PT-2025-2608 · Ibm · Ibm Cognos Dashboards

Name of the Vulnerable Software and Affected Versions: IBM Cognos Dashboards versions 4.0.7 through 5.0.0 Description: The issue is related to dependency confusion, allowing a remote attacker to perform unauthorized actions. This could potentially lead to privilege escalation. Recommendations: Fo...

PT-2025-4008

Name of the Vulnerable Software and Affected Versions JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d Description A critical vulnerability has been found in JoeyBling bootplus. The issue affects an unknown functionality of the file /admin/sys/role/list. The manipulation of the...

PT-2025-4591 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.18 through 4.0.0-beta.252 Description: A vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data an...

WordPress plugin Restrict Anonymous Access 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2025-40594

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.2.2 Redis versions prior to 8.0.4 Redis versions prior to 7.4.6 Redis versions prior to 7.2.11 Redis versions prior to 6.2.20 Description A use-after-free memory corruption issue exists in the Lua scripting engine of...

PT-2025-5432 · WordPress · Woocommerce Product Table Lite

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Table Lite versions 3.8.7 and earlier Description: The issue is related to a lack of authorization in WooCommerce Product Table Lite, allowing the exploitation of incorrectly configured access control security levels...

CVE-2025-24610: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through = 1.2...

PT-2025-4014 · Joeybling · Bootplus

Name of the Vulnerable Software and Affected Versions: JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d Description: A vulnerability has been found in the qrCode function of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the text argument...

PT-2025-4013 · Joeybling · Bootplus

Name of the Vulnerable Software and Affected Versions: JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d Description: A problematic issue was found in the qrCode function of the QrCodeController.java file. The manipulation of the w/h argument leads to resource consumption. This...

PT-2025-3100 · Unknown +1 · Openimageio +1

Name of the Vulnerable Software and Affected Versions: OpenImageIO version 3.1.0.0dev Description: An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO may cause a Denial of Service DoS when the program requests to allocate too much space. Recommendations: For OpenImageIO...

PT-2025-3549 · Lunasvg · Lunasvg

Name of the Vulnerable Software and Affected Versions: lunasvg version 3.0.0 Description: The issue is related to a segmentation violation in the plutovg path add path component. This component is part of the lunasvg software. Recommendations: For lunasvg version 3.0.0, consider restricting acces...

PT-2025-5054 · Unknown · Fures Xtra Settings

Name of the Vulnerable Software and Affected Versions: fures XTRA Settings versions n/a through 2.1.8 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected XSS. This means that an attacker can inject malicious scripts into the...

PT-2025-2244 · Sperse.Io · Automate Hub Free

Name of the Vulnerable Software and Affected Versions: Automate Hub Free by Sperse.IO plugin for WordPress versions up to and including 1.7.0 Description: The issue is due to missing or incorrect nonce validation on the 'automate hub' page, making it possible for unauthenticated attackers to upda...

PT-2025-1511 · Kwhotel · Kwhotel

Name of the Vulnerable Software and Affected Versions: KWHotel version 0.47 Description: The issue concerns CSV Formula Injection in the invoice adding function. This allows for potential exploitation through malicious formula injection in CSV files. Recommendations: For KWHotel version 0.47,...

PT-2025-5087 · Unknown · Wm Options Import Export

Name of the Vulnerable Software and Affected Versions: WM Options Import Export versions 1.0.1 and earlier Description: The issue allows for the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. This can potentially expose confidential information...

PT-2025-4989 · Unknown · Notfound Content Planner

Name of the Vulnerable Software and Affected Versions: NotFound Content Planner versions n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions...

PT-2025-5361

Name of the Vulnerable Software and Affected Versions Jenkins Azure Service Fabric Plugin versions 1.6 and earlier Description A missing permission check in the Jenkins Azure Service Fabric Plugin allows attackers with Overall/Read permission to enumerate the IDs of Azure credentials stored in...

PT-2025-5360

Name of the Vulnerable Software and Affected Versions Jenkins Azure Service Fabric Plugin versions 1.6 and earlier Description A Cross-Site Request Forgery CSRF issue allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method. This...

PT-2025-3466

Name of the Vulnerable Software and Affected Versions Linksys E8450 version 1.2.00.360516 Description A command injection issue was discovered, which can be exploited via the userEmail variable. This allows for potential unauthorized access and control. Recommendations For Linksys E8450 version...

PT-2025-5256 · Unknown · Ppo Call To Actions

Name of the Vulnerable Software and Affected Versions: PPO Call To Actions versions 0.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects PPO Call To Actions, allowing unauthorized requests. The estimated number of potentially affected devices worldwide is not specified...