Medium: runfinch-finch

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...

PT-2025-5545 · Ip2Location · Ip2Location Country Blocker

Name of the Vulnerable Software and Affected Versions: IP2Location Country Blocker versions prior to 2.38.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS attacks. This means that an attacker can...

PT-2025-2222 · WordPress · Simple Gallery With Filter

Name of the Vulnerable Software and Affected Versions: Simple Gallery with Filter plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'c2tw sgwf' shortcode due to insufficient input sanitization and output...

PT-2025-4642 · Unknown · Mdjm Event Management

Name of the Vulnerable Software and Affected Versions: MDJM Event Management versions 1.7.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables an attacker to injec...

PT-2025-2244 · Sperse.Io · Automate Hub Free

Name of the Vulnerable Software and Affected Versions: Automate Hub Free by Sperse.IO plugin for WordPress versions up to and including 1.7.0 Description: The issue is due to missing or incorrect nonce validation on the 'automate hub' page, making it possible for unauthenticated attackers to upda...

PT-2025-2843

Name of the Vulnerable Software and Affected Versions ARPrice versions n/a through 4.0.3 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables attackers to inject malicious...

PT-2025-2824 · WordPress · Hero Mega Menu - Responsive Wordpress Menu Plugin

Name of the Vulnerable Software and Affected Versions: Hero Mega Menu - Responsive WordPress Menu Plugin versions 1.16.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an...

PT-2025-4287 · Oracle +1 · Mysql Server

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 9.1.0 and prior Description: The issue is related to the Server: Optimizer component of MySQL Server, which can be easily exploited by an attacker with low privileges and network access via multiple protocols. This can...

PT-2025-5260 · Vim +6 · Vim +6

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.1043 Description: A segmentation fault was found in Vim. In silent Ex mode -s -e, Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function th...

PT-2025-7094 · Dcmtk +2 · Dcmtk +2

Name of the Vulnerable Software and Affected Versions: DCMTK versions 3.6.9+ DEV Description: A buffer overflow in DCMTK allows attackers to cause a Denial of Service DoS via a crafted DCM file. Recommendations: For DCMTK versions 3.6.9+ DEV, update to a version that fixes the buffer overflow iss...

Fedora 41 : chromium (2025-d9219c6a43)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d9219c6a43 advisory. Update to 132.0.6834.83 High CVE-2025-0434: Out of bounds memory access in V8 High CVE-2025-0435: Inappropriate implementation in Navigation High...

PT-2025-4985 · Unknown · Gordon French Comment-Emailer

Name of the Vulnerable Software and Affected Versions: Gordon French Comment-Emailer versions 1.0.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4927 · WordPress · Wp Lyrics

Name of the Vulnerable Software and Affected Versions: WP Lyrics versions 0.4.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

PT-2025-4915 · WordPress · Wordpress Logging Service

Name of the Vulnerable Software and Affected Versions: WordPress Logging Service versions 1.5.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

PT-2025-4880 · Marvinlabs · Wp Pt-Viewer

Name of the Vulnerable Software and Affected Versions: MarvinLabs WP PT-Viewer versions prior to 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables an attacker to...

PT-2025-5081 · Wpbakery · Gmaps For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: GMAPS for WPBakery Page Builder Free versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-5084 · Unknown · Pravin Durugkar User Sync Activecampaign

Name of the Vulnerable Software and Affected Versions: Pravin Durugkar User Sync ActiveCampaign versions 1.3.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

CVE-2024-52005

A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with "remote:" and printed directly to the standard error output. Typically, thi...

CVE-2024-52005 The sideband payload is passed unfiltered to the terminal in git

Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the...

PT-2025-4575 · Ncipher · Nciphers Seo Bulk Editor

Name of the Vulnerable Software and Affected Versions: NCiphers SEO Bulk Editor versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...