PT-2025-29915 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.6 Description: WeGIA is an open source web manager. A SQL Injection issue was identified that allows an attacker to manipulate SQL queries and access sensitive database information. The vulnerability exists in the...

PT-2025-29962 · Sophos · Sophos Intercept X For Windows With Central Device Encryption +1

Name of the Vulnerable Software and Affected Versions: Sophos Intercept X for Windows with Central Device Encryption versions 2025.1 and older Description: A local privilege escalation vulnerability allows arbitrary code execution. Recommendations: Update Sophos Intercept X for Windows with Centr...

PT-2025-29939

Name of the Vulnerable Software and Affected Versions OpenCV versions prior to 4.12.0 Description OpenCV, an Open Source Computer Vision Library, contains an issue where an uninitialized pointer variable on the stack can lead to an arbitrary heap buffer write when processing crafted JPEG images...

PT-2025-29949 · Sophos · Intercept X For Windows

Name of the Vulnerable Software and Affected Versions: Intercept X for Windows versions prior to 2024.3.2 Description: A vulnerability related to registry permissions in the Intercept X for Windows updater can allow a local user to gain SYSTEM level privileges during a product upgrade...

PT-2025-29897 · Alone +1 · Alone +1

Name of the Vulnerable Software and Affected Versions: Bears Backup versions prior to 2.0.1 Description: The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.0.0. This is due to the bbackup ajax handle function lacking capability check...

CVE-2025-53929

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcor.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53932 WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro_adotante.php' parameter 'cpf'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastroadotante.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to...

CVE-2025-53929 WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint `adicionar_cor.php` parameter `cor`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcor.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

WordPress WP Event Manager plugin <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin WP Event Manager versions = 3.1.49...

PT-2025-29730 · Yaycommerce · Yaycommerce Yayextra

Name of the Vulnerable Software and Affected Versions: YayCommerce YayExtra versions through 1.5.5 Description: YayCommerce YayExtra is susceptible to a SQL injection flaw due to improper neutralization of special elements within SQL commands. This allows for potential manipulation of database...

PT-2025-29874 · Hewlett Packard · Hpe Autopass License Server

Name of the Vulnerable Software and Affected Versions: HPE AutoPass License Server APLS versions prior to 9.18 Description: An authentication bypass and information disclosure issue exists in HPE AutoPass License Server APLS. This allows unauthorized access and potential exposure of sensitive...

PT-2025-29860 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: Adobe Experience Manager is susceptible to a DOM-based Cross-Site Scripting XSS issue. A low privileged attacker could exploit this issue by manipulating the DOM environment to...

PT-2025-29747 · Unknown · Contact Form 7

Name of the Vulnerable Software and Affected Versions: HT Contact Form 7 versions n/a through 2.0.0 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion...

PT-2025-29706 · WordPress · Brandfolder

Name of the Vulnerable Software and Affected Versions: Brandfolder plugin for WordPress versions prior to 5.0.20 Description: The Brandfolder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id parameter. Insufficient input sanitization and output escaping allow...

PT-2025-29819 · Unity Business Technology Pty · The E-Commerce Erp

Name of the Vulnerable Software and Affected Versions: The E-Commerce ERP versions n/a through 2.1.1.3 Description: An incorrect privilege assignment issue exists in Unity Business Technology Pty Ltd The E-Commerce ERP, allowing privilege escalation. Recommendations: Update The E-Commerce ERP to ...

PT-2025-29776 · Awethemes · Hillter

Name of the Vulnerable Software and Affected Versions: awethemes Hillter versions through 3.0.7 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update awethemes Hillter to a version later than 3.0.7...

PT-2025-29884 · Idera · Idera Up.Time Monitoring Station

Name of the Vulnerable Software and Affected Versions: Idera Up.Time Monitoring Station versions up to and including 7.2 Description: An unauthenticated arbitrary file upload issue exists. The wizards/post2file.php script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP...

PT-2025-29812 · Unknown · Cmsminds Pay With Contact Form 7

Name of the Vulnerable Software and Affected Versions: cmsMinds Pay with Contact Form 7 versions through 1.0.4 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicio...

PT-2025-29749 · Creativemindssolutions · Cm Pop-Up Banners

Name of the Vulnerable Software and Affected Versions: CM Pop-Up banners versions n/a through 1.8.4 Description: A missing authorization issue exists in CreativeMindsSolutions CM Pop-Up banners due to incorrectly configured access control security levels. Recommendations: Update CM Pop-Up banners...

PT-2025-29715 · WordPress · The Master Addons – Elementor Addons

Name of the Vulnerable Software and Affected Versions: Master Addons – Elementor Addons versions prior to 2.0.8.3 Description: The Master Addons – Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Custom JS extension. Insufficient capability...