PT-2025-6056 · Unknown · Pihome-Shc Pihome

Name of the Vulnerable Software and Affected Versions: pihome-shc PiHome version 2.0 Description: A critical issue has been found in pihome-shc PiHome, affecting an unknown part of the file "/ajax.php?Ajax=GetModal Sensor Graph". The manipulation leads to SQL injection, and it is possible to...

PT-2025-6107 · Pix · Pix Software Vivaz

Name of the Vulnerable Software and Affected Versions: Pix Software Vivaz version 6.0.10 Description: A critical issue has been found in the code related to the /servlet?act=login file, where manipulation of the usuario argument can lead to SQL injection. This issue can be exploited remotely. The...

PT-2025-6075 · Unknown · Cool-Admin-Java

Name of the Vulnerable Software and Affected Versions: cool-admin-java version 1.0 Description: An arbitrary file upload vulnerability in the component /comm/upload allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to upload malicious files,...

PT-2025-6072 · Unknown · Phpgurukul Small Crm

Name of the Vulnerable Software and Affected Versions: PHPGurukul Small CRM version 3.0 Description: The issue is related to Cross Site Scripting XSS via a crafted payload injected into the name in the profile.php. This allows for potential malicious script execution. Recommendations: For...

PT-2025-6047 · Unknown +1 · System 800Xa +1

Name of the Vulnerable Software and Affected Versions: System 800xA versions 5.1.X through 6.2.X Description: A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited the vulnerability could, in the...

CVE-2025-20907

Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find...

CVE-2025-22602

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest...

PT-2025-6007 · Beijing Guoju Information Technology Co. · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: Beijing Guoju Information Technology Co., Ltd JeecgBoot version 3.7.2 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the getTotalData component. There is no information provided about the...

PT-2025-5985 · Unknown · Dhtmlxfileexplorer

Name of the Vulnerable Software and Affected Versions: dhtmlxFileExplorer version 8.4.6 Description: The issue allows a remote attacker to obtain sensitive information through the file download functionality. This is due to a local file inclusion vulnerability. Recommendations: For...

PT-2025-5990 · Tally · Tally Prime Edit Log

Name of the Vulnerable Software and Affected Versions: Tally Prime Edit Log version 2.1 Description: A DLL hijacking issue was discovered in the TextShaping.dll component, allowing attackers to execute arbitrary code through a manipulated DLL. This issue enables the execution of arbitrary code vi...

PT-2025-5902

Name of the Vulnerable Software and Affected Versions Legull WordPress plugin versions 1.2.2 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be use...

PT-2025-6008 · Unknown · Taisan Tarzan-Cms

Name of the Vulnerable Software and Affected Versions: taisan tarzan-cms versions up to 1.0.0 Description: This issue affects the function upload of the file "/adminthemes" of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely...

PT-2025-5803

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue exists due to an unprotected Windows messaging channel, also known as 'Shatter'. If an attacker sends a specially crafted message to the specific process of th...

PT-2025-5869 · Ibm · Ibm Entirex

Name of the Vulnerable Software and Affected Versions: IBM EntireX version 11.1 Description: The issue is related to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this to expose sensitive information or consume memory resources...

PT-2025-5835 · Newgensoft · Newgensoft Omnidocs

Name of the Vulnerable Software and Affected Versions: Newgensoft OmniDocs version 11.0 SP1 03 006 Description: The issue concerns an Insecure Direct Object Reference IDOR in the getuserproperty function, which allows the theft of a user's configuration and personally identifiable information PII...

PT-2025-5841 · Apphousekitchen · Apphousekitchen Aldente Charge Limiter

Name of the Vulnerable Software and Affected Versions: AppHouseKitchen AlDente Charge Limiter versions up to 1.29 Description: A critical issue has been found in AppHouseKitchen AlDente Charge Limiter, affecting the shouldAcceptNewConnection function of the com.apphousekitchen.aldente-pro.helper...

PT-2025-5876 · Unknown · Deep-Diver Llm-As-Chatbot

Name of the Vulnerable Software and Affected Versions: deep-diver LLM-As-Chatbot versions prior to commit 99c2c03 Description: The issue allows a remote attacker to execute arbitrary code via the modelsbyom.py component. Recommendations: For deep-diver LLM-As-Chatbot versions prior to commit...

CVE-2022-24899

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-39355

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...