PT-2025-24438

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.9.11 Description The issue concerns the Sandbox container in FastGPT, which has insufficient isolation and inadequate restrictions on code execution. This allows attackers to escape the intended sandbox boundaries b...

PT-2025-24499 · Unknown · Quitenicestuff Soho Hotel

Name of the Vulnerable Software and Affected Versions: quitenicestuff Soho Hotel versions through 4.2.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions throu...

PT-2025-24486 · Themeton · Themeton Pressgrid - Frontend Publish Reaction & Multimedia Theme

Name of the Vulnerable Software and Affected Versions: themeton PressGrid - Frontend Publish Reaction & Multimedia Theme versions 1.3.1 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches...

PT-2025-24516 · Spicethemes · Spice Blocks

Name of the Vulnerable Software and Affected Versions: spicethemes Spice Blocks versions n/a through 2.0.7.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in spicethemes Spice...

PT-2025-24537

Name of the Vulnerable Software and Affected Versions Mikado-Themes GrandPrix versions 1.6 and earlier Description The issue is related to a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability enables an attacker to access and potentially execute local files on t...

PT-2025-24513 · Unknown · Spreadsheet Price Changer For Woocommerce/Wp E-Commerce – Light

Name of the Vulnerable Software and Affected Versions: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions 2.4.37 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows a...

PT-2025-24498 · Magentech · Magentech Revo

Name of the Vulnerable Software and Affected Versions: magentech Revo versions 4.0.26 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. Th...

PT-2025-24474 · Unknown · Category Icon

Name of the Vulnerable Software and Affected Versions: Category Icon versions 1.0.2 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference vulnerability in Category Icon, which allows XML Entity Linking. Recommendations: For Category Icon version...

PT-2025-24476 · Apptha · Apptha Slider Gallery

Name of the Vulnerable Software and Affected Versions: Apptha Slider Gallery versions n/a through 2.5 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the Apptha Slider Gallery...

PT-2025-24552 · Unitech · Unitech Pm2

Name of the Vulnerable Software and Affected Versions: Unitech pm2 versions up to 6.0.6 Description: A problematic vulnerability was found in Unitech pm2, affecting unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can b...

PT-2025-24491 · Lambertgroup · Lambertgroup Shout

Name of the Vulnerable Software and Affected Versions: LambertGroup SHOUT versions n/a through 3.5.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-24466 · Ancorathemes · Ancorathemes Inset

Name of the Vulnerable Software and Affected Versions: AncoraThemes Inset versions 1.18.0 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local...

PT-2025-24507 · Romancode · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions n/a through 8.5.34 Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in RomanCode MapSVG. Recommendations: For versions n/a through 8.5.34, update to a...

PT-2025-24471 · Unknown · Snstheme Sns Anton

Name of the Vulnerable Software and Affected Versions: snstheme SNS Anton versions n/a through 4.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24511 · Woocommerce · Holest Engineering Spreadsheet Price Changer

Name of the Vulnerable Software and Affected Versions: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions n/a through 2.4.37 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in ...

PT-2025-24492 · Fantasticplugins · Sumo Affiliates Pro

Name of the Vulnerable Software and Affected Versions: FantasticPlugins SUMO Affiliates Pro versions n/a through 10.7.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 10.7.0,...

PT-2025-24497 · Frenify · Frenify Arlo

Name of the Vulnerable Software and Affected Versions: Frenify Arlo versions n/a through 6.0.3 Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion in Frenify Arlo. Recommendations: For versions n/a through 6.0.3, update to a version that fixes this issue,...

PT-2025-24510 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions n/a through 2.12.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

CVE-2025-29871

An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later...

CVE-2025-29876

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...