PT-2025-15057 · WordPress · Multivendorx

Name of the Vulnerable Software and Affected Versions: The MultiVendorX plugin for WordPress versions up to, and including, 4.2.19 Description: The issue is related to a missing capability check on the delete table rate shipping row function, which allows unauthorized loss of data. This makes it...

PT-2025-15064

Name of the Vulnerable Software and Affected Versions Web::API versions 2.8 and earlier Description The issue concerns the use of a non-cryptographically secure source of entropy for cryptographic functions. Specifically, Web::API uses the Data::Random library, which relies on the rand function...

CVE-2024-13645

CVE-2024-13645 affects the WordPress tagging plugin TagDiv Composer (all versions up to and including 5.3). It describes PHP Object Instantiation via a module parameter, enabling unauthenticated object instantiation. The impact is conditional on a POP chain being present in the target environment...

PT-2025-14869 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue affects some unknown processing of the file /aboutus.php. The manipulation of the argument pagetitle leads to SQL injection. The attack may be initiated remotely. The...

PT-2025-15002 · Unknown · 1-Click Backup & Restore Database

Name of the Vulnerable Software and Affected Versions: 1-Click Backup & Restore Database versions 1.0.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-14887 · Unknown · Oblak Studio Srbtranslatin

Name of the Vulnerable Software and Affected Versions: Oblak Studio Srbtranslatin versions 3.2.0 and earlier Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into externally-accessible files or directories. Recommendations: For...

PT-2025-14911 · Unknown · Libro De Reclamaciones Y Quejas

Name of the Vulnerable Software and Affected Versions: Libro de Reclamaciones y Quejas versions 0.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 0.9 and earlier, consider implementing...

PT-2025-14889 · Simplish · Simplish

Name of the Vulnerable Software and Affected Versions: Simplish versions n/a through 2.6.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can inject...

PT-2025-14908 · Unknown · Xujiangfei Admintwo

Name of the Vulnerable Software and Affected Versions: xujiangfei admintwo version 1.0 Description: A vulnerability has been found in xujiangfei admintwo, classified as problematic. This issue affects the file /resource/add and is related to the manipulation of the Name argument, leading to...

PT-2025-14807 · Snowplow · Snowplow Collector

Name of the Vulnerable Software and Affected Versions: Snowplow Collector versions 3.x before 3.3.0 Description: The issue involves sending very large payloads to the Collector, which can render it unresponsive to other requests, potentially leading to data loss. Recommendations: For Snowplow...

PT-2025-14713 · WordPress · Blubrry Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry PowerPress Podcasting plugin MultiSite add-on versions 0.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected X...

PT-2025-14734 · Otwthemes · Otwthemes Widget Manager Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widget Manager Light versions 1.18 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For OTWthemes Widget...

PT-2025-14630 · Unknown · Projectworlds Online Doctor Appointment Booking System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Doctor Appointment Booking System version 1.0 Description: A critical issue affects the processing of the file /doctor/deleteappointment.php, where the manipulation of the ID argument leads to sql injection. This issue ca...

PT-2025-14806 · Unknown · Iglu Server

Name of the Vulnerable Software and Affected Versions: Iglu Server versions 0.13.0 and below Description: The issue can render Iglu Server completely unresponsive, which would eventually halt event processing in the pipeline if not restored. It involves an authenticated endpoint and is similar to...

PT-2025-14741 · Frank P. Walentynowicz · Fpw Category Thumbnails

Name of the Vulnerable Software and Affected Versions: Frank P. Walentynowicz FPW Category Thumbnails versions 1.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

PT-2025-14639 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the groupid parameter at the "/messaging/Group.php" endpoint. Recommendations: For OS4ED openSI...

PT-2025-14606 · Sourcecodester · Sourcecodester Gym Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gym Management System version 1.0 Description: A critical issue was found in the SourceCodester Gym Management System, affecting some unknown functionality of the file /signup.php. The manipulation of the user name argument lea...

CVE-2025-27244

CVE-2025-27244 affects Hammock AssetView and AssetView CLOUD. The vulnerability involves acquiring sensitive information from data sent to the developer, potentially exposing it to a remote unauthenticated attacker. Reported CVSS v3.0 base score is 5.9 (MEDIUM); impact is limited to confidentiali...

PT-2025-14500 · Stmicroelectronics · Stmicroelectronics X-Cube-Azrtos-Wl +1

Name of the Vulnerable Software and Affected Versions: STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0 STMicroelectronics X-CUBE-AZRTOS-F7 NetX Duo Web Component HTTP server version 1.1.0 Description: A denial of service issue exists in the NetX Component HTTP server functionality. This can be...

PT-2025-27525

Name of the Vulnerable Software and Affected Versions: llama index version 0.12.27 Description: A flaw in the ObsidianReader class allows for hardlink-based path traversal, enabling attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting...