PT-2025-24541 · Unknown · Keeperchat

Name of the Vulnerable Software and Affected Versions: KeeperChat IOS Application version 5.8.8 Description: An issue in the KeeperChat IOS Application allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module. Recommendations: For KeeperChat IOS...

PT-2025-24522 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX versions through 4.2.22 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions through 4.2.22, update to a version later...

PT-2025-24429 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to incorrect authorization, allowing an unprivileged attacker to modify user permissions by sending a POST request to "/PC/Options.aspx?Command=2&Page=-1". This enables the attacker to...

PT-2025-24504 · Unknown · Moreconvert Mc Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: moreconvert MC Woocommerce Wishlist versions 1.9.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potentia...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...

PT-2025-24538

Name of the Vulnerable Software and Affected Versions Mikado-Themes Grill and Chow versions 1.6 and earlier Description The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability affects Mikado-Themes Grill and Chow, enabling potential access to sensitive...

PT-2025-24523 · Thimpress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes versions n/a through 1.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThimPress WP Pipes...

PT-2025-24565 · Pion · Pion Interceptor

Name of the Vulnerable Software and Affected Versions: Pion Interceptor versions v0.1.36 through v0.1.38 Description: Pion Interceptor is a framework for building RTP/RTCP communication software. The issue is caused by a bug in the RTP packet factory, which can be exploited by crafted RTP packets...

PT-2025-24574 · Cyberdata · Cyberdata 011209 Intercom

Name of the Vulnerable Software and Affected Versions: CyberData 011209 Intercom affected versions not specified Description: The issue concerns the improper storage or protection of web server admin credentials. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-24539 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions up to 2.5.7 Description: A vulnerability was found in Emlog, affecting some unknown processing of the file /admin/article.php. The manipulation of the active post argument leads to cross-site scripting. The attack may be...

PT-2025-24366 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp...

PT-2025-24361 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through the get permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-25572 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5232 B20210713 Description: A critical issue has been found in the HTTP POST Request Handler component, affecting the processing of the file /boafrm/formStats. This leads to a buffer overflow. The attack can b...

PT-2025-24360 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through getting permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-24578 · Totolink · Totolink T10

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 version 4.1.8cu.5207 Description: A critical issue has been found in the TOTOLINK T10, affecting the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argumen...

PT-2025-24338 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 6.1.12 Description: The issue is related to Stored Cross-Site Scripting via the eael pricing item tooltip content parameter of the Pricing Table Widget. Th...

PT-2025-24346 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer...

WordPress LTL Freight Quotes – Day & Ross Edition plugin <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via expirydate Parameter vulnerability discovered by sterva in WordPress Plugin LTL Freight Quotes – Day & Ross Edition versions = 2.1.10...

CVE-2025-49128 Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...

CVE-2025-27531

Apache InLong (1.13.0–2.1.0) has a deserialization of untrusted data vulnerability that can allow an authenticated attacker to read arbitrary files by double writing a parameter. The issue stems from unsafe deserialization handling in the JDBC flow. A fixed version is 2.1.0; upgrade to 2.1.0 to m...