PT-2024-10121

Name of the Vulnerable Software and Affected Versions Python versions 3.12.0 through 3.12.x Python versions prior to 3.14.0a2 Description The issue is related to the asyncio. SelectorSocketTransport.writelines method, which does not properly "pause" writing and signal to the Protocol to drain the...

PT-2024-9986 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Linux before build 39185 Description: The issue is related to the use of a weak algorithm for signing RPM packages in the Acronis Cyber Protect Cloud Agent for Linux. This weakness can potentially allow an...

PT-2024-16984 · WordPress · Stars Testimonials

Name of the Vulnerable Software and Affected Versions: Stars Testimonials plugin for WordPress versions up to, and including, 3.3.3 Description: The Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion via the stars-testimonials-with-slider-and-masonry-grid shortcode. Thi...

PT-2025-11225

Name of the Vulnerable Software and Affected Versions libxslt versions prior to 1.1.43 libxslt versions 1.1.34-4ubuntu0.20.04.2 libxslt versions 1.1.35-1+deb12u1 Description libxslt is a library used for transforming XML files into other formats using XSLT. A use-after-free issue exists in the...

PT-2024-17004 · WordPress · Wordpress Pinterest Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Pinterest Plugin versions up to, and including, 1.8.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gs pin widget' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-36007 · Unknown · Mobile Security Framework

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 3.9.7 Description: The issue concerns a server-side request forgery vulnerability. It occurs when the requests.get request in the check url method is set to allow redirects=True, allowing a...

PT-2024-36935 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the LoongArch system, where invalid huge pte entries should be marked as invalid pte table or have a single PAGE...

PT-2024-35857 · WordPress · Wp Mermaid

Name of the Vulnerable Software and Affected Versions: WP Mermaid versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious scripts into the...

PT-2024-35855 · Elementor · Elementor Button Plus

Name of the Vulnerable Software and Affected Versions: Elementor Button Plus versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-26463 · FFmpeg +2 · Ffmpeg +2

Name of the Vulnerable Software and Affected Versions: FFmpeg version n6.1.1 Description: A potential security issue exists in FFmpeg due to insufficient validation of certain parameters when parsing Speex codec extradata. This could lead to integer overflow conditions, resulting in undefined...

PT-2024-16479 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web versions prior to 1.8.31 Description: The issue concerns a Stored Cross-Site Scripting XSS vulnerability. It arises because the plugin does not properly sanitise and escape some of its settings, allowing...

PT-2024-16540 · WordPress · The Restaurant & Cafe Addon For Elementor

Name of the Vulnerable Software and Affected Versions: The Restaurant & Cafe Addon for Elementor plugin for WordPress versions up to, and including, 1.5.9 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts...

PT-2025-15430 · Fortinet · Fortiisolator

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator versions prior to 2.4.6 Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows a privileged attacker with a super-adm...

PT-2024-16611 · WordPress · Sugar Calendar

Name of the Vulnerable Software and Affected Versions: Sugar Calendar – Simple Event Management plugin for WordPress versions prior to 3.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper escaping on the URL...

PT-2024-33249 · Qurouter · Qurouter

Name of the Vulnerable Software and Affected Versions: QuRouter versions prior to 2.4.4.106 Description: An OS command injection issue has been reported, potentially allowing local network attackers to execute commands if exploited. Recommendations: For QuRouter versions prior to 2.4.4.106, updat...

PT-2024-10401

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.4.2 Description The algorithm used for parsing HTTP cookies in Tornado sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in...

PT-2024-16570 · Codeastrology · The Product Table For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Table for WooCommerce by CodeAstrology plugin for WordPress versions up to, and including, 3.5.1 Description: The issue allows unauthenticated attackers to expose sensitive information via the var dump table parameter. This makes ...

PT-2024-34601 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: Gibbon versions prior to 28.0.00 Description: The issue allows a remote attacker to obtain sensitive information via the email parameter found in the "/Gibbon/modules/User Admin/user manage editProcess.php" API endpoint. Recommendations: For...

PT-2024-35393 · 2Fauth · 2Fauth

Name of the Vulnerable Software and Affected Versions: 2FAuth versions prior to 5.4.1 Description: The issue is related to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. An attacker can upload a malicious SVG containing JS code, which could compromise a...

PT-2024-9898

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.9.14, 4.13.2, and 5.5.2 Description Craft CMS is susceptible to a remote code execution issue. This affects users whose php.ini configuration has register argc argv enabled. An unspecified remote code execution vector is...