PT-2025-17668 · Byd · Byd Qin Plus Dm-I Dilink Os

Name of the Vulnerable Software and Affected Versions: BYD QIN PLUS DM-i Dilink OS versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0 Description: The issue allows attackers to execute a man-in-the-middle attack because the affected software sends broadcasts to the manufacturer's clou...

PT-2025-17643 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.6-milestone-1 through 15.10.16 XWiki versions prior to 16.4.6 XWiki versions prior to 16.10.1 Description: The issue allows a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection t...

PT-2025-17638 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version V15.03.05.14 multi Description: The issue is a stack overflow vulnerability in the "/goform/WifiWpsStart" API endpoint, which may lead to remote arbitrary code execution. Recommendations: For Tenda ac9 version V15.03.05.14...

PT-2025-17646 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5032 B20200408 Description: The issue concerns a Command Injection vulnerability in the downloadFile.cgi file via the QUERY STRING parameter. This allows for potential exploitation. There is a high risk of...

PT-2025-17637 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version 1.0 with firmware V15.03.05.14 multi Description: The issue is related to a stack overflow vulnerability in the rebootTime parameter of the "/goform/SetSysAutoRebbotCfg" API endpoint. This vulnerability can lead to remote...

CVE-2025-32965 Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

CVE-2025-26413 Apache Kvrocks: The server was crashed by the negative offset

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the offset input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. User...

PT-2025-17550

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Framework affected versions not specified Description The issue is related to improper control of code generation, which could be exploited through remote code execution. A successful exploit might lead to code execution and data...

PT-2025-17505 · Unknown · Jeff Starr Simple Download Counter

Name of the Vulnerable Software and Affected Versions: Jeff Starr Simple Download Counter versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-17514 · Vform · Vform

Name of the Vulnerable Software and Affected Versions: VForm versions 3.1.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-17561 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1 1 parameter. This enables attackers to potentially manipulate w...

PT-2025-17515 · Unknown · Vikrestaurants Table Reservations/Take-Away

Name of the Vulnerable Software and Affected Versions: VikRestaurants Table Reservations and Take-Away versions 1.3.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.3.3 and earlier,...

PT-2025-17516 · Unknown · Kofimokome Message Filter For Contact Form 7

Name of the Vulnerable Software and Affected Versions: kofimokome Message Filter for Contact Form 7 versions 1.6.3.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

PT-2025-17569 · Totolink · Totolink A830R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A830R version 4.1.2cu.5182 B20201102 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

PT-2025-17557

Name of the Vulnerable Software and Affected Versions Open5GS UPF versions up to v2.7.2 Description The issue results in an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Session Establishment Request with PDN Type = 0, the UPF fails to handle the...

PT-2025-17503 · Unknown · Rbaer List Last Changes

Name of the Vulnerable Software and Affected Versions: rbaer List Last Changes versions n/a through 1.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17486

Name of the Vulnerable Software and Affected Versions Front End Users WordPress plugin versions 3.2.32 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where the Front End Users WordPress plugin does not properly sanitise and escape a parameter before...

PT-2025-17489 · Apache · Apache Kvrocks

Name of the Vulnerable Software and Affected Versions: Apache Kvrocks versions through 2.11.1 Description: The issue is related to improper input validation in the SETRANGE command, which fails to check if the offset input is a positive integer. This can cause the server to crash due to an...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17607

Name of the Vulnerable Software and Affected Versions WordPress Simple Shopping Cart plugin versions up to and including 5.1.2 Description The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the produc...