PT-2025-22758 · Unknown · Mojoomla School Management

Name of the Vulnerable Software and Affected Versions: mojoomla School Management versions n/a through 92.0.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-22752 · Wpfunnels · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels versions 3.5.18 and earlier Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in WPFunnels. Recommendations: For versions 3.5.18 and earlier, update to a version later than 3.5.18 to...

PT-2025-22761 · Unknown · Khaled User Meta

Name of the Vulnerable Software and Affected Versions: Khaled User Meta versions n/a through 3.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a throug...

PT-2025-22749 · Tainacan · Tainacan

Name of the Vulnerable Software and Affected Versions: Tainacan versions 0.21.14 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access to files and directories outside the...

PT-2025-22690 · Designthemes · Designthemes Pet World

Name of the Vulnerable Software and Affected Versions: designthemes Pet World versions n/a through 2.8 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objects into the...

CVE-2022-36104

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads t...

CVE-2022-23497

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...

CVE-2022-39944

In Apache Linkis =1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in...

CVE-2021-43807

Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE...

CVE-2021-32015

In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Comm...

CVE-2021-43828

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management IDOR has been found in PatrowlManager. All imports findings file is placed under /media/imports// In that, ownerid is predictable and tmpfile is in format o...

CVE-2020-8916

A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver eg: debug environments can allow an attacker to crash the service DoS. We recommend updating, or to...

CVE-2019-7184

This cross-site scripting XSS vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions...

PT-2025-22506 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.12 Description: The issue allows an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side...

PT-2025-22473 · Sandboxie · Sandboxie

Name of the Vulnerable Software and Affected Versions: Sandboxie versions 0.0.1 through 1.15.11 Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An arithmetic overflow in the memory allocation subsystem, specifically within the...

PT-2025-22405 · Unknown · Ackites Killwxapkg

Name of the Vulnerable Software and Affected Versions: Ackites KillWxapkg versions up to 2.4.1 Description: A vulnerability was found in the wxapkg File Decompression Handler component, affecting some unknown processing. This issue leads to resource consumption and can be initiated remotely. The...

PT-2025-22279 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2025.1.74704 Description: The issue concerns restricted attachments becoming visible after issue cloning. Recommendations: For versions prior to 2025.1.74704, update to version 2025.1.74704 or later to...

PT-2025-23276 · Suse · Helm

This update for helm fixes the following issues: help was updated to version 3.17.3: Helm v3.17.3 is a security patch release. Users are strongly recommended to update to this release. Changelog - Unarchiving fix e4da497 Matt Farina...

PT-2025-21956 · Google · Recaptcha

Name of the Vulnerable Software and Affected Versions: reCAPTCHA for all versions n/a through 2.26 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-22084 · Jocoxdesign · Tiger

Name of the Vulnerable Software and Affected Versions: jocoxdesign Tiger tiger versions n/a through 2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a...