PT-2025-26918 · WordPress · Image Editor By Pixo

Name of the Vulnerable Software and Affected Versions: The Image Editor by Pixo plugin for WordPress versions up to, and including, 2.3.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attacker...

PT-2025-26987 · Unknown · Phpgurukul Pre-School Enrollment System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System Project version 1.0 Description: The issue concerns a Directory Traversal vulnerability in the manage-classes.php file. Recommendations: For PHPGurukul Pre-School Enrollment System Project version 1.0,...

PT-2025-26991

Name of the Vulnerable Software and Affected Versions: Beward N100 IP Camera version M2.1.6.04C014 Description: An authenticated command injection issue exists via the ServerName and TimeZone parameters in the "servetest" CGI page. An attacker with web interface access can inject arbitrary system...

PT-2025-27021

Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue affects the function sub 484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack...

PT-2025-26929 · WordPress · Homerunner

Name of the Vulnerable Software and Affected Versions: Homerunner plugin for WordPress versions prior to 1.0.30 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the main settings function. This allows unauthenticated attackers to upda...

CVE-2025-6669 gooaclok819 sublinkX jwt.go hard-coded key

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. Th...

CVE-2025-52479 HTTP.jl vulnerable to CR/LF Injection in URIs

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...

PT-2025-26866

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: OpenBao is a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The issue allows an attacker to perform unauthenticated, unaudited...

PT-2025-26856 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ affected versions not specified Description: The issue concerns JSON Web Tokens JWT that do not expire in MICROSENS NMP Web+, potentially allowing an attacker to gain access to the system. Recommendations: At the moment,...

PT-2025-26858 · Unknown · Registrator

Name of the Vulnerable Software and Affected Versions: Registrator versions prior to 1.9.5 Description: The issue concerns a GitHub app that automates creation of registration pull requests for julia packages. If the clone URL returned by GitHub is malicious, an argument injection is possible in...

PT-2025-26829 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta6 Description: The issue is related to cross-site scripting when the content security policy is not enabled, specifically when using social logins. Recommendations: For versions prior to 3.5.0.beta6, upda...

PT-2025-26807 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end database. Thi...

PT-2025-26872 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue has been found, affecting the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. This issue can be exploited...

PT-2025-26820 · Unknown · Plc Designer V4

Name of the Vulnerable Software and Affected Versions: PLC Designer V4 Description: A local, low-privileged attacker can learn the password of the connected controller due to an incorrect implementation that results in the password being displayed in plain text under special conditions...

PT-2025-28086 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical issue has been found that affects the formWlanSetupWPS function of the /goform/formWlanSetupWPS file in the webs component. The manipulation of the wps enrolee pin/webpage argument leads ...

PT-2025-26860 · Unknown · Gitforge.Jl

Name of the Vulnerable Software and Affected Versions: GitForge.jl versions prior to 5.9.1 Description: The issue is related to a lack of input validation for user-provided values in certain functions. Specifically, in the GitHub.repo function, the repo name field can be set to any string, which ...

PT-2025-26837 · Cvat · Cvat

Name of the Vulnerable Software and Affected Versions: CVAT versions 2.2.0 through 2.39.0 Description: CVAT is an open source interactive video and image annotation tool for computer vision. The issue arises from the lack of validation during the import process of a project or task backup, allowi...

PT-2025-26831 · Unknown · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the software. It affects an unknown function of the file /panel/stock.php. The manipulation of the ID argument leads to SQL injection. This iss...

PT-2025-26908 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical issue has been found in the code-projects Inventory Management System. The problem affects the /php action/fetchSelectedBrand.php file, where the manipulation of th...

PT-2025-26909 · Sublinkx · Sublinkx

Name of the Vulnerable Software and Affected Versions: gooaclok819 sublinkX versions up to 1.8 Description: A vulnerability was found in the unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to the use of a hard-coded cryptographic key. The attack can be...