PT-2025-29997 · WordPress · Testimonial Post Type Plugin

Name of the Vulnerable Software and Affected Versions: Testimonial Post type plugin for WordPress versions prior to 1.2.2 Description: The Testimonial Post type plugin for WordPress is susceptible to Stored Cross-Site Scripting through the auto play parameter. Insufficient input sanitization and...

PT-2025-43676

Name of the Vulnerable Software and Affected Versions Wasmtime versions 38.0.0 through 38.0.2 Description Wasmtime is a runtime for WebAssembly. Versions from 38.0.0 through 38.0.2 contain a flaw in the implementation of component-model related host-to-wasm trampolines. Specifically, a carefully...

PT-2025-30023 · WordPress · Balbooa Gallery

Name of the Vulnerable Software and Affected Versions: Balbooa Gallery plugin versions 1.0.0 through 2.4.0 Description: A stored cross-site scripting XSS issue exists in the Balbooa Gallery plugin for Joomla. Privileged users can store malicious scripts within gallery items. Recommendations: Upda...

PT-2025-30079 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC versions up to 2.4 Description: A null pointer dereference issue exists in the gf dash download init segment function within the src/media tools/dash client.c file. Manipulation of the base init url argument can trigger this issue. This...

PT-2025-30045 · Unknown · File Manager

Name of the Vulnerable Software and Affected Versions: Filemanager version 2.5.0 Description: An arbitrary file upload vulnerability exists in the /rsc/filemanager.rsc.class.php component. Attackers can execute arbitrary code by uploading a crafted SVG file. Recommendations: Filemanager version...

PT-2025-29995 · WordPress · The Useful Tab Block – Responsive & Amp-Compatible

Name of the Vulnerable Software and Affected Versions: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress versions prior to 1.3.3 Description: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is susceptible to Stored Cross-Site Scripting through the...

PT-2025-30001 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions up to and including 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection due to a missing capability check on the b1 run query API endpoint. This allows authenticated attackers...

PT-2025-30019 · WordPress · Loginpress Pro

Name of the Vulnerable Software and Affected Versions: LoginPress Pro versions prior to 5.0.1 Description: The LoginPress Pro plugin for WordPress is susceptible to authentication bypass in all versions up to and including 5.0.1. This issue stems from inadequate verification of the user returned ...

PT-2025-29989 · WordPress · Copymatic – Ai Content Writer & Generator

Name of the Vulnerable Software and Affected Versions: Copymatic – AI Content Writer & Generator plugin for WordPress versions up to and including 2.1 Description: The Copymatic – AI Content Writer & Generator plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or...

PT-2025-30047 · Xuxueli · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in Xuxueli xxl-job. The commandJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to OS command injection. This...

CVE-2025-7763

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-7763 thinkgem JeeSite Site Controller SiteController.java select redirect

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-54068

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is...

CVE-2025-53638

CVE-2025-53638 (Solady) affects the Solady library for Solidity snippets. From versions 0.0.125 up to 0.1.23, deploying an account via a proxy and calling its initialization with regular Solidity may silently fail if the initialization function does not return a bool or other data. The root cause...

PT-2025-29981

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A problematic vulnerability exists in thinkgem JeeSite. The select function within the src/main/java/com/jeesite/modules/cms/web/SiteController.java file of the Site Controller component is...

PT-2025-29980

Name of the Vulnerable Software and Affected Versions Brocade ASCG versions prior to 3.3.0 Description A vulnerability exists in the ascgshell component of Brocade ASCG. The software stores commands executed in the Command Line Interface CLI in plain text within the command history. A locally...

PT-2025-29943 · Lenovo · Lenovo Vantage

Name of the Vulnerable Software and Affected Versions: Lenovo Vantage affected versions not specified Description: Lenovo Vantage contains an improper validation issue that may allow a local attacker to execute code with elevated permissions by modifying an application configuration file...

PT-2025-29912

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 1.10.9-lts MaxKB versions prior to 2.0.0 Description A Remote Command Execution issue exists in the MCP call. Recommendations Update to version 1.10.9-lts or later. Update to version 2.0.0 or later...

PT-2025-29904

Name of the Vulnerable Software and Affected Versions Stop User Enumeration WordPress plugin versions prior to 1.7.3 Description The Stop User Enumeration WordPress plugin blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. This protection can be bypassed by URL-encoding the...

PT-2025-29928 · Unknown · Haichang Oa

Name of the Vulnerable Software and Affected Versions: Haichang OA version 1.0.0 Description: The software contains a SQL Injection vulnerability. A remote attacker can obtain sensitive information via the if parameter in hcit.project.rte.agents.UploadImages.class. Recommendations: Update to a...