PT-2025-27224 · Unknown · Track Everything

Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-27065 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar plugin for WordPress versions prior to 2.4.8 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for...

PT-2025-27062 · WordPress · Buddypress Docs

Name of the Vulnerable Software and Affected Versions: BuddyPress Docs WordPress plugin version 2.2.4 and earlier Description: The issue is related to inadequate access controls in the BuddyPress Docs WordPress plugin, allowing a logged-in user to view and download files belonging to another user...

PT-2025-27093 · Unknown · Content No Cache

Name of the Vulnerable Software and Affected Versions: Content No Cache versions 0.1.3 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability affects the Content No Cache software...

PT-2025-27187 · Unknown · Antoineh Football Pool

Name of the Vulnerable Software and Affected Versions: AntoineH Football Pool versions n/a through 2.12.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-27197 · Unknown · Smart Agenda

Name of the Vulnerable Software and Affected Versions: Smart Agenda versions n/a through 4.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Specifically, it is a Stored XSS vulnerability, which means that the...

PT-2025-27107 · Arraytics · Arraytics Eventin

Name of the Vulnerable Software and Affected Versions: Arraytics Eventin versions through 4.0.28 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions through...

PT-2025-27063 · WordPress · A/B Testing For Wordpress

Name of the Vulnerable Software and Affected Versions: A/B Testing for WordPress plugin versions up to and including 1.18.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on the id parameter in the...

PT-2025-27225 · Unknown · Resume Builder

Name of the Vulnerable Software and Affected Versions: My Resume Builder versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

PT-2025-27134

Name of the Vulnerable Software and Affected Versions: themehunk Zita versions 1.6.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-27207 · Zealousweb · Zealousweb Accept Stripe Payments Using Contact Form 7

Name of the Vulnerable Software and Affected Versions: ZealousWeb Accept Stripe Payments Using Contact Form 7 versions 3.0 and earlier Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For ZealousW...

PT-2025-27250 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions 3.0.0 through 3.1.0 Description: The issue allows any user to insert arbitrary HTML into the DOM by inserting a payload into any allowed attribute of the tag, posing a significant security risk to user data. Recommendation...

PT-2025-27036

Name of the Vulnerable Software and Affected Versions: Flock Safety Gunshot Detection devices versions prior to 1.3 Description: The issue concerns cleartext storage of code in Flock Safety Gunshot Detection devices. This means that the code is stored in a plaintext format, potentially allowing...

PT-2025-27203 · Unknown · Rohil Contact Form – 7 : Hide Success Message

Name of the Vulnerable Software and Affected Versions: Rohil Contact Form – 7 : Hide Success Message versions 1.1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...

PT-2025-27157 · Edgarrojas · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: EDGARROJAS WooCommerce PDF Invoice Builder versions 1.2.148 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed. This can lead to Cross Site Request Forgery. Recommendations: For versio...

PT-2025-27121

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL Custom Post Types versions 3.0 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in pebas CouponXxL Custom Post Types. Recommendations: For versio...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2025:02121-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02121-1 advisory. Update to version 3.18.3: builddeps: bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc dependabotbot fix: user username...

CVE-2025-52900

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the...

CVE-2025-52902 File Browser has Stored Cross-Site Scripting vulnerability

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a...

CVE-2025-52900 File Browser has Insecure File Permissions

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the...