PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

PT-2025-24560 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido versions prior to 0.48.0 Description: Caido is a web security auditing toolkit that lacks protection for DNS rebinding, allowing it to be loaded on an attacker-controlled domain. This enables a malicious website to hijack the...

PT-2025-24539 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions up to 2.5.7 Description: A vulnerability was found in Emlog, affecting some unknown processing of the file /admin/article.php. The manipulation of the active post argument leads to cross-site scripting. The attack may be...

PT-2025-24567 · Vue.Js · Vue-Cli

Name of the Vulnerable Software and Affected Versions: vuejs vue-cli versions up to 5.0.8 Description: A vulnerability was found in the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficien...

PT-2025-24360 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through getting permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-24361 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through the get permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-24366 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp...

PT-2025-25572 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5232 B20210713 Description: A critical issue has been found in the HTTP POST Request Handler component, affecting the processing of the file /boafrm/formStats. This leads to a buffer overflow. The attack can b...

PT-2025-24346 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer...

PT-2025-24578 · Totolink · Totolink T10

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 version 4.1.8cu.5207 Description: A critical issue has been found in the TOTOLINK T10, affecting the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argumen...

PT-2025-24338 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 6.1.12 Description: The issue is related to Stored Cross-Site Scripting via the eael pricing item tooltip content parameter of the Pricing Table Widget. Th...

WordPress LTL Freight Quotes – Day & Ross Edition plugin <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via expirydate Parameter vulnerability discovered by sterva in WordPress Plugin LTL Freight Quotes – Day & Ross Edition versions = 2.1.10...

CVE-2025-49128 Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's JsonLocation.appendSourceDesc method allows up to 500 bytes of unintended memory content t...

CVE-2025-27531

A deserialization of untrusted data vulnerability exists in Apache InLong , affecting versions from 1.13.0 before 2.1.0 . The root cause is unsafe deserialization processing of serialized data submitted by a user. An authenticated attacker can exploit this by double writing the param to achieve a...

CVE-2025-5713

A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown functionality of the file /fluxos-dashboard of the component Flow Handler. The manipulation of the argument Descrição da solicitação leads to cross site...

PT-2025-24177 · Unknown · Booqable Rental

Name of the Vulnerable Software and Affected Versions: Booqable Rental versions through 2.4.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-24187 · Unknown · Elite Video Player

Name of the Vulnerable Software and Affected Versions: Elite Video Player versions 10.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Elite Video Player, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Elite Video Player...

PT-2025-24242 · WordPress · Persian Woocommerce Sms

Name of the Vulnerable Software and Affected Versions: Persian Woocommerce SMS versions 7.0.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24266 · Unknown · Bacon Ipsum

Name of the Vulnerable Software and Affected Versions: Bacon Ipsum versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicio...

PT-2025-24107 · Unknown · Next Event Calendar

Name of the Vulnerable Software and Affected Versions: Next Event Calendar versions n/a through 1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...