PT-2025-31634 · Unknown · Gandia Integra Total

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection vulnerability exists in Gandia Integra Total. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete databases throug...

PT-2025-31632 · Gandia · Gandia Integra Total Tesi

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total TESI versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection vulnerability exists in Gandia Integra Total TESI. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete...

PT-2025-31633 · Unknown · Gandia Integra Total

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection vulnerability exists in Gandia Integra Total. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete databases throug...

PT-2025-31637

Name of the Vulnerable Software and Affected Versions Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description A SQL injection vulnerability exists in Gandia Integra Total. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete databases through...

PT-2025-31689 · Zpanel · Zpanel

Name of the Vulnerable Software and Affected Versions: ZPanel version 10.0.0.2 Description: A remote command execution issue exists in the htpasswd module. The inHTUsername field, when creating .htaccess files, is passed to a system call without proper sanitization, which invokes the system’s...

PT-2025-31635 · Tesi · Gandia Integra Total

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection vulnerability exists in Gandia Integra Total of TESI. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete database...

PT-2025-31636 · Gandia · Gandia Integra Total Tesi

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total TESI versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection vulnerability exists in Gandia Integra Total TESI. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete...

PT-2025-31638 · Unknown · Gandia Integra Total

Name of the Vulnerable Software and Affected Versions: Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description: A SQL injection issue exists in Gandia Integra Total. An authenticated attacker can retrieve, create, update, and delete databases through the idestudio parameter in the...

CVE-2025-5684

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mf-template DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

CVE-2025-7205

The CVE-2025-7205 entry refers to a Stored Cross‑Site Scripting in the WordPress GiveWP – Donation Plugin and Fundraising Platform. Affected: GiveWP core (WordPress plugin) for versions up to and including 4.5.0, due to insufficient input sanitization and output escaping in the donor notes parame...

CVE-2025-53079

Absolute Path Traversal in Samsung DMSData Management Server allows authenticated attacker Administrator to read sensitive files...

CVE-2025-7809

The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

PT-2025-31555 · Unknown · Devaslanphp Project-Management

Name of the Vulnerable Software and Affected Versions: DevaslanPHP project-management version 1.2.4 Description: A stored cross-site scripting XSS issue exists in DevaslanPHP project-management version 1.2.4. The vulnerability is located in the Ticket Name field, which does not properly sanitize...

CVE-2025-52203

Summary: CVE-2025-52203 affects DevaslanPHP project-management v1.2.4 with a stored XSS in the Ticket Name field. An authenticated attacker can inject JavaScript, which is stored in the database and executes in a user’s browser context when they log in and are redirected to the Dashboard. The iss...

CVE-2025-8353

The CVE-2025-8353 entry concerns a UI synchronization issue in Devolutions Server (JIT) that affects versions prior to and including 2025.2.4.0. A remote authenticated attacker could exploit stale UI state during standard checkout processing to gain unauthorized access to deleted JIT Groups. Affe...

CVE-2025-2297

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to...

CVE-2025-27800

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...

CVE-2025-27802

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties text fields, which could be used in the "Edit"...

CVE-2025-6348

The Smart Slider 3 plugin for WordPress is vulnerable to time-based SQL Injection via the ‘sliderid’ parameter in all versions up to, and including, 3.5.1.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...