PT-2025-20230 · Unknown · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member versions through 2.10.3 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection'. This allows for Code Injection in Ultimate Member. Recommendations: For versions through...

PT-2025-20314

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.14 Description The issue affects Rack, a modular Ruby web server interface, when using the Rack::Session::Pool middleware. Simultaneous rack requests can restore a deleted rack session, allowing an unauthenticated us...

PT-2025-20099 · Hash Form · Hash Form

Name of the Vulnerable Software and Affected Versions: Hash Form versions 1.2.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For versions 1.2.8 and earlier, update to a version that includes a fix for this...

PT-2025-20186 · Unknown · Martins Free Monetized Ad Exchange Network

Name of the Vulnerable Software and Affected Versions: Martins Free Monetized Ad Exchange Network versions 1.0.0 through 1.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. Recommendations: For versions 1.0.0 through 1.0.5, update to a versio...

PT-2025-20221 · Unknown · Faiyaz Alam User Login History

Name of the Vulnerable Software and Affected Versions: Faiyaz Alam User Login History versions through 2.1.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...

PT-2025-19906 · Peprodev · Peprodev Ultimate Profile Solutions

Name of the Vulnerable Software and Affected Versions: PeproDev Ultimate Profile Solutions versions 1.9.1 through 7.5.2 Description: The issue is related to the lack of proper authentication in the handel ajax req function, specifically with the change user meta functionality. This allows attacke...

PT-2025-19917 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject SQL statements, enabling them to obtain, update, and delete all information in the database. The vulnerability is specifically found in the User...

PT-2025-19964 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was found in the runtime.ddnsStatus DynDNS function, specifically via the mailex parameter. This allows for potential exploitation. Recommendations: For Linksys E5600 versi...

PT-2025-19877 · Qualcomm · Snapdragon +29

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue involves memory corruption that occurs during the processing of a message. This happens when the buffer is controlled by a Guest VM, allowing the value to be changed continuously...

PT-2025-19853 · Qualcomm · Snapdragon +18

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to memory corruption that occurs while processing the command buffer in the OPE module. Recommendations: At the moment, there is no information about a newer version tha...

PT-2025-19833 · Unknown · Sourcecodester Advanced Web Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Advanced Web Store version 1.0 Description: A critical vulnerability was found in SourceCodester Advanced Web Store. The issue affects an unknown function of the file /admin/admin addnew product.php. The manipulation of the...

PT-2025-19782

Name of the Vulnerable Software and Affected Versions One version 1.0 Description The issue is related to incorrect access control in the component "/api/user/manager" that allows attackers to access sensitive information via a crafted payload. Recommendations For version 1.0, as a temporary...

PT-2025-19777 · Kob · Kob

Name of the Vulnerable Software and Affected Versions: kob version 1.0.0-SNAPSHOT Description: The issue is related to incorrect access control in the doFilter function, which allows attackers to access sensitive information by sending a crafted payload. Recommendations: For version 1.0.0-SNAPSHO...

PT-2025-19326

Name of the Vulnerable Software and Affected Versions zhangyanbo2007 youkefu versions up to 4.2.0 Description A critical issue was found in the function Upload of the file MediaController.java, where the manipulation of the argument imgFile leads to unrestricted upload. This issue can be exploite...

PT-2025-19770

Name of the Vulnerable Software and Affected Versions @misskey-dev/summaly versions 3.0.1 through 5.2.0 Description A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. This issue allows Misskey to follow...

PT-2025-19789

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.4 Description A LLM application leveraging the XMLToolMessage class may be exposed to untrusted XML input, potentially resulting in Denial of Service DoS and/or exposing local files with sensitive information. T...

PT-2025-19783 · Yaoqishan · Yaoqishan

Name of the Vulnerable Software and Affected Versions: yaoqishan version 0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the "/admin/" API endpoint, which allows attackers to gain access to Admin rights via a crafted request. Recommendations: For yaoqishan version...

PT-2025-19788

Name of the Vulnerable Software and Affected Versions Keystone versions prior to 6.5.0 Description Keystone, a content management system for Node.js, has an issue where field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These...

PT-2025-19884 · Dell · Dell Storage Center +1

Name of the Vulnerable Software and Affected Versions: Dell Storage Center - Dell Storage Manager version 20.1.20 Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a low-privileged attacker wi...

PT-2025-19739 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The variables exp dir1, np7, and f0method8 take user input and pass it into...