PT-2025-22756 · Mapsvg · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions n/a through 8.5.31 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions n/a through 8.5.31, update to ...

PT-2025-22759 · Unknown · Facturante

Name of the Vulnerable Software and Affected Versions: Facturante versions n/a through 1.11 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-22812 · Schule · Schule

Name of the Vulnerable Software and Affected Versions: Schule versions prior to 1.0.1 Description: The issue concerns a lack of proper rate limiting controls in the file forgot password.php, which is responsible for email-based OTP generation. This allows attackers to abuse the OTP request...

PT-2025-22712 · Goodlayers · Goodlayers Hotel

Name of the Vulnerable Software and Affected Versions: Goodlayers Hotel versions 3.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-22683 · WordPress · Enzio

Name of the Vulnerable Software and Affected Versions: Enzio - Responsive Business WordPress Theme versions 1.1.8 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or PHP Local...

PT-2025-22788 · Unknown · Catkin Redi Restaurant Reservation

Name of the Vulnerable Software and Affected Versions: catkin ReDi Restaurant Reservation versions n/a through 24.1209 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means tha...

PT-2025-22764 · Unknown · 6Storage Rentals

Name of the Vulnerable Software and Affected Versions: 6Storage Rentals versions n/a through 2.19.4 Description: The issue is related to a Missing Authorization vulnerability in 6Storage Rentals, which allows Path Traversal. Recommendations: For versions n/a through 2.19.4, update to a version th...

PT-2025-22768 · Woocommerce · Printcart Web To Print Product Designer

Name of the Vulnerable Software and Affected Versions: Printcart Web to Print Product Designer for WooCommerce versions 2.3.8 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to...

PT-2025-22696 · Unknown · Gavias Oxpitan

Name of the Vulnerable Software and Affected Versions: gavias Oxpitan versions 1.3.1 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22650 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.20 Description: The issue arises from the generation of password reset tokens in MegaBIP software, which uses a small space of random values combined with a queryable value. This allows an unauthenticated attacker...

PT-2025-22684 · Unknown · Apustheme Ogami

Name of the Vulnerable Software and Affected Versions: ApusTheme Ogami versions 1.53 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. Thi...

PT-2025-22713 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue affects Nasa Core due to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', allowing PHP Local File Inclusion...

PT-2025-22701 · WordPress · Grand Tour

Name of the Vulnerable Software and Affected Versions: Grand Tour | Travel Agency WordPress versions through 5.5.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited by injecting malicious objects into the...

PT-2025-22648 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.20 Description: The issue arises when a user with high privileges is prompted to provide a reasoning for editing pages managed by MegaBIP. The input provided by the user is not sanitized, leading to a SQL Injection...

PT-2025-22755 · Wpfunnels · Wpfunnels Mail Mint

Name of the Vulnerable Software and Affected Versions: WPFunnels Mail Mint versions 1.17.7 and earlier Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For WPFunnels Mail Mint versions 1.17.7 and...

CVE-2022-36101

Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...

CVE-2021-21402

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public...

CVE-2021-38296

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

CVE-2021-32716

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the...

CVE-2021-39220

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommend...