PT-2025-28862 · Unknown · Datasync Center

Name of the Vulnerable Software and Affected Versions: DataSync Center versions 1.1.0 through 1.1.0.r207 DataSync Center versions 1.2.0 through 1.2.0.r206 Description: A security bypass issue allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the...

PT-2025-28838 · Unknown · Sala - Startup & Saas Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Sala - Startup & SaaS WordPress Theme versions prior to 1.1.5 Description: The issue arises from the theme's failure to properly validate a user's identity before updating their details, such as the password. This allows unauthenticated...

PT-2025-28858 · Asustor · Asustor Adm

Name of the Vulnerable Software and Affected Versions: ASUSTOR ADM versions 4.1 through 4.3.1.R5A0 Description: The issue is related to improper input validation, allowing arbitrary values to be injected into the NAS configuration file. This could lead to system misconfiguration, breaking the...

PT-2025-28964 · Unknown · Docusaurus-Plugin-Content-Gists

Name of the Vulnerable Software and Affected Versions: docusaurus-plugin-content-gists versions prior to 4.0.0 Description: The Docusaurus gists plugin displays public gists of a GitHub user on a Docusaurus instance. Versions prior to 4.0.0 inadvertently include GitHub Personal Access Tokens in...

PT-2025-28965 · WordPress · Events Manager – Calendar

Name of the Vulnerable Software and Affected Versions: Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress versions prior to 7.0.4 Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress version 6.6.5 Description: The Events Manager plugin for WordPre...

PT-2025-29072 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions prior to 18.0.4 GitLab EE versions prior to 18.1.2 Description: An issue allows authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionalit...

PT-2025-29075 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 18.0 through 18.0.3 GitLab EE versions 18.1 through 18.1.1 Description: An issue allows authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests. Recommendations: Update t...

PT-2025-28958 · Builder.Io · @Builder.Io/Qwik-City

Name of the Vulnerable Software and Affected Versions: @builder.io/qwik-city versions prior to 1.13.0 Description: The @builder.io/qwik-city meta-framework for Qwik is susceptible to an issue where improper handling of invalid qfunc during the execution of a Qwik Server Action QRL can lead to a...

PT-2025-28407 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: The issue allows an attacker to retrieve, create, update, and delete databases through the id concesion parameter in the "/FacturaE/DescargarFactura" endpoint. Recommendations: For versions...

PT-2025-28743 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier ColdFusion versions prior to 2025.3 Description: The issue is related to an incorrect authorization vulnerability that could result in a security feature bypass. A low-privileged attack...

PT-2025-29166 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.4.0a Description: Brocade SANnav logs passwords and Private Bag Encryption PBE keys in the server audit logs after installation and under specific conditions. These logs are part of the local server Virtual...

PT-2025-28411 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: The issue allows an attacker to retrieve, create, update, and delete databases through the suceso.contenido mensaje in /QMSCliente/Sucesos.action. This is a SQL injection vulnerability that...

PT-2025-28803

Name of the Vulnerable Software and Affected Versions: Support Board plugin for WordPress versions prior to 3.8.1 Description: The Support Board plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the sb file delete function. This flaw allo...

PT-2025-28406 · Unknown · Quiter Gateway

Name of the Vulnerable Software and Affected Versions: Quiter Gateway versions prior to 4.7.0 Description: The issue allows an attacker to retrieve, create, update, and delete databases through the id concesion parameter in the "/FacturaE/VerFacturaPDF" endpoint. Recommendations: For versions pri...

PT-2025-28782

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8, 2022.6 and earlier Description: The issue is an Integer Underflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

CVE-2025-3044

The CVE-2025-3044 affects the ArxivReader class in the llama_index project. Versions up to v0.12.22.post1 are vulnerable to MD5 hash collisions when generating filenames for downloaded papers, which can cause papers with identical titles but different contents to overwrite each other, leading to ...

PT-2025-28167

Name of the Vulnerable Software and Affected Versions: Dagster versions prior to 1.5.12 Description: A Directory Traversal issue allows remote attackers to obtain sensitive information via crafted requests to the "/logs" endpoint. This may be restricted to certain file names that start with a dot...

PT-2025-28181 · Mediawiki · Mediawiki Quiz Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Quiz Extension versions 1.39.X through 1.39.12 Mediawiki - Quiz Extension versions 1.42.X through 1.42.6 Mediawiki - Quiz Extension versions 1.43.X through 1.43.1 Description: The issue is related to Improper Neutralization of Inp...

PT-2025-28203 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik...

PT-2025-28154 · Mozilla +1 · Firefox +1

Name of the Vulnerable Software and Affected Versions: langgenius/dify versions prior to 1.1.3 Description: An XSS vulnerability exists, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat...