PT-2025-25002 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing an attacker with elevated privileges to inject malicious scripts into vulnerable form fields. This could...

CVE-2024-37395

REDCap 13.1.9.x stores XSS in the Public Survey page: authenticated users can inject scripts via the Survey Title and Survey Instructions. The vulnerability triggers when the survey is accessed via its public link. Remediation is to update to 14.2.1 or later (per the CVE description). The connect...

PT-2025-24612 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions up to, and including, 3.29.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-24680 · Keyoti · Keyoti Searchunit

Name of the Vulnerable Software and Affected Versions: Keyoti SearchUnit versions prior to 9.0.0. Description: The issue is related to Server-Side Request Forgery SSRF in the /Keyoti SearchEngine Web Common/SearchService.svc/GetResults and /Keyoti SearchEngine Web...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

CVE-2025-49138 HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field...

CVE-2025-49006 Wasp has case insensitive OAuth ID vulnerability

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

CVE-2025-49006 Wasp has case insensitive OAuth ID vulnerability

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

PT-2025-24525

Name of the Vulnerable Software and Affected Versions MyStyle Custom Product Designer versions 3.21.1 and earlier Description The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injectio...

PT-2025-24484 · WordPress · Wp Lead Capturing Pages

Name of the Vulnerable Software and Affected Versions: kamleshyadav WP Lead Capturing Pages versions prior to 2.3 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-24503 · WordPress · Backup/Staging By Wp Time Capsule

Name of the Vulnerable Software and Affected Versions: Backup and Staging by WP Time Capsule versions 1.22.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...

PT-2025-24535 · Unknown · Unfoldwp Magze

Name of the Vulnerable Software and Affected Versions: Unfoldwp Magze versions 1.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local File...

PT-2025-24533 · Unknown · Unfoldwp Magty

Name of the Vulnerable Software and Affected Versions: Unfoldwp Magty versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24490 · Amentotech · Amentotech Wp Guppy

Name of the Vulnerable Software and Affected Versions: AmentoTech WP Guppy versions n/a through 4.3.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24403 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.85 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and esca...

PT-2025-24564 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the...

PT-2025-24530 · Unknown · Unfoldwp Blogprise

Name of the Vulnerable Software and Affected Versions: Unfoldwp Blogprise versions 1.0.0 through 1.0.9 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24473 · Payu · Payu India

Name of the Vulnerable Software and Affected Versions: PayU India versions through 3.8.5 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing authentication abuse. Recommendations: For versions through 3.8.5, update to a version later than 3.8...

PT-2025-24464 · Unknown · Snstheme Nitan

Name of the Vulnerable Software and Affected Versions: snstheme Nitan versions n/a through 2.9 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...