PT-2025-22860 · Wcms · Wcms

Name of the Vulnerable Software and Affected Versions: WCMS versions up to 8.3.11 Description: A critical issue has been found in the Login component, specifically affecting the getMemberByUid function. The manipulation of the uid argument leads to improper authentication, allowing for remote...

PT-2025-22828 · Unknown · Process Lock

Name of the Vulnerable Software and Affected Versions: process lock crate version 0.1.0 Description: The issue allows data races in unlock, which can lead to unpredictable behavior. Recommendations: For process lock crate version 0.1.0, consider avoiding the use of the unlock functionality until ...

PT-2025-22829 · Unknown · Process-Sync

Name of the Vulnerable Software and Affected Versions: process-sync crate version 0.2.2 Description: The issue is related to the drop function in the process-sync crate for Rust, which lacks a check to ensure the pthread mutex is unlocked. Recommendations: For process-sync crate version 0.2.2,...

CVE-2023-38849

An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

PT-2025-22679 · Ancorathemes · Ancorathemes Fish House

Name of the Vulnerable Software and Affected Versions: AncoraThemes Fish House versions 1.2.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For AncoraThemes Fish House versions 1.2.7 and earlier, update to a...

PT-2025-22688 · Designthemes · Designthemes Crafts & Arts

Name of the Vulnerable Software and Affected Versions: designthemes Crafts & Arts versions n/a through 2.5 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For designthemes Crafts & Arts versions n/a through 2.5, update to a...

PT-2025-22716 · Intellian Technologies · Iridium Certus 700

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The SSID field is not parsed correctly, allowing it to be used for command injection into the hostpad.conf file. This issue can be exploited by an attacker to gain more knowledge of the syst...

PT-2025-22736 · Unknown · Crossword Compiler

Name of the Vulnerable Software and Affected Versions: Crossword Compiler Puzzles versions 5.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2025-22677 · Ancorathemes · Ancorathemes Umberto

Name of the Vulnerable Software and Affected Versions: AncoraThemes Umberto versions 1.2.8 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.2.8 and earlier, update to a version that fixes this issue...

PT-2025-22735 · Unknown · Crossword Compiler

Name of the Vulnerable Software and Affected Versions: Crossword Compiler Puzzles versions 5.2 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-22766

Name of the Vulnerable Software and Affected Versions STAGGS versions n/a through 2.11.0 Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to potential security breaches. Recommendations For...

PT-2025-22670 · Themeton · Themeton Dash

Name of the Vulnerable Software and Affected Versions: themeton Dash versions 1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For themeton Dash versions 1.3 and earlier, at the moment, there is no information...

PT-2025-22741 · Unknown · Ctltwp Section Widget

Name of the Vulnerable Software and Affected Versions: ctltwp Section Widget versions n/a through 3.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in the ctltwp Section Widget...

PT-2025-22712 · Goodlayers · Goodlayers Hotel

Name of the Vulnerable Software and Affected Versions: Goodlayers Hotel versions 3.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-22782 · Verge3D · Verge3D

Name of the Vulnerable Software and Affected Versions: Verge3D versions through 4.9.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can inject malicious scrip...

PT-2025-22799 · Marked · Marked

Name of the Vulnerable Software and Affected Versions: Marked versions prior to 0.3.17 Description: The issue is related to a Regular Expression Denial of Service ReDoS attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacke...

PT-2025-22791 · Goodlayers · Goodlayers Tourmaster

Name of the Vulnerable Software and Affected Versions: GoodLayers Tourmaster versions through 5.3.8 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22752 · Wpfunnels · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels versions 3.5.18 and earlier Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in WPFunnels. Recommendations: For versions 3.5.18 and earlier, update to a version later than 3.5.18 to...

PT-2025-22713 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue affects Nasa Core due to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', allowing PHP Local File Inclusion...

PT-2025-22654 · I-Filter · I-Filter

Name of the Vulnerable Software and Affected Versions: i-FILTER affected versions not specified Description: The issue is related to improper pattern file validation in the optional feature 'Anti-Virus & Sandbox' of i-FILTER. If exploited, the product may treat an unauthorized pattern file as...