laravel-translation-manager 跨站脚本漏洞

laravel-translation-manager is a barryvdh personal developer for managing Laravel translation files. A cross-site scripting vulnerability exists in laravel-translation-manager versions prior to 0.6.8, which stems from improper input validation and cleanup, and could lead to cross-site scripting...

PT-2025-24539 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions up to 2.5.7 Description: A vulnerability was found in Emlog, affecting some unknown processing of the file /admin/article.php. The manipulation of the active post argument leads to cross-site scripting. The attack may be...

PT-2025-24508 · Click5 · Click5 History Log

Name of the Vulnerable Software and Affected Versions: History Log by click5 versions 1.0.0 through 1.0.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-24543 · Vigybag · Vigybag

Name of the Vulnerable Software and Affected Versions: Vigybag versions 1.0 and before Description: The issue is related to Cross Site Scripting XSS via the upload profile picture function under the user's profile. This allows for potential malicious script execution. No information is provided...

PT-2025-24473 · Payu · Payu India

Name of the Vulnerable Software and Affected Versions: PayU India versions through 3.8.5 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing authentication abuse. Recommendations: For versions through 3.8.5, update to a version later than 3.8...

PT-2025-24533

Name of the Vulnerable Software and Affected Versions Unfoldwp Magty versions 1.0.0 through 1.0.6 Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24469 · Avaz · Avaz

Name of the Vulnerable Software and Affected Versions: Avaz versions n/a through 2.8 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in the Avaz them...

CVE-2025-48328

Cross-Site Request Forgery CSRF vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through = 1.7.0...

CVE-2025-41365

CVE-2025-41365 describes a code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The flaw allows an attacker to store a malicious payload that runs in the victim’s browser. Exploitation requires authentication to the device and commands with permissions higher than the view...

RHSA-2025:8607 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

PT-2025-24268 · Unknown · Minhlaobao Admin Notes

Name of the Vulnerable Software and Affected Versions: minhlaobao Admin Notes versions n/a through 1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For versions n/a through 1.1, update to a version that includes...

PT-2025-24252 · WordPress · Store Locator

Name of the Vulnerable Software and Affected Versions: Store Locator WordPress versions n/a through 1.5.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24225 · Unknown · Calculated Fields Form

Name of the Vulnerable Software and Affected Versions: Calculated Fields Form versions 5.3.58 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Calculated Fields Form, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 5.3.5...

PT-2025-24072 · Quickcab · Quickcab

Name of the Vulnerable Software and Affected Versions: QuickCab versions 1.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain features or...

PT-2025-24158 · Unknown · Acf: Yandex Maps Field

Name of the Vulnerable Software and Affected Versions: ACF: Yandex Maps Field versions 1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in ACF: Yandex Maps Field...

PT-2025-24299 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: A NULL pointer dereference issue allows a remote attacker with a user account to launch a denial-of-service DoS attack. Recommendations: For versions prior to 5.5.6.4847, update to...

PT-2025-24201 · Unknown · Everest Backup

Name of the Vulnerable Software and Affected Versions: Everest Backup versions n/a through 2.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.3.3, update to a version later than 2.3....

PT-2025-24094 · Unknown · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 6.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-24085

Name of the Vulnerable Software and Affected Versions ThemeGoods Photography versions prior to 7.5.3 Description The issue is related to Deserialization of Untrusted Data. This affects ThemeGoods Photography, allowing potential exploitation. Recommendations For versions prior to 7.5.3, update to...

PT-2025-24176 · WordPress · Wp Gravity Forms Constant Contact Plugin

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Constant Contact Plugin versions 1.1.0 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing. This vulnerability can be...