GHSA-WWC9-WMM3-2PMF DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1...

PT-2025-26396 · Woocommerce · Related Products Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Related Products Manager for WooCommerce versions 1.6.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means...

PT-2025-26345 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.3.4 Description: A Cross-Site Request Forgery CSRF issue affects the WP Inventory Manager, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 2.3....

PT-2025-26371 · Unknown · Iamapinan Pdpa Consent For Thailand

Name of the Vulnerable Software and Affected Versions: iamapinan PDPA Consent for Thailand versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-26333 · Oganro · Oganro Pixelbeds Channel Manager/Hotel Booking Engine

Name of the Vulnerable Software and Affected Versions: Oganro PixelBeds Channel Manager and Hotel Booking Engine versions 1.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For Oganro PixelBeds Chann...

PT-2025-26375 · Tealium · Tealium

Name of the Vulnerable Software and Affected Versions: Tealium versions through 2.1.17 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject malicious script...

PT-2025-26360 · Unknown · Cookie-Script.Com

Name of the Vulnerable Software and Affected Versions: Cookie-Script.com versions 1.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Cookie Script, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-26389 · Unknown · Mailing Group Listserv

Name of the Vulnerable Software and Affected Versions: Yamna Khawaja Mailing Group Listserv versions 3.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Mailing Group Listserv, allowing unauthorized actions to be performed on behalf of the user. Recommendations: For...

PT-2025-26354 · Unknown · Thanhtungtnt Video List Manager

Name of the Vulnerable Software and Affected Versions: thanhtungtnt Video List Manager versions 1.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For thanhtungtnt Vide...

PT-2025-26502 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 Description: The issue is caused by insufficient validation of incoming request resources, which could allow a remote attacker to cause a denial of service. Recommendations:...

PT-2025-26340 · Unknown · Tm Replace Howdy

Name of the Vulnerable Software and Affected Versions: TM Replace Howdy versions 1.4.2 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the TM Replace Howdy plugin, enabling Cross Site Request...

PT-2025-26452 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.10 through 16.11.5 GitLab CE/EE version 17.0 through 17.0.3 GitLab CE/EE version 17.1 through 17.1.1 Description: A Denial of Service DoS condition exists in GitLab CE/EE. An attacker can cause a denial of service by...

PT-2025-26415 · Woocommerce · Change Cart Button Colors

Name of the Vulnerable Software and Affected Versions: Change Cart button Colors WooCommerce versions 1.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that also allows Stored XSS. This means an attacker could potentially trick a user into performing...

PT-2025-26317 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An out-of-bounds read vulnerability exists in COROS PACE 3. Sending a crafted Bluetooth Low Energy BLE message forces the device to reboot. Recommendations: Update COROS PACE 3 to a version...

PT-2025-26388 · Unknown · Fyrebox Quizzes

Name of the Vulnerable Software and Affected Versions: Fyrebox Quizzes versions n/a through 3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-26373 · Unknown · Ip Based Login

Name of the Vulnerable Software and Affected Versions: brijeshk89 IP Based Login versions n/a through 2.4.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker ca...

PT-2025-26398 · Sitekit · Sitekit

Name of the Vulnerable Software and Affected Versions: Sitekit versions n/a through 1.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject malicious...

PT-2025-26395 · Unknown · Rameez Iqbal Real Estate Manager

Name of the Vulnerable Software and Affected Versions: Rameez Iqbal Real Estate Manager versions n/a through 7.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This is a type of attack whe...

PT-2025-26381 · Truong Thanh · Truong Thanh Atp Call Now

Name of the Vulnerable Software and Affected Versions: Truong Thanh ATP Call Now versions 1.0.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables attackers to inje...

PT-2025-26413 · Unknown · Beee Tinynav

Name of the Vulnerable Software and Affected Versions: Beee TinyNav versions n/a through 1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Beee TinyNav versions n/a through 1.4, update to a version that fixes this issue. At...