PT-2025-21743 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue affects the MDELETE Command Handler component, leading to a buffer overflow. This can be exploited remotely. Recommendations: For FreeFloat FTP Server version 1.0, consider...

PT-2025-21736 · Woocommerce · Import Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Import Export For WooCommerce versions 1.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-21675 · Themeton · Themeton Spare

Name of the Vulnerable Software and Affected Versions: themeton Spare versions n/a through 1.7 Description: A Cross-Site Request Forgery CSRF issue affects themeton Spare, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For themeton Spare versions n/a through...

PT-2025-21710 · Romancode · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG versions n/a through 8.5.34 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', in RomanCode MapSVG, allowing Code Injection. Recommendations: For versions n/a through 8.5.34,...

PT-2025-21642 · Seaweedfs · Seaweedfs

Name of the Vulnerable Software and Affected Versions: seaweedfs version 3.68 Description: A SQL injection issue was discovered in the component /abstract sql/abstract sql store.go. This issue affects seaweedfs and can be exploited via the vulnerable component. Recommendations: For seaweedfs...

PT-2025-21726 · WordPress · Steve Puddick Wp Notes Widget

Name of the Vulnerable Software and Affected Versions: Steve Puddick WP Notes Widget versions 1.0.0 through 1.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-21651

Name of the Vulnerable Software and Affected Versions Qt versions prior to 5.15.19 Qt versions 6.0.0 through 6.5.8 Qt versions 6.6.0 through 6.8.1 Description An improper link resolution issue exists in QFileSystemEngine within the Qt corelib module on Windows. This flaw arises from the use of th...

PT-2025-21683 · Unknown · Lambertgroup Multimedia Responsive Carousel With Image Video Audio Support

Name of the Vulnerable Software and Affected Versions: LambertGroup Multimedia Responsive Carousel with Image Video Audio Support versions through 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command...

PT-2025-21749 · Unknown · Phpgurukul Online Course Registration System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Course Registration version 3.1 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /news.php. The manipulation of the newstitle argument leads to SQL injection. This...

PT-2025-21637 · Syncpilot · Live Contract

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A path traversal vulnerability in the file download functionality allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server...

PT-2025-21735 · Unknown · Berthaai Bertha Ai

Name of the Vulnerable Software and Affected Versions: berthaai BERTHA AI versions 1.12.11 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2025-21687 · Lambertgroup · Lambertgroup Sticky Html5 Music Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky HTML5 Music Player versions 3.1.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-21692 · WordPress · Lambertgroup Radio Player Shoutcast & Icecast Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin versions through 4.4.6 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This...

PT-2025-21706 · WordPress · Valvepress Wordpress Auto Spinner

Name of the Vulnerable Software and Affected Versions: ValvePress Wordpress Auto Spinner versions 3.25.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-21618 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.4-00 Description: The issue is related to a Missing Authorization vulnerability in the Hitachi Ops Center Analyzer detail view component. This vulnerability affects the specified...

CVE-2025-4727

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

CVE-2025-4727 Meteor livedata_server.js Object.assign redos

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedataserver.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be...

Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-38896).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-38896 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the frommathprompt and...

CVE-2025-47287

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

Security Bulletin: Vulnerability in commons-compress affects IBM Integrated Analytics System (Sailfish) [CVE-2024-25710, CVE-2024-26308]

Summary The commons-compress package is used by IBM Integrated Analytics System . IBM Integrated Analytics System has addressed the applicable CVECVE-2024-25710, CVE-2024-26308. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop'...