PT-2025-20411 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList versions 3.6.3 through 3.6.14 Description: The issue concerns Reflected Cross-Site Scripting XSS via the "/lists/dl.php" endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly...

PT-2025-20370 · Danfoss · Danfoss Ak-Sm 8Xxa Series

Name of the Vulnerable Software and Affected Versions: Danfoss AK-SM 8xxA Series versions prior to 4.2 Description: The issue is related to an improper authentication vulnerability in the Danfoss AKSM8xxA Series. This vulnerability affects the Danfoss AK-SM 8xxA Series prior to version 4.2...

PT-2025-20035 · WordPress · Wz Followed Posts

Name of the Vulnerable Software and Affected Versions: WZ Followed Posts – Display what visitors are reading plugin for WordPress versions up to and including 3.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode due to insufficient input...

PT-2025-20157 · Woocommerce · Acowebs Dynamic Pricing With Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: acowebs Dynamic Pricing With Discount Rules for WooCommerce versions prior to 4.5.9 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This...

PT-2025-20222 · Unknown · The Photo Gallery – Gt3 Image Gallery & Gutenberg Block Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery versions through 2.7.7.25 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS...

PT-2025-20022 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: A NULL Pointer Dereference in RT-Labs P-Net allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. Recommendations: For RT-Labs P-Net...

PT-2025-20194 · Mario Peshev · Wp-Crm System

Name of the Vulnerable Software and Affected Versions: Mario Peshev WP-CRM System versions 3.4.1 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For Mario Peshev WP-CRM System versions 3.4.1 and earlier, update to...

PT-2025-20040 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to SMR May-2025 Release 1 Description: The issue concerns the improper export of Android application components in NotificationHistoryImageProvider, allowing local attackers to access notification images. This could...

PT-2025-20085 · Unknown · Meow Gallery

Name of the Vulnerable Software and Affected Versions: Meow Gallery versions through 5.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

PT-2025-20219 · Unknown · Credova Financial

Name of the Vulnerable Software and Affected Versions: Credova Financial versions n/a through 2.5.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.5.0, update to a version that include...

PT-2025-20118 · Unknown · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks versions n/a through 3.2.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS attacks. Recommendations: For...

PT-2025-20031 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions through 1.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in BOINC Server. Recommendations: For BOI...

PT-2025-20184 · Ablocks · Ablocks

Name of the Vulnerable Software and Affected Versions: aBlocks versions 1.9.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-20057 · Samsung · Samsung Flow

Name of the Vulnerable Software and Affected Versions: Samsung Flow versions prior to 4.9.17.6 Description: The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to modify the configuration. This could potentially lead to unauthorized changes in...

PT-2025-20225 · Unknown · Wp Maintenance

Name of the Vulnerable Software and Affected Versions: WP Maintenance versions through 6.1.9.7 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions through 6.1.9.7, update to a version that contains a fix for this...

PT-2025-20173 · Unknown · Syed Balkhi Beacon Lead Magnets/Lead Capture

Name of the Vulnerable Software and Affected Versions: Syed Balkhi Beacon Lead Magnets and Lead Capture versions 1.5.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross-Site Request Forgery. This means an attacker can trick a user...

PT-2025-20121 · Unknown · Publishpress Authors

Name of the Vulnerable Software and Affected Versions: PublishPress Authors versions through 4.7.5 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-20196 · Unknown · Raihanul Islam Awesome Gallery

Name of the Vulnerable Software and Affected Versions: Raihanul Islam Awesome Gallery versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2025-20043 · Unknown · Unifiedwfc

Name of the Vulnerable Software and Affected Versions: UnifiedWFC versions prior to SMR May-2025 Release 1 Description: The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to manipulate VoWiFi related behaviors. This could potentially be...

PT-2025-20191 · Unknown · Dofollow Case By Case

Name of the Vulnerable Software and Affected Versions: DoFollow Case by Case versions through 3.5.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...