PT-2025-16083 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...

PT-2025-16080 · Unknown · Miunosoft Task Scheduler

Name of the Vulnerable Software and Affected Versions: miunosoft Task Scheduler versions 1.6.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables potential attackers to...

PT-2025-16145 · Unknown · Oz Forensics

Name of the Vulnerable Software and Affected Versions: Oz Forensics face recognition application versions prior to 4.0.8 Description: The issue allows PII retrieval via /statistic/list Insecure Direct Object Reference. Recommendations: For versions prior to 4.0.8, consider disabling access to the...

PT-2025-16094 · Unknown · Notfound Testimonial Slider/Showcase Pro

Name of the Vulnerable Software and Affected Versions: NotFound Testimonial Slider And Showcase Pro versions 2.3.15 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows P...

PT-2025-16044 · WordPress · Wp Food Ordering/Restaurant Menu

Name of the Vulnerable Software and Affected Versions: WP Food ordering and Restaurant Menu versions 1.1 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local...

PT-2025-16144 · Mediawiki · Mediawiki Mobilefrontend Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Mobile Frontend Extension versions 1.39 through 1.43 Description: The issue affects the Mediawiki - Mobile Frontend Extension, allowing exposure of sensitive information to an unauthorized actor. This enables shared resource...

PT-2025-16096 · Unknown · John Weissberg Print Science Designer

Name of the Vulnerable Software and Affected Versions: John Weissberg Print Science Designer versions 1.3.155 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows for Path Traversal, which can...

PT-2025-16097 · Unknown · G5Theme Ultimate Bootstrap Elements For Elementor

Name of the Vulnerable Software and Affected Versions: g5theme Ultimate Bootstrap Elements for Elementor versions 1.4.9 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allo...

PT-2025-16076 · Woocommerce · Aba Payway Payment Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: ABA PayWay Payment Gateway for WooCommerce versions prior to 2.1.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables an attacker...

PT-2025-16059 · Vimeo & Youtube · Workbox Video

Name of the Vulnerable Software and Affected Versions: Workbox Video from Vimeo & Youtube versions 3.2.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to...

PT-2025-16041 · WordPress · Mailhawk

Name of the Vulnerable Software and Affected Versions: Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk versions 1.3.1 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File...

PT-2025-16115 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress versions up to 3.1.1 Description: The issue arises from the software's failure to properly validate a value before executing do shortcode, allowin...

PT-2025-16084 · WordPress · Wpbookingly

Name of the Vulnerable Software and Affected Versions: WpBookingly versions 1.2.0 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection in WpBookingly. Recommendations: For versions 1.2.0 and earlier, update to a version that contain...

PT-2025-16026

Name of the Vulnerable Software and Affected Versions: ch-go library versions prior to 0.65.0 Description: The issue arises when the ch-go library is used under a specific condition where the query includes large, uncompressed malicious external data. This allows an attacker in control of such da...

Improper Preservation of Permissions

Overview mediawiki/core is a Free software wiki application developed by the Wikimedia Foundation and others. Note: This package is not maintained on Packagist anymore, but newer releases exist. Affected versions of this package are vulnerable to Improper Preservation of Permissions due to improp...

CVE-2025-32391 HedgeDoc allows XSS possibility through malicious SVG uploads

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub...

PT-2025-15937 · Brizy · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy versions n/a through 2.6.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for the injection of malicious scripts into web pages. No...

PT-2025-15960 · Detheme · Dethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor versions n/d through 2.1.10 Description: The issue is related to a lack of authorization in Detheme DethemeKit for Elementor. This problem affects DethemeKit for Elementor from an unspecified start version up to versi...

PT-2025-15957 · Toast Plugins · Toast Plugins Internal Link Optimiser

Name of the Vulnerable Software and Affected Versions: Toast Plugins Internal Link Optimiser versions 5.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser, which allows exploiting incorrectly configured access contro...

PT-2025-16889 · Tp Link · Tp-Link M7000

Name of the Vulnerable Software and Affected Versions: TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection vulnerability exists in the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject...