PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...

PT-2025-17707 · WordPress · The Reales Wp

Name of the Vulnerable Software and Affected Versions: The Reales WP - Real Estate WordPress Theme versions up to, and including, 2.1.2 Description: The issue allows unauthorized modification and loss of data due to a missing capability check on the reales delete file, reales delete file plans,...

PT-2025-17682 · WordPress · Mang Board Wp

Name of the Vulnerable Software and Affected Versions: Mang Board WP plugin versions up to, and including, 1.8.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the board header and board footer parameters. This allows...

PT-2025-17801 · Unknown · Call Now Pht Blog

Name of the Vulnerable Software and Affected Versions: Call Now PHT Blog versions n/a through 2.4.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application,...

PT-2025-17786 · WordPress · Wp Custom Post Popup

Name of the Vulnerable Software and Affected Versions: WP Custom Post Popup versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker can...

PT-2025-17750 · Vw Themes · Vw Themes Sirat

Name of the Vulnerable Software and Affected Versions: VW Themes Sirat versions prior to 1.5.1 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior to 1.5.1,...

PT-2025-17710 · WordPress · Lottie Player

Name of the Vulnerable Software and Affected Versions: Lottie Player plugin for WordPress versions up to, and including, 1.1.8 Description: The issue is related to Stored Cross-Site Scripting via File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-17934

Name of the Vulnerable Software and Affected Versions ScreenConnect versions 25.2.3 and earlier Description The issue concerns a ViewState code injection attack in ScreenConnect, which uses ASP.NET Web Forms to preserve page and control state. The data is encoded using Base64 and protected by...

PT-2025-17789 · Unknown · Able Player

Name of the Vulnerable Software and Affected Versions: Able Player versions n/a through 1.2.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS attacks. This can lead to the execution of malicious scripts within the...

PT-2025-17787 · Elementor · The Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Pack Elementor addons versions n/a through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in The Pack Elementor addons...

Redis DoS Vulnerability (GHSA-r67f-p999-2gff)

Redis is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

PT-2025-17792 · Unknown · Metaloha Dropdown Content

Name of the Vulnerable Software and Affected Versions: metaloha Dropdown Content versions n/a through 1.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in metaloha Dropdown Content...

PT-2025-17818 · Unknown · Shamim Hasan Custom Functions Plugin

Name of the Vulnerable Software and Affected Versions: Shamim Hasan Custom Functions Plugin versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Shamim Hasan Custom Functions Plugin versions 1.1 and earlier...

PT-2025-17835 · WordPress · Domain Aliases +1

Name of the Vulnerable Software and Affected Versions: Landing pages and Domain aliases for WordPress versions 0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-17824 · Unknown · Alphasis Related Posts Via Taxonomies

Name of the Vulnerable Software and Affected Versions: alphasis Related Posts via Taxonomies versions n/a through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

PT-2025-17733 · Trpc · Trpc

Name of the Vulnerable Software and Affected Versions: tRPC versions 11.0.0 through 11.1.0 Description: The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocke...

CVE-2025-32966

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8...

GHSA-GGPF-24JW-3FCW CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Description https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify weightsonly=True to calls to torch.load did not solve the problem prior to...

Tenable Nessus Privilege Escalation Vulnerability (TNS-2025-05)

Tenable Nessus is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-17656 · Drupal · Drupal Colorbox

Name of the Vulnerable Software and Affected Versions: Drupal Colorbox versions 0.0.0 through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...