PT-2025-25411

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations For OpenC3 COSMOS version 6.0.0,...

PT-2025-25413

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue allows attackers to execute a directory traversal in the "openc3-api/tables" endpoint. Recommendations For OpenC3 COSMOS version 6.0.0, consider restricting access to the "openc3-api/tables"...

PT-2025-25378 · WordPress · Wp2Html

Name of the Vulnerable Software and Affected Versions: WP2HTML plugin for WordPress versions prior to 1.0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save function. This allows unauthenticated attackers to update plugin...

PT-2025-25275 · Unknown · Kicode111 Like-Girl

Name of the Vulnerable Software and Affected Versions: kiCode111 like-girl version 5.2.0 Description: A critical vulnerability was found in the kiCode111 like-girl software, affecting unknown code in the /admin/aboutPost.php file. The manipulation of the argument...

CVE-2025-5935 Open5GS AMF/MME emm-sm.c common_register_state denial of service

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function commonregisterstate of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ranueid leads to denial of service. The attack can be...

PT-2025-24606 · Woocommerce · Abandoned Cart Pro For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Pro for WooCommerce versions up to, and including, 9.16.0 Description: The issue is related to an authenticated arbitrary file upload due to missing file type validation in the wcap add to cart popup upload files function. This...

PT-2025-25093 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-25120 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing an attacker with limited privileges to inject malicious scripts into vulnerable form fields. This could...

PT-2025-24941 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-25018 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing an attacker with limited privileges to inject malicious scripts into vulnerable form fields. This could...

PT-2025-24884 · Unknown · Phpgurukul Restaurant Table Booking System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Restaurant Table Booking System version 1.0 Description: A vulnerability was found in the PHPGurukul Restaurant Table Booking System, affecting some unknown functionality of the file /admin/add-subadmin.php. The manipulation of the...

CVE-2025-5895 Metabase dom.js parseDataUri redos

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit...

CVE-2025-5895 Metabase dom.js parseDataUri redos

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit...

PT-2025-24433 · Unknown · Feng Office

Name of the Vulnerable Software and Affected Versions: Fengoffice Feng Office version 3.2.2.1 Description: A problematic issue has been found in the Document Upload Handler component, specifically affecting some unknown functionality of the file /application/models/ApplicationDataObject.class.php...

PT-2025-24572 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb Description: A critical issue was found in the parse variables option function of the file utilities/pspp-convert.c. This issue leads to the freeing of memory not on the heap. An attac...

PT-2025-24558 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase version 54.10 Description: A problematic issue was found in the function parseDataUri of the file frontend/src/metabase/lib/dom.js. This issue leads to inefficient regular expression complexity and can be initiated remotely...

PT-2025-24566 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.3 Description: The gitImportSite functionality in HAX CMS PHP obtains a URL string from a POST request and insufficiently validates user input. The set remote function later passes this input into proc open,...

PT-2025-24578 · Totolink · Totolink T10

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 version 4.1.8cu.5207 Description: A critical issue has been found in the TOTOLINK T10, affecting the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argumen...

PT-2025-24132 · Unknown · Email Subscribe Form

Name of the Vulnerable Software and Affected Versions: Elastic Email Subscribe Form versions 1.2.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Elastic Email Subscribe Form, which allows exploitation due to incorrectly configured access control...

PT-2025-24052 · B. Braun · B. Braun Onlinesuite

Name of the Vulnerable Software and Affected Versions: B.Braun OnlineSuite versions prior to AP 3.0 Description: A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server. The issue affects t...