ASB-A-378900798

In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14155 · Niteothemes · Clp – Custom Login Page

Name of the Vulnerable Software and Affected Versions: CLP – Custom Login Page by NiteoThemes versions 1.5.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...

ASB-A-375623125

In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User...

ASB-A-332277530

In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2025-14030 · Unknown · Breezing Forms

Name of the Vulnerable Software and Affected Versions: Breezing Forms versions 1.2.8.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions 1.2.8.11...

PT-2025-14172 · Unknown · Travis Simple Icons

Name of the Vulnerable Software and Affected Versions: Travis Simple Icons versions through 2.8.4 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 2.8.4,...

PT-2025-14066 · Unknown · Aec Kiosque

Name of the Vulnerable Software and Affected Versions: AEC Kiosque versions 1.9.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that an attacker can injec...

PT-2025-14073 · Unknown · Tla Media Gtm Kit

Name of the Vulnerable Software and Affected Versions: TLA Media GTM Kit versions n/a through 2.3.1 Description: The issue allows retrieval of embedded sensitive data due to debug messages revealing unnecessary information. Recommendations: For versions n/a through 2.3.1, update to a version that...

PT-2025-14076 · Unknown · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart versions 3.4.10 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, but no specific details about the estimated number of...

CVE-2025-29049

Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before fixed in 0.104.0 allows an attacker to execute arbitrary code via the MathLive function...

ASB-A-333344157

In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-388480622

In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14043

Name of the Vulnerable Software and Affected Versions Ays Pro Quiz Maker versions n/a through 6.6.8.7 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendation...

PT-2025-14392 · Unknown · Next-Cart Store To Woocommerce Migration

Name of the Vulnerable Software and Affected Versions: Next-Cart Store to WooCommerce Migration versions 3.9.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-14256 · Unknown · Stylemix Pearl

Name of the Vulnerable Software and Affected Versions: Stylemix Pearl versions 1.3.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-14409 · WordPress · Wp Bookmarks

Name of the Vulnerable Software and Affected Versions: WP Bookmarks versions 1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PUB-A-385736329

In n/a of n/a, there is a possible n/a due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-382243530

In multiple functions of quirks.c, there is a possible way to free arbitrary memory due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-14171 · Clearbit · Clearbit Reveal

Name of the Vulnerable Software and Affected Versions: Clearbit Reveal versions n/a through 1.0.6 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 1.0.6, update t...

PT-2025-14450 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome on Android versions prior to 135.0.7049.52 Description: The issue is related to an inappropriate implementation in Intents, allowing a remote attacker to perform privilege escalation via a crafted HTML page. Recommendations: For...