PT-2025-15754 · Unknown · Af Tell A Friend

Name of the Vulnerable Software and Affected Versions: AF Tell a Friend versions 1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15841 · National Instruments · Ni Labview

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions prior to 2025 Q1 Description: The issue is related to a DLL hijacking vulnerability due to an uncontrolled search path in NI LabVIEW, which may result in arbitrary code execution. Successful exploitation requires an attack...

PT-2025-15846 · Onthegosystems · Woocommerce Multilingual & Multicurrency

Name of the Vulnerable Software and Affected Versions: WooCommerce Multilingual & Multicurrency versions 5.3.8 and earlier Description: The issue affects the OnTheGoSystems WooCommerce Multilingual & Multicurrency plugin, where a Missing Authorization vulnerability allows exploitation of...

PT-2025-15787 · WordPress · Click & Pledge Connect Plugin

Name of the Vulnerable Software and Affected Versions: Click & Pledge Connect Plugin versions 2.24080000 through WP6.6.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-15792 · Woocommerce · Chillpay Woocommerce

Name of the Vulnerable Software and Affected Versions: ChillPay WooCommerce versions through 2.5.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

PT-2025-15698 · Pbootcms · Pbootcms

Name of the Vulnerable Software and Affected Versions: PbootCMS version 3.2.9 Description: The issue is related to a XSS vulnerability. It affects the "admin.php?p=/Content/index/mcode/2tab=t2" endpoint. Recommendations: For PbootCMS version 3.2.9, update to a version that fixes this issue, as th...

PT-2025-15676

Name of the Vulnerable Software and Affected Versions: Mdecservice versions prior to SMR Apr-2025 Release 1 Description: The issue is related to improper access control, allowing local attackers to access arbitrary files with system privilege. Recommendations: For versions prior to SMR Apr-2025...

PT-2025-15692 · Flowise · Flowise

Name of the Vulnerable Software and Affected Versions: Flowise versions 2.2.3 and earlier Description: The issue is related to SQL Injection, which occurs via the tableName parameter at Postgres VectorStores. This allows for potential exploitation. Recommendations: For versions 2.2.3 and earlier,...

PT-2025-15774 · Waymark · Waymark

Name of the Vulnerable Software and Affected Versions: Waymark versions n/a through 1.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-15696 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.4 through 12.1 Description: The issue allows a privileged user to read any file on the system due to incorrect privilege assignment. Recommendations: For versions 11.4 through 12.1, update to a version that...

PT-2025-15815 · Unknown · Nepali Date Utilities

Name of the Vulnerable Software and Affected Versions: Nepali Date Utilities versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-15843 · National Instruments · Ni Labview

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions prior to 2025 Q1 Description: The issue is an out of bounds write vulnerability due to improper bounds checking in NI LabVIEW when reading CPU info from cache. This may result in information disclosure or arbitrary code...

PT-2025-15811 · Ip2Location · Ip2Location Ip2Location World Clock

Name of the Vulnerable Software and Affected Versions: ip2location IP2Location World Clock versions 1.1.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker could potentially trick a user into performing...

PT-2025-15739 · Unknown · Woo Product Feed For Marketing Channels

Name of the Vulnerable Software and Affected Versions: Woo Product Feed For Marketing Channels versions 1.9.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-15703 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN versions prior to 9.13.4 Description: The issue allows manipulation of a URL for the ImageHandler to render text from a querystring parameter. This text would be displayed in the resulting image, potentially deceiving users who trust the...

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

PT-2025-15344

Name of the Vulnerable Software and Affected Versions: secfr trustlet versions prior to SMR Apr-2025 Release 1 Description: The issue allows local privileged attackers to cause memory corruption due to an out-of-bounds write in the secfr trustlet. Recommendations: For versions prior to SMR Apr-20...

PT-2025-15630 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2022.6 and earlier Adobe Framemaker version 2020.8 Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to...

PT-2025-15617 · Adobe · Animate

Name of the Vulnerable Software and Affected Versions: Animate versions 24.0.7 and earlier Description: The issue is related to a Heap-based Buffer Overflow that could lead to arbitrary code execution in the context of the current user. To exploit this, a victim must open a malicious file,...