PT-2025-24472 · Miniorange · Miniorange Password Policy Manager

Name of the Vulnerable Software and Affected Versions: miniOrange Password Policy Manager versions 2.0.4 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing Authentication Abuse. Recommendations: For miniOrange Password Policy...

PT-2025-24481 · Redqteam · Wishlist

Name of the Vulnerable Software and Affected Versions: redqteam Wishlist versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-24468 · Bzotheme · Bzotheme Giftxtore

Name of the Vulnerable Software and Affected Versions: BZOTheme GiftXtore versions 1.7.4 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24562 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

PT-2025-24565 · Pion · Pion Interceptor

Name of the Vulnerable Software and Affected Versions: Pion Interceptor versions v0.1.36 through v0.1.38 Description: Pion Interceptor is a framework for building RTP/RTCP communication software. The issue is caused by a bug in the RTP packet factory, which can be exploited by crafted RTP packets...

PT-2025-24519 · Unknown · Alex Zaytseff Multi Cryptocurrency Payments

Name of the Vulnerable Software and Affected Versions: Alex Zaytseff Multi CryptoCurrency Payments versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injectio...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...

PT-2025-24520 · Unknown · Formulario De Contacto Salesup!

Name of the Vulnerable Software and Affected Versions: Formulario de contacto SalesUp! versions 1.0.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2025-24473 · Payu · Payu India

Name of the Vulnerable Software and Affected Versions: PayU India versions through 3.8.5 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing authentication abuse. Recommendations: For versions through 3.8.5, update to a version later than 3.8...

PT-2025-24533 · Unknown · Unfoldwp Magty

Name of the Vulnerable Software and Affected Versions: Unfoldwp Magty versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24564 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the...

PT-2025-24511 · Woocommerce · Holest Engineering Spreadsheet Price Changer

Name of the Vulnerable Software and Affected Versions: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions n/a through 2.4.37 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in ...

PT-2025-24405

Name of the Vulnerable Software and Affected Versions Broadstreet WordPress plugin versions prior to 1.51.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...

PT-2025-24492 · Fantasticplugins · Sumo Affiliates Pro

Name of the Vulnerable Software and Affected Versions: FantasticPlugins SUMO Affiliates Pro versions n/a through 10.7.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 10.7.0,...

PT-2025-24510 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions n/a through 2.12.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-24526 · Sprig +1 · Sprig +1

Name of the Vulnerable Software and Affected Versions: Listmonk versions 4.0.0 through 5.0.2 Description: Listmonk is a standalone, self-hosted, newsletter and mailing list manager. The env and expandenv template functions, enabled by default in Sprig, allow capturing of environment variables on...

PT-2025-24429 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to incorrect authorization, allowing an unprivileged attacker to modify user permissions by sending a POST request to "/PC/Options.aspx?Command=2&Page=-1". This enables the attacker to...

PT-2025-24485 · Unknown · Lambertgroup Sticky Radio Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky Radio Player versions n/a through 3.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-24574 · Cyberdata · Cyberdata 011209 Intercom

Name of the Vulnerable Software and Affected Versions: CyberData 011209 Intercom affected versions not specified Description: The issue concerns the improper storage or protection of web server admin credentials. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-24521 · Unknown · Cryptocloud - Crypto Payment Gateway

Name of the Vulnerable Software and Affected Versions: CryptoCloud - Crypto Payment Gateway versions n/a through 2.1.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...