PT-2025-16391 · Teigarage · Teigarage

Name of the Vulnerable Software and Affected Versions: TEIGarage versions prior to 1.2.4 Description: The Document Conversion Service in TEIGarage contains a critical XML External Entity XXE Injection issue in its document conversion functionality. This allows an attacker to read arbitrary files...

PT-2025-16411 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.9.2 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools, requiring human interaction from a person other...

PT-2025-16452 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.14 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks can result in unauthorized update,...

PT-2025-16221 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.1 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 9.11.x through 9.11.9 Description: The issue arises from the failure to restrict certain operations on system admins to only other system...

PT-2025-16224 · Allegro · My Auctions Allegro

Name of the Vulnerable Software and Affected Versions: My auctions allegro versions 3.6.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-16226 · Softcom · Softcom Iksoris Internet Starter

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, which causes the script...

PT-2025-16387 · Pleezer · Pleezer

Name of the Vulnerable Software and Affected Versions: pleezer versions prior to 0.16.0 Description: The issue arises from hook scripts in pleezer being spawned without proper process cleanup, leading to zombie processes in the system's process table. This occurs with every track change and...

PT-2025-17420

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.21.4 Description The issue arises from the phase one correct function in decoders/load mfbacks.cpp, which allows out-of-buffer access. This occurs because the split col and split row values are not checked during the...

PT-2025-16385

Name of the Vulnerable Software and Affected Versions Argo Events versions prior to 1.9.6 Description Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create or modify EventSource and Sensor custom resources can gain privileged access to the...

PT-2025-16162 · WordPress · Wordpress Mega Menu – Quadmenu

Name of the Vulnerable Software and Affected Versions: The WordPress Mega Menu – QuadMenu plugin for WordPress versions up to, and including, 3.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax dismiss notice function. Thi...

PT-2025-36: Local Privilege Escalation (LPE) in Amnezia VPN

The vulnerability was identified in Amnezia VPN, versions to 4.8.6.0, on MacOS. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 12.04.2025 Recommendations: Update to...

PT-2025-16025

Name of the Vulnerable Software and Affected Versions: InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress versions up to, and including, 0.1.0.85 Description: The InstaWP Connect plugin is vulnerable to Local File Inclusion via the instawp-database-manager parameter. This allow...

PT-2025-16049 · Unknown · N-Media Bulk Product Sync

Name of the Vulnerable Software and Affected Versions: N-Media Bulk Product Sync versions n/a through 8.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially...

PT-2025-16080 · Unknown · Miunosoft Task Scheduler

Name of the Vulnerable Software and Affected Versions: miunosoft Task Scheduler versions 1.6.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables potential attackers to...

PT-2025-16083 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...

PT-2025-16094 · Unknown · Notfound Testimonial Slider/Showcase Pro

Name of the Vulnerable Software and Affected Versions: NotFound Testimonial Slider And Showcase Pro versions 2.3.15 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows P...

PT-2025-16097 · Unknown · G5Theme Ultimate Bootstrap Elements For Elementor

Name of the Vulnerable Software and Affected Versions: g5theme Ultimate Bootstrap Elements for Elementor versions 1.4.9 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allo...

PT-2025-16076 · Woocommerce · Aba Payway Payment Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: ABA PayWay Payment Gateway for WooCommerce versions prior to 2.1.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables an attacker...

PT-2025-16144 · Mediawiki · Mediawiki Mobilefrontend Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Mobile Frontend Extension versions 1.39 through 1.43 Description: The issue affects the Mediawiki - Mobile Frontend Extension, allowing exposure of sensitive information to an unauthorized actor. This enables shared resource...

PT-2025-16084 · WordPress · Wpbookingly

Name of the Vulnerable Software and Affected Versions: WpBookingly versions 1.2.0 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection in WpBookingly. Recommendations: For versions 1.2.0 and earlier, update to a version that contain...