PT-2025-24233 · Implecode · Implecode Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: impleCode Product Catalog Simple versions 1.8.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24230 · Unknown · Webhotelier

Name of the Vulnerable Software and Affected Versions: WebHotelier versions 1.9.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

PT-2025-24117 · Unknown · Nir Complete Google Seo Scan

Name of the Vulnerable Software and Affected Versions: Nir Complete Google Seo Scan versions 3.5.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24228 · Unknown · Crawlomatic Multipage Scraper Post Generator

Name of the Vulnerable Software and Affected Versions: Crawlomatic Multisite Scraper Post Generator versions 2.6.8.2 and earlier Description: The issue allows for the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions...

PT-2025-24070 · Unknown · Code-Projects Real Estate Property Management System

Name of the Vulnerable Software and Affected Versions: code-projects Real Estate Property Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /Admin/EditCity.php. This issue leads to sql injection and can be exploited...

PT-2025-24176 · WordPress · Wp Gravity Forms Constant Contact Plugin

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Constant Contact Plugin versions 1.1.0 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing. This vulnerability can be...

PT-2025-24124

Name of the Vulnerable Software and Affected Versions CubePoints versions n/a through 3.2.1 Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations For versions n/a through 3.2.1, update to a version that includes a fix fo...

PT-2025-24182 · Unknown · Nexa Blocks

Name of the Vulnerable Software and Affected Versions: Nexa Blocks versions 1.1.0 and earlier Description: A Server-Side Request Forgery SSRF issue affects Nexa Blocks, allowing for Server Side Request Forgery. Recommendations: For versions 1.1.0 and earlier, update to a version that contains a f...

PT-2025-24326 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.09 Description: A critical issue has been identified, affecting the fromSetWirelessRepeat function of the file /goform/WifiExtraSet. The manipulation of the wpapsk crypto argument leads to a stack-based buffer...

PT-2025-24169 · Unknown · Taskbuilder

Name of the Vulnerable Software and Affected Versions: Taskbuilder versions 4.0.3 and earlier Description: The issue is related to a Missing Authorization vulnerability in Taskbuilder, which allows accessing functionality not properly constrained by ACLs. Recommendations: For Taskbuilder versions...

PT-2025-24264 · WordPress · Wp Map Plugins Interactive Regional Map Of Florida

Name of the Vulnerable Software and Affected Versions: WP Map Plugins Interactive Regional Map of Florida versions 1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

PT-2025-24398 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version 15.03.06.47 Description: A critical issue was found, classified as critical, affecting the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to a stack-based...

PT-2025-24390 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 Description: A critical vulnerability was found in Tenda AC6. This affects the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buff...

ThinManager Path Traversal (CVE-2023-2917) Arbitrary File Upload

This module exploits a path traversal vulnerability CVE-2023-2917 in ThinManager use auxiliary/admin/networking/thinmanagertraversalupload2 msf auxiliarythinmanagertraversalupload2 show actions ...actions... msf auxiliarythinmanagertraversalupload2 set ACTION msf...

CVE-2025-5642 Radare2 radiff2 pal.c r_cons_pal_init memory corruption

A vulnerability classified as problematic has been found in Radare2 5.9.9. Affected is the function rconspalinit in the library /libr/cons/pal.c of the component radiff2. The manipulation leads to memory corruption. The attack needs to be approached locally. The complexity of an attack is rather...

Ubuntu: Security Advisory (USN-7554-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-48947

The CVE describes a vulnerability in the Auth0 Next.js SDK (auth0/nextjs-auth0) affecting versions 4.0.1–4.6.0 where __session cookies set by auth0.middleware can be cached by CDNs due to missing Cache-Control headers. Preconditions require: (1) use of the NextJS-Auth0 SDK, (2) CDN/edge caching o...

CVE-2025-1051

Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

PT-2025-23787 · Unknown · Codeastro Real Estate Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Real Estate Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /login.php. The manipulation of the email argument leads to SQL injection. It is possible to...