PT-2025-17760 · Unknown · M A Vinoth Kumar Frontend Dashboard

Name of the Vulnerable Software and Affected Versions: M A Vinoth Kumar Frontend Dashboard versions 2.2.5 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attack...

PT-2025-17733 · Trpc · Trpc

Name of the Vulnerable Software and Affected Versions: tRPC versions 11.0.0 through 11.1.0 Description: The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocke...

PT-2025-17795 · Unknown · Michael Cannon Flickr Shortcode Importer

Name of the Vulnerable Software and Affected Versions: Michael Cannon Flickr Shortcode Importer versions n/a through 2.2.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 2.2.3, update to a version...

PT-2025-29941

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.0.0 Description 7-Zip is a file archiver that supports extracting from Compound Documents. A null pointer dereference in the Compound handler may lead to denial of service. Recommendations Update to version 25.0.0 or...

PT-2025-17874 · Allegra +1 · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this issue. The flaw exists within the implementatio...

PT-2025-17826 · Unknown · Billy Bryant Tabs

Name of the Vulnerable Software and Affected Versions: Billy Bryant Tabs versions n/a through 4.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 4.0.3, update to a version later than 4.0.3 to resolve th...

PT-2025-17638 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version V15.03.05.14 multi Description: The issue is a stack overflow vulnerability in the "/goform/WifiWpsStart" API endpoint, which may lead to remote arbitrary code execution. Recommendations: For Tenda ac9 version V15.03.05.14...

PT-2025-17673 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after logout. Recommendations: For IBM InfoSphere Information...

PT-2025-17607 · WordPress · Wordpress Simple Shopping Cart

Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to and including 5.1.2 Description: The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the...

PT-2025-17643 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.6-milestone-1 through 15.10.16 XWiki versions prior to 16.4.6 XWiki versions prior to 16.10.1 Description: The issue allows a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection t...

PT-2025-17668 · Byd · Byd Qin Plus Dm-I Dilink Os

Name of the Vulnerable Software and Affected Versions: BYD QIN PLUS DM-i Dilink OS versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0 Description: The issue allows attackers to execute a man-in-the-middle attack because the affected software sends broadcasts to the manufacturer's clou...

PT-2025-17646 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5032 B20200408 Description: The issue concerns a Command Injection vulnerability in the downloadFile.cgi file via the QUERY STRING parameter. This allows for potential exploitation. There is a high risk of...

PT-2025-17637 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version 1.0 with firmware V15.03.05.14 multi Description: The issue is related to a stack overflow vulnerability in the rebootTime parameter of the "/goform/SetSysAutoRebbotCfg" API endpoint. This vulnerability can lead to remote...

PT-2025-17677 · Nih · Nih Brics

Name of the Vulnerable Software and Affected Versions: NIH BRICS aka Biomedical Research Informatics Computing System versions 14.0.0-67 and earlier Description: The issue allows users without the InET role to access the InET module by making direct requests to known endpoints. Recommendations: F...

CVE-2025-32965 Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

CVE-2025-26413 Apache Kvrocks: The server was crashed by the negative offset

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the offset input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. User...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17565 · Unknown · Sacco Management System

Name of the Vulnerable Software and Affected Versions: Sacco Management system version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the password parameter at the "/sacco/ajax.php" API endpoint. Recommendations: For Sacco Management system version...

PT-2025-17486

Name of the Vulnerable Software and Affected Versions Front End Users WordPress plugin versions 3.2.32 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where the Front End Users WordPress plugin does not properly sanitise and escape a parameter before...

PT-2025-17516 · Unknown · Kofimokome Message Filter For Contact Form 7

Name of the Vulnerable Software and Affected Versions: kofimokome Message Filter for Contact Form 7 versions 1.6.3.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...