PT-2025-51287

Name of the Vulnerable Software and Affected Versions WEBIGniter version 28.7.23 Description The software contains a file upload issue that permits authenticated attackers to upload and execute malicious PHP files via the media function. An attacker with any valid account can upload PHP scripts,...

PT-2025-51196

Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password...

Adobe DNG Software Development Kit (SDK) Denial of Service Vulnerability

Adobe DNG Software Development Kit SDK is a software development kit from the American company Audobee Adobe. A denial of service vulnerability exists in Adobe DNG Software Development Kit SDK, which can be exploited by attackers to cause a denial of service...

The vulnerability of tmptcp components in the Linux operating system’s kernel allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of tmptcp components in the Linux operating system is related to state management errors. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2026-0013244)

Adobe Experience Manager is an enterprise-class content management solution from Adobe. Adobe Experience Manager suffers from a cross-site scripting vulnerability that originates from a low-privilege attacker who can inject malicious script into form fields, no details of the vulnerability are...

PT-2025-51274

Name of the Vulnerable Software and Affected Versions MicroStudio version 24.01.29 Description A HTML Injection issue exists in the comment section of the project page. This allows remote attackers to inject arbitrary web script or HTML through the text parameter of the add project comment...

The vulnerabilities of Linux operating system’s crypto kernel components allow attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of Linux operating system’s crypto kernel components is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the RDBMS Functional Index component of the Oracle Database Server allows a hacker to gain read access to data.

The vulnerability of the RDBMS Functional Index component in the Oracle Database Server management system is related to the violation of the buffer’s initial limit. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read access to data...

The vulnerability of the drm/imagination component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drm/imagination component in the Linux operating system is related to state management errors. Exploiting this vulnerability allows a perpetrator to cause service failures...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the error reporting mechanism, allowing attackers to disclose sensitive information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to shortcomings in the error reporting mechanism. Exploiting this vulnerability allows a malicious actor, operating remotely, to disclose sensitive information by sending specially crafted...

PT-2025-51301

Name of the Vulnerable Software and Affected Versions Webedition CMS version 2.9.8.8 Description Webedition CMS version 2.9.8.8 has a flaw that permits authenticated attackers to execute system commands remotely. This is achieved by creating a new PHP page and inserting malicious system commands...

PT-2025-51286

Name of the Vulnerable Software and Affected Versions Coppermine Gallery version 1.6.25 Description Coppermine Gallery version 1.6.25 has a remote code execution issue. Authenticated attackers can upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file...

CVE-2025-8780

The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2025-13705

The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

The vulnerability of the rtw89 component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the rtw89 component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

EUVD-2025-203245

The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2025-203205

The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they...

EUVD-2025-203222

The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2025-203248

The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the getusers function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including...

CVE-2025-9856

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpopup' shortcode in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user...