PT-2025-30190 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat versions 4.60 and 4.61 Description: A stored cross-site scripting XSS issue exists in the Personal Canned Messages feature. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload...

PT-2025-30166

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A critical issue exists in thinkgem JeeSite that allows for unrestricted file uploads. The Upload function within the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java ...

PT-2025-30207 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A cross-site scripting issue exists due to the addSave function within the com/ruoyi/web/controller/system/SysNoticeController.java file. This allows for remote attacks. The exploit detail...

PT-2025-30204 · Unknown · Moneyprinterturbo

Name of the Vulnerable Software and Affected Versions: harry0703 MoneyPrinterTurbo versions through 1.2.6 Description: A critical issue exists in the verify token function within the app/controllers/base.py file of the API Endpoint component. This allows for missing authentication and may be...

PT-2025-30168 · Portabilis · I-Educar 2.9.0

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic issue exists due to cross site scripting. The manipulation of the argument Deficiência ou Transtorno within the file /intranet/educar deficiencia lst.php of the Disabilities Module...

PT-2025-30202 · Harry0703 · Moneyprinterturbo

Name of the Vulnerable Software and Affected Versions: harry0703 MoneyPrinterTurbo versions through 1.2.6 Description: A critical issue exists in harry0703 MoneyPrinterTurbo. The upload bgm file function within the File Extension Handler component, located in the app/controllers/v1/video.py file,...

PT-2025-30414 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue exists in the httpd component of Tenda AC7. The vulnerability is due to a stack-based buffer overflow in the formSetMacFilterCfg function within the /goform/setMacFilterCfg file. The...

PT-2025-30126 · WordPress · Simple Backup

Name of the Vulnerable Software and Affected Versions: Simple Backup versions prior to 2.7.11 Description: The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download due to a lack of capability checks and file type validation in the download backup file function. This allows...

Azure Linux 3.0 Security Update: httpd (CVE-2024-42516)

The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42516 advisory. - HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the...

PT-2025-30156 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.20-dev Description: Pluck CMS contains a flaw that allows an authenticated attacker to upload or create a crafted PHP file within the albums module directory. This file can then be accessed through the module routing log...

PT-2025-30112 · WordPress · Partnerský Systém Martinus Plugin

Name of the Vulnerable Software and Affected Versions: Partnerský systém Martinus plugin for WordPress versions up to and including 1.7.1 Description: The Partnerský systém Martinus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s martinus shortcode...

PT-2025-30132

Name of the Vulnerable Software and Affected Versions Work The Flow File Upload plugin for WordPress versions up to and including 2.5.2 Description The Work The Flow File Upload plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the...

PT-2025-30109 · WordPress · Epay.Bg Payments

Name of the Vulnerable Software and Affected Versions: EPay.bg Payments plugin for WordPress versions up to and including 0.1 Description: The EPay.bg Payments plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s epay shortcode. Insufficient input sanitization a...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

Predictable Value Range from Previous Values

Overview Affected versions of this package are vulnerable to Predictable Value Range from Previous Values via the boundary value, which uses Math.random. An attacker can manipulate HTTP request boundaries by exploiting predictable values, potentially leading to HTTP parameter pollution. Remediati...

PT-2025-30047 · Xuxueli · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in Xuxueli xxl-job. The commandJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to OS command injection. This...

PT-2025-30044 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: xxl-job versions up to 3.1.1 Description: A critical issue exists in xxl-job. The httpJobHandler function within the srcmainjavacomxxljobexecutorservicejobhandlerSampleXxlJob.java file is susceptible to server-side request forgery SSRF. This...

PT-2025-29995 · WordPress · The Useful Tab Block – Responsive & Amp-Compatible

Name of the Vulnerable Software and Affected Versions: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress versions prior to 1.3.3 Description: The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is susceptible to Stored Cross-Site Scripting through the...

PT-2025-43676

Name of the Vulnerable Software and Affected Versions Wasmtime versions 38.0.0 through 38.0.2 Description Wasmtime is a runtime for WebAssembly. Versions from 38.0.0 through 38.0.2 contain a flaw in the implementation of component-model related host-to-wasm trampolines. Specifically, a carefully...

PT-2025-30019 · WordPress · Loginpress Pro

Name of the Vulnerable Software and Affected Versions: LoginPress Pro versions prior to 5.0.1 Description: The LoginPress Pro plugin for WordPress is susceptible to authentication bypass in all versions up to and including 5.0.1. This issue stems from inadequate verification of the user returned ...