n/a through 3.2.8...

CVE-2024-0682

The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers t...

CVE-2024-0910

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract...

CVE-2024-1083

The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content...

CVE-2024-27085

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-24702

Cross-Site Request Forgery CSRF vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5...

CVE-2023-47518

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Matthew Muro Restrict Categories plugin = 2.6.4 versions...

CVE-2023-41861

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Restrict plugin = 2.2.4 versions...

PT-2025-22957 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 versions up to 20250523 Description: A critical issue was found in the D-Link DI-8100, affecting the httpd get parm function of the /login.cgi file in the jhttpd component. The manipulation of the notify argument leads to a...

PT-2025-22335 · WordPress · Splitit

Name of the Vulnerable Software and Affected Versions: Splitit plugin for WordPress versions up to, and including, 4.2.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify plugin settings due to missing capability checks on several functions in...

PT-2025-22329

Name of the Vulnerable Software and Affected Versions Proget MDM versions prior to 2.17.5 Description A low-privileged user can obtain information about tasks executed on devices controlled by Proget MDM, as well as details of the devices like their UUIDs. To perform the attack, an attacker needs...

PT-2025-22123 · WordPress · Order Delivery Date

Name of the Vulnerable Software and Affected Versions: Order Delivery Date WordPress plugin versions prior to 12.4.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape a parameter before outputting it...

PT-2025-21859 · Code Projects · Code-Projects Police Station Management System

Name of the Vulnerable Software and Affected Versions: code-projects Police Station Management System version 1.0 Description: A critical issue was found in the function criminal::display of the file source.cpp of the component Display Record. The manipulation of the argument N leads to buffer...