PT-2025-24562 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

PT-2025-24472 · Miniorange · Miniorange Password Policy Manager

Name of the Vulnerable Software and Affected Versions: miniOrange Password Policy Manager versions 2.0.4 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing Authentication Abuse. Recommendations: For miniOrange Password Policy...

PT-2025-24470 · Unknown · Valen - Sport

Name of the Vulnerable Software and Affected Versions: Valen - Sport, Fashion WooCommerce WordPress Theme versions n/a through 2.4 Description: The issue affects the Valen - Sport, Fashion WooCommerce WordPress Theme, allowing for PHP Local File Inclusion due to improper control of filename for...

PT-2025-24463 · Woocommerce · Ticketbai Facturas Para Woocommerce

Name of the Vulnerable Software and Affected Versions: TicketBAI Facturas para WooCommerce versions 3.19 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-24523 · Thimpress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes versions n/a through 1.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThimPress WP Pipes...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

PT-2025-24492 · Fantasticplugins · Sumo Affiliates Pro

Name of the Vulnerable Software and Affected Versions: FantasticPlugins SUMO Affiliates Pro versions n/a through 10.7.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 10.7.0,...

PT-2025-24468 · Bzotheme · Bzotheme Giftxtore

Name of the Vulnerable Software and Affected Versions: BZOTheme GiftXtore versions 1.7.4 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24538

Name of the Vulnerable Software and Affected Versions Mikado-Themes Grill and Chow versions 1.6 and earlier Description The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability affects Mikado-Themes Grill and Chow, enabling potential access to sensitive...

PT-2025-24564 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the...

PT-2025-24567 · Vue.Js · Vue-Cli

Name of the Vulnerable Software and Affected Versions: vuejs vue-cli versions up to 5.0.8 Description: A vulnerability was found in the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficien...

PT-2025-24529 · Unknown · Unfoldwp Blogmine

Name of the Vulnerable Software and Affected Versions: Unfoldwp Blogmine versions 1.1.7 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24522 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX versions through 4.2.22 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions through 4.2.22, update to a version later...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...

PT-2025-24361 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through the get permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

WordPress LTL Freight Quotes – Day & Ross Edition plugin <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via expirydate Parameter vulnerability discovered by sterva in WordPress Plugin LTL Freight Quotes – Day & Ross Edition versions = 2.1.10...

PT-2025-24134 · Unknown · Arildur Read More Login

Name of the Vulnerable Software and Affected Versions: arildur Read More Login versions n/a through 2.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-24258 · Konami · Konami Easter Egg

Name of the Vulnerable Software and Affected Versions: Konami Easter Egg versions n/a through v0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Konami Easter Egg. Recommendations: For versions n/a through v0.4, update to a version that...

PT-2025-24293 · Qnap · Qsync Central

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.6 Description: A use of externally-controlled format string vulnerability has been reported. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data ...

PT-2025-24253 · WordPress · Agile Logix Store Locator

Name of the Vulnerable Software and Affected Versions: Agile Logix Store Locator WordPress versions 1.5.2 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For Agile Log...