PT-2025-23594 · WordPress · Woocommerce Ultimate Gift Card

Name of the Vulnerable Software and Affected Versions: Ultimate Gift Cards for WooCommerce plugin for WordPress versions prior to 3.1.5 Description: The issue is related to boolean-based SQL Injection via the default price and product id parameters. This is due to insufficient escaping of...

PT-2025-23617 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to...

PT-2025-23658 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 DataEase version 2.10.6 through 2.10.9 Description: The issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection due to a bypass of a previous patch...

PT-2025-23591 · Timeworks · Timeworks

Name of the Vulnerable Software and Affected Versions: TimeWorks versions 10.0 through 10.3 Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This could allow a remote unauthenticated attacker to access arbitrary JSON...

PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...

PT-2025-23677

Name of the Vulnerable Software and Affected Versions Deno versions 1.46.0 through 2.1.6 Description The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks th...

PT-2025-23612 · Phpcms · Phpcms

Name of the Vulnerable Software and Affected Versions: phpwcms versions 1.9.45 through 1.10.8 Description: A critical vulnerability was found in the Feedimport Module of phpwcms, affecting unknown code in the file include/inc module/mod feedimport/inc/processing.inc.php. The manipulation of the c...

PT-2025-23675 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R version 1.0.0-B20230726.1108 Description: The issue is related to a cross-site scripting vulnerability in the Virtual Server Page of the TOTOLINK X2000R router. This vulnerability can be exploited remotely by manipulating the...

PT-2025-23615 · Erupt · Erupt

Name of the Vulnerable Software and Affected Versions: erupt version 1.12.19 Description: The issue is related to an arbitrary file upload vulnerability in the /upload/GoodsCategory/image component, which allows attackers to execute arbitrary code by uploading a crafted file. Recommendations: For...

PT-2025-23668 · Unknown · Jrohy Trojan

Name of the Vulnerable Software and Affected Versions: Jrohy trojan versions up to 2.15.3 Description: A critical issue affects the LogChan function in the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. This issue can be initiated remotely, but the...

PT-2025-23664 · Unknown · Enilu Web-Flash

Name of the Vulnerable Software and Affected Versions: enilu web-flash version 1.0 Description: A problematic vulnerability has been found in the File Upload component of enilu web-flash. This issue affects the fileService.upload function, allowing for cross-site scripting through the manipulatio...

PT-2025-23652 · Maxkb · Maxkb

Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.10.8-lts Description: The issue allows attackers to exploit certain files with execution permissions in non-blacklisted directories to carry out attacks, as the Sandbox only restricts the execution permissions of...

CVE-2025-48957

AstrBot has a documented path traversal vulnerability in versions 3.4.4–3.5.12 that can disclose sensitive data (e.g., LLM API keys and passwords) via the /api/chat/get_file endpoint. The issue is addressed in PR #1676 and included in v3.5.13. A temporary workaround is to disable the dashboard in...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

PT-2025-23508 · Sslh +1 · Sslh +1

Name of the Vulnerable Software and Affected Versions: sslh versions prior to 2.2.4 Description: A Use of Out-of-range Pointer Offset issue in sslh leads to denial of service on some architectures. Recommendations: For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue...

PT-2025-23446 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS versions up to 3.4.2 Description: A critical vulnerability has been found in the General Setting Page component of juzaweb CMS, affecting unknown code of the file /admin-cp/setting/system/general. This vulnerability leads to...

PT-2025-23555 · Hax · Hax Cms +1

Name of the Vulnerable Software and Affected Versions: HAX open-apis versions up to and including 10.0.2 Description: An unauthenticated information disclosure issue exists in the HAX content management system via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrie...

PT-2025-23493 · Arm · Valhall Gpu Kernel Driver +1

Name of the Vulnerable Software and Affected Versions: Valhall GPU Kernel Driver versions r53p0 through r53p0 Arm 5th Gen GPU Architecture Kernel Driver versions r53p0 through r53p0 Description: The issue allows a local non-privileged user process to perform improper GPU memory processing...

PT-2025-23485 · Linksys · Linksys Re6300 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500 version 1.0.013.001 Linksys RE6250 version 1.0.013.001 Linksys RE6300 version 1.0.013.001 Linksys RE6350 version 1.0.013.001 Linksys RE7000 version 1.0.013.001 Linksys RE9000 version 1.0.013.001 Linksys RE6500 version 1.0.04.00...

PT-2025-23524 · Sitecom · Sitecom Wlx-2006

Name of the Vulnerable Software and Affected Versions: Sitecom WLX-2006 Wall Mount Range Extender N300 versions 1.5 and earlier Description: The issue concerns the use of default credentials in the Sitecom WLX-2006 Wall Mount Range Extender N300. This allows unauthorized access to the device. No...