PT-2025-30228 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.5 through 6.8.2 Description: WordPress versions 3.5 through 6.8.2 are susceptible to a flaw that allows remote attackers to determine the titles of private and draft posts through pingback.ping XML-RPC requests...

PT-2025-30243 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate versions prior to 7.4.3 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s shortcodes. Insufficient...

PT-2025-30291 · Unknown +1 · Strongswan +1

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-WLC100P version 2.03b03 Description: The i dont care about security and use aggressive mode psk option is enabled in the strongSwan configuration file, allowing IKE Responders to use IKEv1 Aggressive Mode with Pre-Shared Keys. Th...

PT-2025-30288 · Sk Telecom · Com.Skt.Prod.Dialer

Name of the Vulnerable Software and Affected Versions: com.skt.prod.dialer versions through 12.5.0 Description: The application allows any installed application, without requiring any permissions, to initiate phone calls without user interaction. This is achieved by sending a specially crafted...

PT-2025-30271 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An arbitrary file writing vulnerability exists in the Secure PDF eXchange SPX feature. This can lead to pre-authentication remote code execution when SPX is enabled with a specifi...

PT-2025-30277 · Unknown · Extremecontrol

Name of the Vulnerable Software and Affected Versions: ExtremeControl versions prior to 25.5.12 Description: The application contains a cross-site scripting XSS issue in a login interface. This is due to improper handling of user-supplied input within HTML attributes, which allows an attacker to...

PT-2025-30362

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev90 Description pyLoad contains an authenticated path traversal vulnerability in the /json/upload endpoint. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended uploa...

PT-2025-30328 · Luxcal · Luxcal

Name of the Vulnerable Software and Affected Versions: Luxcal version 4.5.2 Description: A reflected cross-site scripting XSS vulnerability exists in index.php that allows an unauthenticated attacker to steal other users' data. Recommendations: Update to a newer version that contains a fix for th...

PT-2025-30343

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions up to and including 25.7.18.2519 Description Manager-io/Manager is accounting software with a critical unauthenticated Server-Side Request Forgery SSRF vulnerability identified in the proxy handler component. This...

Malicious code in grayavatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a840f69e770a8a7f48a5cd9ce41432db11d5c5f9f0cc48c3d64dda80c93fad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

CVE-2025-7864 thinkgem JeeSite FileUploadController.java upload unrestricted upload

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to unrestricted upload. It is possible to initiate the attack...

CVE-2025-7863 thinkgem JeeSite ServletUtils.java redirectUrl

A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be...

PT-2025-30167

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A vulnerability exists in thinkgem JeeSite up to version 5.12.0 related to cross-site scripting. The issue resides in the xssFilter function within the...

PT-2025-30194 · Instantbits · Instantbits Web Video Cast App

Name of the Vulnerable Software and Affected Versions: InstantBits Web Video Cast App versions up to 5.12.4 Description: A vulnerability exists in the InstantBits Web Video Cast App for Android, related to the improper export of android application components through manipulation of the...

PT-2025-30172 · Portabilis · Portabilis I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario version 1.5.0 Description: A problematic issue exists in the justificativas-de-falta component of Portabilis i-Diario. The manipulation of the Anexo argument in the justificativas-de-falta Endpoint leads to cross site...

PT-2025-30189 · Unknown · Zavy86 Wikidocs

Name of the Vulnerable Software and Affected Versions: Zavy86 WikiDocs versions through 1.0.78 Description: A vulnerability exists in Zavy86 WikiDocs, potentially allowing for cross site scripting. The issue is located in the file template.inc.php and involves manipulation of the path argument. T...

PT-2025-30166

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A critical issue exists in thinkgem JeeSite that allows for unrestricted file uploads. The Upload function within the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java ...

PT-2025-30190 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat versions 4.60 and 4.61 Description: A stored cross-site scripting XSS issue exists in the Personal Canned Messages feature. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload...

PT-2025-30207 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A cross-site scripting issue exists due to the addSave function within the com/ruoyi/web/controller/system/SysNoticeController.java file. This allows for remote attacks. The exploit detail...