PT-2025-24146 · Wordlift · Wordlift

Name of the Vulnerable Software and Affected Versions: WordLift versions 3.54.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WordLift versions 3.54.4 and...

PT-2025-24213 · Verge3D · Verge3D

Name of the Vulnerable Software and Affected Versions: Verge3D versions 4.9.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For Verge3D versions 4.9.4 and...

PT-2025-24217 · WordPress · Bill Minozzi Wp Tools

Name of the Vulnerable Software and Affected Versions: Bill Minozzi WP Tools versions n/a through 5.24 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Bill Minozzi WP Tool...

PT-2025-24134 · Unknown · Arildur Read More Login

Name of the Vulnerable Software and Affected Versions: arildur Read More Login versions n/a through 2.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-24292 · Qnap · Qnap Quts Hero +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.2.4.3079 build 20250321 QNAP QuTS hero versions prior to h5.2.4.3079 build 20250321 Description: A command injection issue has been reported, affecting several QNAP operating system versions. This could allow remo...

PT-2025-24175 · Unknown · Wp Gravity Forms Salesforce

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Salesforce versions 1.4.7 and earlier Description: The issue is an 'Open Redirect' vulnerability, which allows URL redirection to untrusted sites, potentially enabling phishing attacks. Recommendations: For versions 1.4.7 and...

PT-2025-26867

Name of the Vulnerable Software and Affected Versions: jackson-core versions prior to 2.15.0 Description: The issue arises when parsing input files with deeply nested data, potentially causing a StackoverflowError due to excessive depth. A configurable limit for traversal depth has been introduce...

Fedora 41 : seamonkey (2025-447d7cb067)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-447d7cb067 advisory. Update to 2.53.21 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

PT-2025-24141 · Woocommerce · Direct Checkout For Woocommerce Lite

Name of the Vulnerable Software and Affected Versions: Direct Checkout for WooCommerce Lite versions 1.0.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions...

PT-2025-24066

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description A missing authorization issue allows remote attackers to modify system settings without prior authorization. Recommendations For versions prior to...

PT-2025-24078 · WordPress · Wp Posts Carousel

Name of the Vulnerable Software and Affected Versions: WP Posts Carousel versions 1.3.12 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in WP Posts Carousel. Recommendations: For WP Posts Carousel versions 1.3.12 and earlier, upda...

PT-2025-24087 · Gravity Forms · Real Time Validation For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Real Time Validation for Gravity Forms versions 1.7.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed. This issue can be exploited to perform actions on beha...

PT-2025-24139 · Unknown · Mva7 The Holiday Calendar

Name of the Vulnerable Software and Affected Versions: mva7 The Holiday Calendar versions n/a through 1.18.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in mva7 The Holiday...

PT-2025-24166 · Unknown · Melipayamak

Name of the Vulnerable Software and Affected Versions: Melipayamak versions through 2.2.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...

PT-2025-24253 · WordPress · Agile Logix Store Locator

Name of the Vulnerable Software and Affected Versions: Agile Logix Store Locator WordPress versions 1.5.2 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For Agile Log...

PT-2025-24077 · WordPress · Simple History

Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...

PT-2025-23876 · Atheros · Atheos

Name of the Vulnerable Software and Affected Versions: Atheos versions prior to 6.0.4 Description: Atheos is a self-hosted browser-based cloud integrated development environment. The improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to...

PT-2025-23895 · WordPress · Wp User Frontend Pro

Name of the Vulnerable Software and Affected Versions: WP User Frontend Pro plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to insufficient file path validation in the delete avatar ajax function, allowing authenticated attackers with Subscriber-level...

PT-2025-23939 · Yii · Yii 2 Redis Extension

Name of the Vulnerable Software and Affected Versions: Yii 2 Redis extension versions prior to 2.0.20 Description: The issue concerns the logging of commands when a connection fails in the Yii 2 Redis extension. Specifically, prior to version 2.0.20, AUTH parameters are written in plain text,...

PT-2025-23923 · Joomla · Rsfirewall

Name of the Vulnerable Software and Affected Versions: RSFirewall component versions 2.9.7 through 3.1.5 for Joomla Description: A path traversal issue allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of...