PT-2025-21867 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue affects the processing of the file /pages/transaction update.php in Campcodes Sales and Inventory System. The manipulation of the ID argument leads to SQL injectio...

PT-2025-21828 · D Link · D-Link Dap-2695

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2695 version 120b36r137 ALL en 20210528 Description: A vulnerability was found in the ARP Spoofing Prevention Page component, specifically in the file /adv arpspoofing.php. The manipulation of the harp mac argument leads to...

PT-2025-21835 · Unknown · Sourcecodester Restaurant Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Restaurant Management System version 1.0 Description: A critical issue has been discovered, affecting the /admin/finished.php file. The manipulation of the ID argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-21816 · D Link · D-Link Dcs-932L

Name of the Vulnerable Software and Affected Versions: D-Link DCS-932L version 2.18.01 Description: A critical issue affects the function SubUPnPCSInit of the file /sbin/udev. The manipulation of the argument CameraName leads to a stack-based buffer overflow. It is possible to initiate the attack...

PT-2025-21864 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 16.03.10.13 Description: A critical issue affects an unknown functionality of the file /goform/UserCongratulationsExec. The manipulation of the getuid argument leads to a buffer overflow. This issue can be exploited remotel...

PT-2025-21650

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.6.2 Description: The issue allows a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FAB SAFE REDIRECT HOS...

PT-2025-21750 · Unknown · Gongfuxiang Schoolcms

Name of the Vulnerable Software and Affected Versions: gongfuxiang schoolcms version 2.3.1 Description: A critical issue has been discovered, affecting the SaveInfo function of the file "/index.php?m=Admin&c=article&a=SaveInfo". The manipulation of the ID argument leads to SQL injection. This iss...

PT-2025-21708 · Mapsvg · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions through 8.5.31 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-21672 · Themeton · Themeton Hotstar – Multi-Purpose Business Theme

Name of the Vulnerable Software and Affected Versions: themeton HotStar – Multi-Purpose Business Theme versions 1.4 and earlier Description: The issue affects the themeton HotStar – Multi-Purpose Business Theme due to a Missing Authorization vulnerability, allowing exploitation of incorrectly...

PT-2025-21612 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer viewpoint versions 10.0.0-00 through 11.0.4-00 Description: The issue is related to authentication credentials leakage. It affects the viewpoint component of Hitachi Ops Center Analyzer. Recommendations: For versio...

PT-2025-21690 · Themovation · Themovation Quickcal

Name of the Vulnerable Software and Affected Versions: Themovation QuickCal versions 1.0.0 through 1.0.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Themovation...

PT-2025-21761 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue was found in the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument reboot time leads to a stack-based buffer overflow. This issue can b...

PT-2025-21720

Name of the Vulnerable Software and Affected Versions: ShayanWeb Admin FontChanger versions 1.8.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-21735 · Unknown · Berthaai Bertha Ai

Name of the Vulnerable Software and Affected Versions: berthaai BERTHA AI versions 1.12.11 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-21603 · Unknown · Code-Projects Employee Record System

Name of the Vulnerable Software and Affected Versions: code-projects Employee Record System version 1.0 Description: A problematic issue was found in the code-projects Employee Record System. This issue affects an unknown part of the file current employees.php. The manipulation of the arguments...

PT-2025-21692 · WordPress · Lambertgroup Radio Player Shoutcast & Icecast Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin versions through 4.4.6 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This...

PT-2025-21326 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.11 Description: The issue arises when a user lacks access to ExperimentalSettings, causing the system to fail in checking the RestrictSystemAdmin setting. This...

PT-2025-21281 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Vehicle Record Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via Cross Site Scripting XSS in the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, and enginenumber...

PT-2025-21531 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Event Calendar WordPress plugin versions 1.0.0 through 1.0.4 Description: The issue concerns a lack of authorization checks on delete actions, allowing unauthenticated users to delete arbitrary calendars. This means that without proper...

PT-2025-21570 · Dumb Drop · Dumb Drop

Name of the Vulnerable Software and Affected Versions: DumbDrop versions prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b Description: The issue is related to a DOM cross-site scripting vulnerability in the upload functionality. A user could be tricked into uploading a file with a malicio...