PT-2025-4409 · Wp Job Manager · Gravity Master Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: Gravity Master Custom Field For WP Job Manager versions n/a through 1.3 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Reflected XSS. This mea...

PT-2025-2645 · Unknown · Themeglow Jobboard

Name of the Vulnerable Software and Affected Versions: ThemeGlow JobBoard Job listing versions 1.2.6 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited by uploading a...

PT-2025-1576 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery WordPress plugin versions prior to 3.2.22 Description: The issue concerns the Rbs Image Gallery WordPress plugin, where some of its Gallery settings are not properly sanitised and escaped. This could allow high privilege...

PT-2025-4519 · WordPress · Huurkalender Wp

Name of the Vulnerable Software and Affected Versions: Huurkalender WP versions 1.5.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

PT-2025-4369 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.7 Description: A Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the "WeGIA/html/socio/sistema/controller/controla xlsx.php" endpoint. By uploading a file containing...

Trix allows Cross-site Scripting via `javascript:` url in a link

The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field. Impact An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute arbitrary JavaScript code within the context of the user's session,...

GHSA-J386-3444-QGWG Trix allows Cross-site Scripting via `javascript:` url in a link

The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field. Impact An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute arbitrary JavaScript code within the context of the user's session,...

PT-2025-1150 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions 16.7.0 through 24.4.0 Description: The issue is related to an XML External Entity XXE injection vulnerability in the GoCD server, which can be exploited by a remote attacker. This vulnerability is associated with the incorrect...

PT-2025-3195 · Maxkb · Maxkb

Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.9.0 Description: MaxKB is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation. A remote command execution issue existed in the function library...

PT-2025-1520 · Nsquared · Nsquared Draw Attention

Name of the Vulnerable Software and Affected Versions: NSquared Draw Attention versions 2.0.15 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 2.0.1...

PT-2025-1482 · Wedevs · Wedevs Wp User Frontend

Name of the Vulnerable Software and Affected Versions: weDevs WP User Frontend versions 3.6.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For weDevs WP User...

PT-2025-16900 · Chromium +4 · Chromium +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 135.0.7049.95 Description: A use after free issue in the USB component of Google Chrome allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue is related to the...

PT-2025-21253

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 24.x Description Node.js is susceptible to a remote crash issue due to a flaw in the SignTraits::DeriveBits function. This flaw can be triggered by malformed crypto input in background threads, leading to a...

PT-2025-30759

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug and earlier. Description A flaw exists in the Linux kernel related to handling in atomic within the do secure storage access function. User space accesses to...

PT-2025-23001

Name of the Vulnerable Software and Affected Versions GIMP versions prior to the fixed version Description A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious...

PT-2025-27861

Name of the Vulnerable Software and Affected Versions: php7.4 php8.2 Description: The software contains package vulnerabilities. These issues were addressed in the php8-8.4.10-1.1 package on openSUSE Tumbleweed. Recommendations: Update to php8-8.4.10-1.1 on openSUSE Tumbleweed...

PT-2025-11343

Name of the Vulnerable Software and Affected Versions PHP versions 8.1. through 8.1.31 PHP versions 8.2. through 8.2.27 PHP versions 8.3. through 8.3.18 PHP versions 8.4. through 8.4.4 Description The issue is related to the incorrect parsing of folded headers in HTTP responses by the http reques...

PT-2025-19757 · Chromium +3 · Chromium +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 136.0.7103.59 chromium in Debian Linux affected versions not specified Description: The issue is related to an inappropriate implementation in DevTools, allowing a remote attacker to bypass discretionary access...

PT-2025-28848

Name of the Vulnerable Software and Affected Versions: Git versions 2.43.7 through 2.49.1 Description: The issue allows for the creation and truncation of any writable file when a user clones an untrusted repository and runs Gitk without additional command arguments, provided the "Support per-fil...

PT-2025-32248

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description An inappropriate implementation in Filesystems within Google Chrome allows a remote attacker to perform UI spoofing through a specially crafted HTML page. The security severity is rated...