PT-2025-21031 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A buffer overflow issue was discovered via the dnsaddr parameter in the "formDhcpv6s" interface. Recommendations: For TOTOLINK A3002R version 4.0.0-B20230531.1404, avoid using the...

PT-2025-22307 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the theauthName parameter in the web aaa loginAuthlistEdit function. Recommendations: For FW-WGS-804HPT version 1.305b241111, consider disabling the web...

PT-2025-17309 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue allows an authenticated attacker to perform a UI-based denial of service DoS by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This is...

PT-2025-17325 · Nautel · Nautel Vx Series

Name of the Vulnerable Software and Affected Versions: Nautel VX Series transmitters VX SW versions 6.4.0 and below Description: The issue is related to a remote code execution RCE vulnerability in the firmware update process. This allows attackers to execute arbitrary code by supplying a crafted...

PT-2025-17261 · Unknown · Baseweb Jsite

Name of the Vulnerable Software and Affected Versions: baseweb JSite version 1.0 Description: A vulnerability was found in the file /a/sys/user/save, where the manipulation of the Name argument leads to cross-site scripting. The attack can be launched remotely. Recommendations: For baseweb JSite...

PT-2025-17323 · Bw Broadcast · Tx1000 +5

Name of the Vulnerable Software and Affected Versions: BW Broadcast TX600 versions 1.6.0 BW Broadcast TX300 versions 1.6.0 BW Broadcast TX150 versions 1.6.0 BW Broadcast TX1000 versions 1.6.0 BW Broadcast TX30 versions 1.6.0 BW Broadcast TX50 versions 1.6.0 Description: The issue is related to...

PT-2025-17259 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions prior to 2.94.10 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-17347

Name of the Vulnerable Software and Affected Versions PHPGurukul Men Salon Management System version 1.0 Description A critical issue has been discovered, affecting an unknown part of the file /admin/contact-us.php. The manipulation of the arguments pagetitle, pagedes, email, mobnumber, and timin...

PT-2025-17341 · Macro Video Technologies Co. · V380E6 C1 Ip Camera

Name of the Vulnerable Software and Affected Versions: Macro-video Technologies Co.,Ltd V380E6 C1 IP camera version 1020302 Description: An issue in the V380E6 C1 IP camera allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mnt/mtd/mvconf/user...

PT-2025-17295 · 74Cms · 74Cms

Name of the Vulnerable Software and Affected Versions: 74cms versions 3.33 and earlier Description: The issue concerns remote code execution RCE in the background interface apiadmin. Recommendations: For versions 3.33 and earlier, update to a version later than 3.33 to resolve the issue. As a...

PT-2025-17317 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A security issue was identified in Dify, an open-source LLM app development platform, where normal users are improperly granted permissions to edit app names, descriptions, and icons. This access...

PT-2025-17328

Name of the Vulnerable Software and Affected Versions DAEnetIP4 METO version 1.25 Description The issue is related to improper session management in the "/login ok.htm" endpoint, which allows attackers to execute a session hijacking attack. Recommendations For DAEnetIP4 METO version 1.25, conside...

PT-2025-17336 · Nessus · Nessus

Name of the Vulnerable Software and Affected Versions: Nessus versions prior to 10.8.4 Description: A non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application. Recommendations: For versions prior to 10.8.4, update to version 10.8.4 or later to...

PT-2025-17251 · WordPress · Avatar

Name of the Vulnerable Software and Affected Versions: Avatar plugin for WordPress versions up to, and including, 0.1.4 Description: The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function. This makes it possible for...

PT-2025-17305 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: The issue concerns an unauthorized arbitrary command execution in the enable parameter of the sub 41105C function of cstecgi.cgi. Recommendations: For TOTOLINK X18 version 9.1.0cu.2024...

PT-2025-17318 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A vulnerability was identified in Dify, an open-source LLM app development platform, where normal users can enable or disable apps through the API, despite not being permitted to make such changes...

PT-2025-17254 · Thimpress · Thimpress Ivy School

Name of the Vulnerable Software and Affected Versions: ThimPress Ivy School versions 1.6.0 and earlier Description: The issue is related to a Path Traversal vulnerability, specifically a '.../...//' vulnerability, which allows PHP Local File Inclusion in ThimPress Ivy School. Recommendations: For...

PT-2025-17337 · Seclore · Seclore

Name of the Vulnerable Software and Affected Versions: Seclore version 3.27.5.0 Description: An issue in the login page of Seclore allows attackers to bypass authentication via a brute force attack. Recommendations: For version 3.27.5.0, consider temporarily restricting access to the login page...

PT-2025-17320 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: Alkacon OpenCMS version 17.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function...

PT-2025-17333

Name of the Vulnerable Software and Affected Versions NodeBB versions prior to 4.0.5 Description A Cross-Site Scripting XSS issue allows remote attackers to store arbitrary code, potentially rendering the blacklist IP functionality unusable until the content is removed via the database...