PT-2025-27075 · Kingdee +1 · Kingdee Cloud-Starry-Sky Enterprise Edition +1

Name of the Vulnerable Software and Affected Versions: Kingdee Cloud-Starry-Sky Enterprise Edition versions 6.x through 9.0 Description: A critical issue has been found, affecting the function plugin.buildMobilePopHtml of the file k3o2oboswebappactionDynamicForm 4 Action.class of the component...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

PT-2025-27235 · Case Erp · Case Erp

Name of the Vulnerable Software and Affected Versions: Case ERP versions prior to V2.0.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. There is a critical SQL...

PT-2025-27081 · Unknown · Bzotheme Zenny

Name of the Vulnerable Software and Affected Versions: BZOTheme Zenny versions 1.7.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-27196 · Unknown · Morten Dalgaard Johansen Dashboard Widget Sidebar

Name of the Vulnerable Software and Affected Versions: Morten Dalgaard Johansen Dashboard Widget Sidebar versions 1.2.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels...

PT-2025-27051 · WordPress · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox WordPress plugin versions prior to 2.3.16 Description: The issue concerns the Firelight Lightbox WordPress plugin, which does not properly sanitise and escape title attributes before displaying them on the page. This could...

PT-2025-27221 · Unknown · Aioseo Multibyte Descriptions

Name of the Vulnerable Software and Affected Versions: Aioseo Multibyte Descriptions versions 0.0.0 through 0.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions...

PT-2025-27211 · Unknown · Plumwd Twitch Tv Embed Suite

Name of the Vulnerable Software and Affected Versions: plumwd Twitch TV Embed Suite versions n/a through 2.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the plumwd Twitch TV Embed Suite. Recommendations: For versions n/a through 2.1.0,...

PT-2025-27117 · Classiera · Classiera

Name of the Vulnerable Software and Affected Versions: Classiera versions through 4.0.34 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-27216 · WordPress · Wp Enhanced Free Downloads Edd

Name of the Vulnerable Software and Affected Versions: Wp Enhanced Free Downloads EDD versions 1.0.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2025-27046 · Unknown · Neacsafe64 Driver +1

Name of the Vulnerable Software and Affected Versions: NeacSafe64 Driver versions prior to 1.0.0.8 Description: The issue allows attackers to escalate privileges by sending crafted IOCTL commands to the NeacSafe64.sys component. Recommendations: For versions prior to 1.0.0.8, update to version...

GHSA-9R64-3WMC-X8M8 Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper enforcement of resource limits in the nftables rules generation process for managed bridge networks. An attacker can exhaust the DHCP pool and disrupt network...

CVE-2025-52904 File Browser: Command Execution not Limited to Scope

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

MAL-2025-5284 Malicious code in meuhq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a603acb3997e3395851edc9bc2cb0812dff4a2eb9a5f0bf87aa6b5bc229a0097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-26947 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Ultra Addons for Contact Form 7 plugin for WordPress versions 3.5.11 through 3.5.19 Description: The issue is related to Stored Cross-Site Scripting via the Database module due to insufficient input sanitization and output escaping. The...

PT-2025-26923 · WordPress · Responsive Food/Drink Menu

Name of the Vulnerable Software and Affected Versions: The Responsive Food and Drink Menu plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's display pdf menus shortcode due to insufficient input sanitization an...

PT-2025-26978

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.7 Description: The Markdown preview function of File Browser is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the...