PT-2025-22783

Name of the Vulnerable Software and Affected Versions fullworks Quick Contact Form versions n/a through 8.2.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables potential...

PT-2025-22750 · Unknown · Infocob Crm Forms

Name of the Vulnerable Software and Affected Versions: Infocob CRM Forms versions n/a through 2.4.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in Infocob CRM Forms...

PT-2025-22748 · Elementor · Drag/Drop File Upload For Elementor Forms

Name of the Vulnerable Software and Affected Versions: Drag and Drop File Upload for Elementor Forms versions 1.4.3 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability...

PT-2025-22708 · Goodlayers · Goodlayers Hostel

Name of the Vulnerable Software and Affected Versions: Goodlayers Hostel versions n/a through 3.1.2 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection' vulnerability, which allows Blind SQL Injection...

PT-2025-22679 · Ancorathemes · Ancorathemes Fish House

Name of the Vulnerable Software and Affected Versions: AncoraThemes Fish House versions 1.2.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For AncoraThemes Fish House versions 1.2.7 and earlier, update to a...

PT-2025-22676 · Woocommerce · Bus Ticket Booking With Seat Reservation For Woocommerce

Name of the Vulnerable Software and Affected Versions: Bus Ticket Booking with Seat Reservation for WooCommerce versions 1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for S...

PT-2025-22673 · Unknown · Apustheme Capie

Name of the Vulnerable Software and Affected Versions: ApusTheme Capie versions 1.0.0 through 1.0.40 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22727 · Unknown · Occupancyplan

Name of the Vulnerable Software and Affected Versions: occupancyplan versions n/a through 1.0.3.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection in the occupancyplan. Recommendations: For versions n/a through 1.0.3.0, update to a...

PT-2025-22726 · Unknown · Theme Blvd Sliders

Name of the Vulnerable Software and Affected Versions: Theme Blvd Sliders versions 1.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can...

PT-2025-22757 · Unknown · Zoomit Zoomsounds

Name of the Vulnerable Software and Affected Versions: ZoomIt ZoomSounds versions n/a through 6.91 Description: The issue is related to the deserialization of untrusted data, which allows object injection in ZoomIt ZoomSounds. Recommendations: For ZoomIt ZoomSounds versions n/a through 6.91, upda...

PT-2025-22649 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP versions prior to 5.20 Description: The text editor embedded into MegaBIP software does not neutralize user input, allowing Stored XSS attacks on other users. High privileges are required to use the editor. Recommendations: For versio...

PT-2025-22740 · Unknown · Likecoin Web3Press

Name of the Vulnerable Software and Affected Versions: LikeCoin Web3Press versions n/a through 3.2.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in LikeCoin Web3Press...

CVE-2022-41918

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules document-level security, field-level security and field masking where they are not correctly applied to the indices that back data streams...

CVE-2022-40817

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

CVE-2022-36095

XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery CSRF attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workaround, one may locally modify the...

CVE-2022-36015

TensorFlow is an open source platform for machine learning. When RangeSize receives values that do not fit into an int64t, it crashes. We have patched the issue in GitHub commit 37e64539cd29fcfb814c4451152a60f5d107b0f0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this...

CVE-2022-36102

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version 5.7.15. Users ca...

CVE-2022-36016

TensorFlow is an open source platform for machine learning. When tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status. We have patched the issue in GitHub commit...

CVE-2022-31076

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message can crash CloudCore by triggering a nil-pointer dereference in the UDS Server. Since the UDS Server only communicates...