PT-2025-21802 · Donetick · Donetick

Name of the Vulnerable Software and Affected Versions: Donetick versions prior to 0.1.44 Description: The issue concerns the use of JSON Web Tokens JWT for authentication in Donetick, an open-source task management application. Prior to version 0.1.44, the application uses a weak default signing...

PT-2025-21767 · Imagination Technologies · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, potentially triggering use-after-free kernel exceptions. Recommendations: At the...

WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.6.2...

WordPress Kali Forms plugin < 2.4.3 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Kali Forms versions 2.4.3...

CVE-2025-32299

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through...

CVE-2025-32310

The CVE-2025-32310 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal that enables privilege escalation in QuickCal versions up to 1.0.13. The vulnerability is supported by multiple sources, including PT-2025-21694 which states ThemeMove QuickCal versions 1.0.1...

CVE-2025-32643

CVE-2025-32643 affects the WPGYM WordPress Gym Management System plugin. Affected versions up to 65.0 suffer from improper neutralization of special elements in SQL commands, enabling a blind SQL injection. Public sources confirm the vulnerability, with patches available in newer releases (e.g., ...

GHSA-Q97M-8853-PQ76 SeaweedFS Vulnerable to SQL Injection

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstractsql/abstractsqlstore.go...

GHSA-3VCG-J39X-CWFM Vyper's `slice()` may elide side-effects when output length is 0

Impact the slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is skipped:...

CVE-2025-32962 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS...

MAL-2025-3897 Malicious code in internallib_v370 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c10422740b7cbb39e0369e25a7deefc65842295a36c5fb7c6d10182737b2df8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insecure temporary file creation, race with write access and permission

None...

Information Disclosure

oxid-esales/oxideshop-ce is vulnerable to information disclosure. The vulnerability is due to improper error handling and also Smarty syntax errors in CMS pages that may allow an attacker to access user information...

PT-2025-21725 · Unknown · Mapsvg Lite

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions n/a through 8.6.4 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects MapSVG Lite. This allows for Code Injection. Recommendations: For versions n/...

PT-2025-21729 · Ultraaddons · Ultraaddons Elementor Lite

Name of the Vulnerable Software and Affected Versions: UltraAddons Elementor Lite versions prior to 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-21724 · WordPress · Rs Wp Book Showcase

Name of the Vulnerable Software and Affected Versions: RS WP Book Showcase versions through 6.7.41 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects RS WP Book Showcase, allowing code injection. Recommendations: For...

PT-2025-21749 · Unknown · Phpgurukul Online Course Registration System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Course Registration version 3.1 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /news.php. The manipulation of the newstitle argument leads to SQL injection. This...

PT-2025-21592 · Ibm · Ibm Content Navigator

Name of the Vulnerable Software and Affected Versions: IBM Content Navigator versions 3.0.11 through 3.1.0 Description: The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting sit...

PT-2025-21671 · Themeton · Themeton Seven Stars

Name of the Vulnerable Software and Affected Versions: themeton Seven Stars versions 1.4.4 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions without the user's knowledge ...

PT-2025-21675 · Themeton · Themeton Spare

Name of the Vulnerable Software and Affected Versions: themeton Spare versions n/a through 1.7 Description: A Cross-Site Request Forgery CSRF issue affects themeton Spare, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For themeton Spare versions n/a through...