PT-2025-16217 · Veal98 · Veal98

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2 Description: A critical issue has been found in the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be...

PT-2025-16224 · Allegro · My Auctions Allegro

Name of the Vulnerable Software and Affected Versions: My auctions allegro versions 3.6.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-16275 · Zhenfeng13 · My-Blog-Layui

Name of the Vulnerable Software and Affected Versions: ZHENFENG13/code-projects My-Blog-layui version 1.0 Description: A problem was found in the software, affecting an unknown part of the file /admin/v1/link/edit. This issue leads to cross site scripting and can be initiated remotely. Multiple...

PT-2025-16171 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1012 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the widgetGri...

PT-2025-16071 · WordPress · Empikplace For Woocommerce

Name of the Vulnerable Software and Affected Versions: EmpikPlace for Woocommerce versions 1.4.2 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection. This is a problem where an attacker could potentially inject malicious objects in...

PT-2025-16017 · W. W. Norton · W. W. Norton Inquizitive

Name of the Vulnerable Software and Affected Versions: W. W. Norton InQuizitive versions through 2025-04-08 Description: The issue allows students to insert arbitrary records of their quiz performance into the backend due to the existence of only client-side access control. This is related to a...

PT-2025-16047 · Unknown · Insert Html Here

Name of the Vulnerable Software and Affected Versions: Insert HTML Here versions prior to 1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Reflected XSS. Recommendations: For...

PT-2025-16145 · Unknown · Oz Forensics

Name of the Vulnerable Software and Affected Versions: Oz Forensics face recognition application versions prior to 4.0.8 Description: The issue allows PII retrieval via /statistic/list Insecure Direct Object Reference. Recommendations: For versions prior to 4.0.8, consider disabling access to the...

PT-2025-16053 · Wpminds · Wpminds Simple Wp Events

Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and...

PT-2025-15977 · Msi · Msi Center

Name of the Vulnerable Software and Affected Versions: MSI Center versions prior to 2.0.52.0 Description: The issue allows for Time-of-Check-to-Time-of-Use TOCTOU Local Privilege Escalation. TOCTOU refers to a class of vulnerabilities that occur when an attacker can exploit the difference between...

PT-2025-15938 · Vcita · Contact Form Builder

Name of the Vulnerable Software and Affected Versions: Contact Form Builder by vcita versions n/a through 4.10.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to b...

PT-2025-15978 · Msi · Msi Center

Name of the Vulnerable Software and Affected Versions: MSI Center versions prior to 2.0.52.0 Description: The issue concerns missing PE signature validation. Recommendations: For versions prior to 2.0.52.0, update to version 2.0.52.0 or later to resolve the issue...

PT-2025-15990 · Connman +1 · Connman +1

Name of the Vulnerable Software and Affected Versions: ConnMan versions 1.44 and earlier Description: The issue in ConnMan allows attackers to cause a denial of service or possibly execute arbitrary code by manipulating DNS responses. This occurs when the lookup string in ns resolv in dnsproxy.c...

CVE-2025-26888

Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through = 5.3.8...

PT-2025-15696 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.4 through 12.1 Description: The issue allows a privileged user to read any file on the system due to incorrect privilege assignment. Recommendations: For versions 11.4 through 12.1, update to a version that...

PT-2025-15883 · Unknown · Meddream Pacs Server

Name of the Vulnerable Software and Affected Versions: MedDream PACS Server affected versions not specified Description: The issue is related to a stack-based buffer overflow in the DICOM file parsing functionality, which can lead to remote code execution. Recommendations: At the moment, there is...

PT-2025-15755

Name of the Vulnerable Software and Affected Versions: Koa versions prior to 2.16.1 Koa versions prior to 3.0.0-alpha.5 Description: The issue arises when passing untrusted user input to ctx.redirect, which can execute JavaScript code on the user's device, even after sanitizing the input...

PT-2025-15815 · Unknown · Nepali Date Utilities

Name of the Vulnerable Software and Affected Versions: Nepali Date Utilities versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-15750 · Chandan Garg · Cg Scroll To Top

Name of the Vulnerable Software and Affected Versions: Chandan Garg CG Scroll To Top versions n/a through 3.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-15821 · WordPress · Wp Social Stream Designer

Name of the Vulnerable Software and Affected Versions: WP Social Stream Designer versions 1.3 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection,...