PT-2025-27051 · WordPress · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox WordPress plugin versions prior to 2.3.16 Description: The issue concerns the Firelight Lightbox WordPress plugin, which does not properly sanitise and escape title attributes before displaying them on the page. This could...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

PT-2025-27144

Name of the Vulnerable Software and Affected Versions: Net::IP::LPM version 1.10 Description: The issue arises from the improper consideration of leading zero characters in IP CIDR address strings, potentially allowing attackers to bypass access control based on IP addresses. This confusion can...

PT-2025-27196 · Unknown · Morten Dalgaard Johansen Dashboard Widget Sidebar

Name of the Vulnerable Software and Affected Versions: Morten Dalgaard Johansen Dashboard Widget Sidebar versions 1.2.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

PT-2025-27075 · Kingdee +1 · Kingdee Cloud-Starry-Sky Enterprise Edition +1

Name of the Vulnerable Software and Affected Versions: Kingdee Cloud-Starry-Sky Enterprise Edition versions 6.x through 9.0 Description: A critical issue has been found, affecting the function plugin.buildMobilePopHtml of the file k3o2oboswebappactionDynamicForm 4 Action.class of the component...

PT-2025-27126 · Designthemes · Designthemes Lms

Name of the Vulnerable Software and Affected Versions: designthemes LMS versions n/a through 9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

PT-2025-27165 · Wow Company · Hover Effects

Name of the Vulnerable Software and Affected Versions: Wow-Company Hover Effects versions n/a through 2.1.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27279 · Mescius · Activereports.Net

Name of the Vulnerable Software and Affected Versions: Mescius ActiveReports.NET affected versions not specified Description: The issue concerns a deserialization of untrusted data remote code execution vulnerability in the TypeResolutionService. This allows for remote code execution. The estimat...

PT-2025-27231 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.5.0 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. This issu...

PT-2025-27178 · Woocommerce · Additional Order Filters For Woocommerce

Name of the Vulnerable Software and Affected Versions: Additional Order Filters for WooCommerce versions 1.22 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...

PT-2025-27139 · Unknown · Uxper Nuss

Name of the Vulnerable Software and Affected Versions: uxper Nuss versions 1.3.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.3.3 and earlier, update to a version that contains a fix for this...

PT-2025-27132 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.7.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-27210 · Onionbuzz · Onionbuzz

Name of the Vulnerable Software and Affected Versions: OnionBuzz versions n/a through 1.0.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Looks Awesome OnionBuzz. Recommendations: For OnionBuzz versions n/a through 1.0.7, update to a version...

PT-2025-27153 · Cookiebot · Cookiebot

Name of the Vulnerable Software and Affected Versions: Cookiebot versions through 4.5.8 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a user...

GHSA-9R64-3WMC-X8M8 Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper enforcement of resource limits in the nftables rules generation process for managed bridge networks. An attacker can exhaust the DHCP pool and disrupt network...

CVE-2025-52904 File Browser: Command Execution not Limited to Scope

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

MAL-2025-5284 Malicious code in meuhq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a603acb3997e3395851edc9bc2cb0812dff4a2eb9a5f0bf87aa6b5bc229a0097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...