PT-2025-23925 · Rsblog! · Rsblog!

Name of the Vulnerable Software and Affected Versions: RSBlog! component versions 1.11.6 through 1.14.4 Description: A stored XSS issue allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when...

PT-2025-23746

Name of the Vulnerable Software and Affected Versions Samsung Cloud for Galaxy Watch versions prior to SMR Jun-2025 Release 1 Description The issue is related to an incorrect default permission setting in Samsung Cloud for Galaxy Watch, allowing local attackers to access data. This could...

PT-2025-23850 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 2.2.0 through 2.2.4 Description: The issue allows bypassing Deno's permission read/write db permission check by using the ATTACH DATABASE statement. Recommendations: For Deno versions 2.2.0 through 2.2.4, update to version 2.2.5...

PT-2025-23847 · Freshrss · Freshrss

Name of the Vulnerable Software and Affected Versions: FreshRSS versions prior to 1.26.2 Description: The issue allows an attacker to run arbitrary JavaScript on the feeds page by combining a cross-site scripting XSS issue in f.php with the lack of Content Security Policy CSP when SVG favicons ar...

PT-2025-23745

Name of the Vulnerable Software and Affected Versions AudioService versions prior to SMR Jun-2025 Release 1 Description The issue is related to improper access control in the AudioService, allowing local attackers to access sensitive information. Recommendations For versions prior to SMR Jun-2025...

PT-2025-23799 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 4 Description: The issue is a Reflected Cross-Site Scripting XSS that allows an attacker to execute JavaScript code in the victim's browser. This can be achieved by sending a malicious URL using any parameter name in the...

PT-2025-23747

Name of the Vulnerable Software and Affected Versions ThemeManager versions prior to SMR Jun-2025 Release 1 Description The issue is related to improper privilege management, allowing local privileged attackers to reuse trial items. This could potentially be exploited by attackers with local...

PT-2025-23762 · Kro · Kro

Name of the Vulnerable Software and Affected Versions: kro Kube Resource Orchestrator versions 0.1.0 through 0.2.1 Description: The issue allows users with permission to create or modify ResourceGraphDefinition resources to supply arbitrary container images. This can lead to a confused-deputy...

PT-2025-23753 · Samsung · Libsecimaging.Camera.Samsung.So

Name of the Vulnerable Software and Affected Versions: libsecimaging.camera.samsung.so versions prior to SMR Feb-2025 Release 1 Description: The issue is an out-of-bound read that allows local attackers to read out-of-bounds memory. This can be exploited by local attackers. Recommendations: For...

PT-2025-23671

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10 Description DataEase is an open source business intelligence and data visualization tool. The issue arises from a flaw in the patch that allows it to be bypassed due to case insensitivity, as INIT and RUNSCRI...

PT-2025-23649 · Unknown · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 5.2.1 Description: The issue allows an attacker to obtain source code via a method similar to that used to exploit a previously reported vulnerability. This is possible because webpack-dev-server always...

PT-2025-23594 · WordPress · Woocommerce Ultimate Gift Card

Name of the Vulnerable Software and Affected Versions: Ultimate Gift Cards for WooCommerce plugin for WordPress versions prior to 3.1.5 Description: The issue is related to boolean-based SQL Injection via the default price and product id parameters. This is due to insufficient escaping of...

PT-2025-23593 · Unknown · Pc Time Tracer

Name of the Vulnerable Software and Affected Versions: PC Time Tracer versions prior to 5.2 Description: The issue is related to incorrect default permissions in PC Time Tracer. If exploited, a local authenticated attacker could execute arbitrary code with SYSTEM privilege on Windows systems wher...

PT-2025-23648 · Unknown · Webpack-Dev-Server

Name of the Vulnerable Software and Affected Versions: webpack-dev-server versions prior to 5.2.1 Description: The issue allows an attacker to steal users' source code when they access a malicious website. This is possible because the request for a classic script by a script tag is not subject to...

PT-2025-23669 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 Description: A bypass of the patch for a previous issue exists, allowing for the construction of a malicious JDBC statement. In a malicious payload, the getUrlType function retrieves the hostName. Since the...

PT-2025-23658 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 DataEase version 2.10.6 through 2.10.9 Description: The issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection due to a bypass of a previous patch...

PT-2025-23652 · Maxkb · Maxkb

Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.10.8-lts Description: The issue allows attackers to exploit certain files with execution permissions in non-blacklisted directories to carry out attacks, as the Sandbox only restricts the execution permissions of...

PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...

PT-2025-23493 · Arm · Valhall Gpu Kernel Driver +1

Name of the Vulnerable Software and Affected Versions: Valhall GPU Kernel Driver versions r53p0 through r53p0 Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r53p0 Description: The issue allows a local non-privileged user process to perform improper GPU memory processing...

PT-2025-23611

Name of the Vulnerable Software and Affected Versions Python versions 3.12 through 3.13 Description An issue in the tarfile module allows arbitrary filesystem writes outside the extraction directory when extracting untrusted tar archives. This occurs when using the TarFile.extractall or...