PT-2025-25477 · WordPress · Zen Sticky Social

Name of the Vulnerable Software and Affected Versions: Zen Sticky Social plugin for WordPress versions up to, and including, 0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This...

PT-2025-25473 · WordPress · The Ai Image Lab – Free Ai Image Generator

Name of the Vulnerable Software and Affected Versions: The AI Image Lab – Free AI Image Generator plugin for WordPress versions 1.0.0 through 1.0.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This allows...

PT-2025-25402 · Ricoh · Ricoh Streamline Nx V3 Pc Client

Name of the Vulnerable Software and Affected Versions: RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 Description: The issue is related to the use of a less trusted source, which may allow an attacker to conduct a man-in-the-middle attack, eavesdrop on upgrade requests, and execute a...

PT-2025-25443 · Unknown · Goodby-Csv

Name of the Vulnerable Software and Affected Versions: goodby-csv versions prior to 1.4.3 Description: The issue concerns an insecure deserialization vulnerability in the goodby-csv library, which can be used as part of a "gadget chain" to achieve remote code execution if an application...

PT-2025-25419 · Tenable · Tenable Agent

Name of the Vulnerable Software and Affected Versions: Tenable Agent versions prior to 10.8.5 Description: A non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation on a Windows host. Recommendations: For Tenable...

PT-2025-25399 · WordPress · Auto Attachments

Name of the Vulnerable Software and Affected Versions: Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-25376 · WordPress · Link Shield

Name of the Vulnerable Software and Affected Versions: The Link Shield plugin for WordPress versions up to, and including, 0.5.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the link shield menu options function. This allows...

PT-2025-25381 · WordPress · Indieblocks

Name of the Vulnerable Software and Affected Versions: IndieBlocks plugin for WordPress versions up to, and including, 0.13.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-25418 · Tenable · Tenable Agent

Name of the Vulnerable Software and Affected Versions: Tenable Agent versions prior to 10.8.5 Description: A non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege on a Windows host. Recommendations: For Tenable Agent versions prior to 10.8.5,...

PT-2025-25341 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11 Description: The issue concerns an open-source framework designed for privacy-enhancing technologies such as Federated Learning and Multi-Party Computation. If an attacker gains access to an authenticated...

PT-2025-25337 · Euroinformation · Euroinformation Moneticopaiement

Name of the Vulnerable Software and Affected Versions: EuroInformation MoneticoPaiement module for PrestaShop version 1.1.1 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to "transaction.php",...

PT-2025-25343 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11.0 Description: The vantage6 server has a predictable JWT secret key generation issue. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This issue...

PT-2025-25330 · Unknown · Pg-Promise

Name of the Vulnerable Software and Affected Versions: pg-promise versions prior to 11.5.5 Description: The issue is related to SQL Injection due to improper handling of negative numbers. Recommendations: For versions prior to 11.5.5, update to version 11.5.5 or later to resolve the issue...

PT-2025-25345 · Citizen · Citizen

Name of the Vulnerable Software and Affected Versions: Citizen versions prior to 3.3.1 Description: The issue arises from the insertion of various preferences messages into raw HTML, allowing editors of those messages to insert arbitrary HTML into the DOM. This could potentially lead to malicious...

PT-2025-25281 · WordPress · Workreap

Name of the Vulnerable Software and Affected Versions: Workreap plugin for WordPress versions up to and including 3.3.2 Description: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, exhibits a flaw that allows for arbitrary file uploads. This is due...

PT-2025-25178 · Ossec · Ossec Hids Agent For Windows

Name of the Vulnerable Software and Affected Versions: OSSEC HIDS agent for Windows versions prior to 3.8.0 Description: The issue is related to improper input validation, allowing an attacker with control over the OSSEC server or in possession of the agent's key to configure the agent to connect...

PT-2025-25292 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.7 through 17.10.8 GitLab CE/EE versions 17.11 through 17.11.4 GitLab CE/EE versions 18.0 through 18.0.2 Description: An issue has been discovered in GitLab CE/EE that allows an attacker to trigger an infinite redirect...

PT-2025-25223 · Drupal · Drupal Admin Audit Trail

Name of the Vulnerable Software and Affected Versions: Drupal Admin Audit Trail versions 0.0.0 through 1.0.4 Description: The issue is related to the allocation of resources without limits or throttling in Drupal Admin Audit Trail, allowing excessive allocation. Recommendations: For versions 0.0....

PT-2025-25184 · Qt Company +1 · Qt +1

Name of the Vulnerable Software and Affected Versions: Qt versions 6.9.0 Description: The issue is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module, affecting only HTTP/2 handling. This occurs due to a race condition between uploading the body of a POST reque...

PT-2025-25177 · Wazuh · Wazuh Agent For Windows

Name of the Vulnerable Software and Affected Versions: Wazuh agent for Windows versions prior to 4.8.0 Description: The issue is caused by improper input validation in the Wazuh agent for Windows, allowing an attacker with control over the Wazuh server or agent key to configure the agent to conne...