PT-2025-24139 · Unknown · Mva7 The Holiday Calendar

Name of the Vulnerable Software and Affected Versions: mva7 The Holiday Calendar versions n/a through 1.18.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in mva7 The Holiday...

PT-2025-24217 · WordPress · Bill Minozzi Wp Tools

Name of the Vulnerable Software and Affected Versions: Bill Minozzi WP Tools versions n/a through 5.24 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Bill Minozzi WP Tool...

PT-2025-24242 · WordPress · Persian Woocommerce Sms

Name of the Vulnerable Software and Affected Versions: Persian Woocommerce SMS versions 7.0.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24304 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4791 Description: An improper certificate validation issue has been reported, potentially allowing remote attackers with user access to compromise system security. Recommendations: For versions prior to...

PT-2025-24157 · WordPress · Wp Biographia

Name of the Vulnerable Software and Affected Versions: WP Biographia versions prior to 4.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24146 · Wordlift · Wordlift

Name of the Vulnerable Software and Affected Versions: WordLift versions 3.54.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WordLift versions 3.54.4 and...

PT-2025-24166 · Unknown · Melipayamak

Name of the Vulnerable Software and Affected Versions: Melipayamak versions through 2.2.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...

PT-2025-24036 · WordPress · Wp Knowledgebase

Name of the Vulnerable Software and Affected Versions: Knowledge Base plugin for WordPress versions prior to 2.3.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the kbalert shortcode. This allows authenticated attackers with...

PT-2025-24208 · Unknown · Cmoreira Testimonials Showcase

Name of the Vulnerable Software and Affected Versions: cmoreira Testimonials Showcase versions 1.9.16 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For version...

PT-2025-24145 · Unknown · Faaiq Custom Category/Post Type Post Order

Name of the Vulnerable Software and Affected Versions: faaiq Custom Category/Post Type Post order versions 1.5.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations:...

PT-2025-24213 · Verge3D · Verge3D

Name of the Vulnerable Software and Affected Versions: Verge3D versions 4.9.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For Verge3D versions 4.9.4 and...

PT-2025-24054 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache versions prior to the fixed version Description: A missing protection against path traversal allows access to any file on the server. This issue affects the Apache software, allowing unauthorized access to files. Recommendations: For...

PT-2025-24087 · Gravity Forms · Real Time Validation For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Real Time Validation for Gravity Forms versions 1.7.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed. This issue can be exploited to perform actions on beha...

PT-2025-24066

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description A missing authorization issue allows remote attackers to modify system settings without prior authorization. Recommendations For versions prior to...

PT-2025-24306 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: An improper certificate validation issue has been reported, allowing a remote attacker with a user account to compromise the system's security. Recommendations: For versions prior to...

PT-2025-24187 · Unknown · Elite Video Player

Name of the Vulnerable Software and Affected Versions: Elite Video Player versions 10.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Elite Video Player, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Elite Video Player...

PT-2025-24077 · WordPress · Simple History

Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...

PT-2025-24302 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4791 Description: An improper certificate validation issue has been reported, potentially allowing remote attackers with user access to compromise system security. Recommendations: For versions prior to...

PT-2025-24162 · Unknown · Nickduncan Contact Form

Name of the Vulnerable Software and Affected Versions: NickDuncan Contact Form versions n/a through 2.0.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker...

PT-2025-24078 · WordPress · Wp Posts Carousel

Name of the Vulnerable Software and Affected Versions: WP Posts Carousel versions 1.3.12 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in WP Posts Carousel. Recommendations: For WP Posts Carousel versions 1.3.12 and earlier, upda...