PT-2025-30202 · Harry0703 · Moneyprinterturbo

Name of the Vulnerable Software and Affected Versions: harry0703 MoneyPrinterTurbo versions through 1.2.6 Description: A critical issue exists in harry0703 MoneyPrinterTurbo. The upload bgm file function within the File Extension Handler component, located in the app/controllers/v1/video.py file,...

PT-2025-30109 · WordPress · Epay.Bg Payments

Name of the Vulnerable Software and Affected Versions: EPay.bg Payments plugin for WordPress versions up to and including 0.1 Description: The EPay.bg Payments plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s epay shortcode. Insufficient input sanitization a...

PT-2025-30156 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.20-dev Description: Pluck CMS contains a flaw that allows an authenticated attacker to upload or create a crafted PHP file within the albums module directory. This file can then be accessed through the module routing log...

PT-2025-30126 · WordPress · Simple Backup

Name of the Vulnerable Software and Affected Versions: Simple Backup versions prior to 2.7.11 Description: The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download due to a lack of capability checks and file type validation in the download backup file function. This allows...

PT-2025-30132

Name of the Vulnerable Software and Affected Versions Work The Flow File Upload plugin for WordPress versions up to and including 2.5.2 Description The Work The Flow File Upload plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the...

Azure Linux 3.0 Security Update: httpd (CVE-2024-42516)

The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42516 advisory. - HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the...

PT-2025-30112 · WordPress · Partnerský Systém Martinus Plugin

Name of the Vulnerable Software and Affected Versions: Partnerský systém Martinus plugin for WordPress versions up to and including 1.7.1 Description: The Partnerský systém Martinus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s martinus shortcode...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

Predictable Value Range from Previous Values

Overview Affected versions of this package are vulnerable to Predictable Value Range from Previous Values via the boundary value, which uses Math.random. An attacker can manipulate HTTP request boundaries by exploiting predictable values, potentially leading to HTTP parameter pollution. Remediati...

PT-2025-30093 · Unknown +1 · Qbittorrent +1

Name of the Vulnerable Software and Affected Versions: qBittorrent versions prior to 5.1.2 Description: qBittorrent does not prevent access to a local file referenced in a link URL. This issue affects the rsswidget.cpp and searchjobwidget.cpp files. Recommendations: Update qBittorrent to version...

PT-2025-29985 · WordPress · Wp Knowledgebase

Name of the Vulnerable Software and Affected Versions: Knowledge Base plugin for WordPress versions prior to 2.3.2 Description: The Knowledge Base plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin slug setting due to insufficient input sanitization and output...

PT-2025-30051 · Melange · Melange

Name of the Vulnerable Software and Affected Versions: melange versions 0.23.0 through 0.29.4 Description: melange allows users to build apk packages using declarative pipelines. SBOM files generated by melange in apks had file system permissions mode 666, potentially allowing an unprivileged use...

PT-2025-29990 · WordPress · Aapanel Wp Toolkit

Name of the Vulnerable Software and Affected Versions: aapanel WP Toolkit versions 1.0 through 1.1 Description: The aapanel WP Toolkit plugin for WordPress is susceptible to privilege escalation due to missing authorization checks within the auto login function. Authenticated attackers with...

PT-2025-29987 · WordPress · Plugin Pengiriman Woocommerce Kurir Reguler

Name of the Vulnerable Software and Affected Versions: Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship versions through 3.2.0 Description: The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship for WordPress is susceptible to an Insecure Direct Object...

PT-2025-30089 · Phpgurukul · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A cross-site scripting issue exists in PHPGurukul Complaint Management System 2.0. The vulnerability is located in the /admin/complaint-search.php file. Manipulation of the Searc...

PT-2025-29999 · WordPress · Woocommerce Refund/Exchange With Rma - Warranty Management

Name of the Vulnerable Software and Affected Versions: WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet versions up to and including 3.2.6 Description: The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User...

PT-2025-29994 · WordPress · Vertical Scroll Image Slideshow Gallery

Name of the Vulnerable Software and Affected Versions: Vertical scroll image slideshow gallery plugin for WordPress versions prior to 11.2 Description: The plugin is susceptible to Stored Cross-Site Scripting through the width parameter due to inadequate input sanitization and output escaping. Th...

PT-2025-30050 · Apko · Apko

Name of the Vulnerable Software and Affected Versions: apko versions 0.27.0 through 0.29.4 Description: apko is a tool that allows users to build and publish OCI container images built from apk packages. In versions prior to 0.29.5, critical files were inadvertently set to 0666, which could...

PT-2025-30086 · Hotelmis · Hotelmis

Name of the Vulnerable Software and Affected Versions: cgpandey hotelmis versions prior to c572198e6c4780fccc63b1d3e8f3f72f825fc94e Description: A problematic issue exists in the admin.php file's HTTP GET Request Handler component. Manipulation of the Search argument can lead to cross-site...

PT-2025-30044 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in xxl-job. The httpJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to server-side request forgery SSRF. This...