PT-2025-3951 · Tduckcloud · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: TDuckCloud tduck-platform versions up to 4.0 Description: A critical issue was found in the TDuckCloud tduck-platform, affecting the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.jav...

PT-2025-2140 · WordPress · Adifier System

Name of the Vulnerable Software and Affected Versions: Adifier System plugin for WordPress versions up to, and including, 3.1.7 Description: The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as passwords, through the adifier...

PT-2025-3953 · Unknown · Campcodes School Management

Name of the Vulnerable Software and Affected Versions: CampCodes School Management Software version 1.0 Description: A problematic vulnerability was found in the Photo Gallery Page component of the software, specifically in an unknown function of the file /photo-gallery. The manipulation of the...

PT-2025-7558 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.06 Description: The issue is related to a Buffer Overflow in the get parentControl list Info function. Recommendations: For Tenda AC8 version 16.03.34.06, consider disabling the get parentControl list Info function...

PT-2025-2134 · WordPress · Sandbox

Name of the Vulnerable Software and Affected Versions: Sandbox plugin for WordPress versions up to and including 0.4 Description: The issue is related to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages through the...

Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders

Impact If SVG or JPEGXL thumbnailers are enabled they are disabled by default, a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript...

PT-2025-5013 · Mailchimp · Import Users To Mailchimp

Name of the Vulnerable Software and Affected Versions: Import Users to MailChimp versions 1.0 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a we...

PT-2025-4977 · Unknown · Andrea Brandi Twitter Shortcode

Name of the Vulnerable Software and Affected Versions: Andrea Brandi Twitter Shortcode versions 0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions o...

PT-2025-4740

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description RE11S version 1.11 contains a command injection issue through the command parameter at the ''/goform/mp'' API endpoint. This allows for potential unauthorized command execution. Recommendations RE11S version 1.11...

PT-2025-2583 · Themesebrand · Themesebrand Chatvia

Name of the Vulnerable Software and Affected Versions: themesebrand Chatvia version 5.3.2 Description: An issue in themesebrand Chatvia allows a remote attacker to execute arbitrary code via the User profile Upload image function. Recommendations: For themesebrand Chatvia version 5.3.2, consider...

PT-2025-5002 · Mercadolibre · Mercadolibre Integration

Name of the Vulnerable Software and Affected Versions: MercadoLibre Integration versions 1.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4997 · Quotemedia · Quotemedia Tools

Name of the Vulnerable Software and Affected Versions: QuoteMedia Tools versions n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This is a type of Cross-site Scripting attack. Recommendations: For...

PT-2025-4881 · Unknown · Shockingly Big Ie6 Warning

Name of the Vulnerable Software and Affected Versions: Shockingly Big IE6 Warning versions n/a through 1.6.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4742

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description A stack overflow issue was discovered in the formWlSiteSurvey function through the selSSID parameter. Recommendations For RE11S version 1.11, consider disabling the formWlSiteSurvey function or restricting access...

PT-2025-4842 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: Librenms versions up to 24.10.1 Description: The issue is a stored XSS that affects the parameter: ajax form.php - param: state. This allows remote attackers to inject malicious scripts, which execute immediately when a user views or interact...

PT-2025-5107 · Unknown · Spiderpowa Embed Pdf

Name of the Vulnerable Software and Affected Versions: Spiderpowa Embed PDF versions 1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

PT-2025-5060 · Unknown · Martijn Scheybeler Social Analytics

Name of the Vulnerable Software and Affected Versions: Martijn Scheybeler Social Analytics versions n/a through 0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4743

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description A command injection issue was discovered in the /goform/formAccept component. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world...

PT-2025-14350

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc5 Description A slab-use-after-free read vulnerability has been identified in the Linux kernel's Bluetooth L2CAP implementation. The issue occurs when the hci sync command releases l2cap conn, and the hc...

PT-2025-3545 · Tenda · Tenda Ac8V4

Name of the Vulnerable Software and Affected Versions: Tenda AC8v4 version V16.03.34.06 Description: The issue is a stack overflow vulnerability affecting the setSchedWifi function in the /goform/openSchedWifi file. This vulnerability is caused by the manipulation of the schedEndTime argument,...