PT-2025-24606 · Woocommerce · Abandoned Cart Pro For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Pro for WooCommerce versions up to, and including, 9.16.0 Description: The issue is related to an authenticated arbitrary file upload due to missing file type validation in the wcap add to cart popup upload files function. This...

PT-2025-24991 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: A stored Cross-Site Scripting XSS issue affects the software, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses ...

PT-2025-30684 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.22 and earlier Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS issue. A low privileged attacker can inject malicious scripts into...

CVE-2025-5895 Metabase dom.js parseDataUri redos

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit...

CVE-2025-5895 Metabase dom.js parseDataUri redos

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit...

AZL-63747 CVE-2024-47081 affecting package python-requests for versions less than 2.31.0-3

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

CVE-2025-49136

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary The env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on the host. While this may not be a problem on single-user super admin installations, on multi-user installations, this allows non-super-admin users with campaign or template...

PT-2025-24523 · Thimpress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes versions n/a through 1.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThimPress WP Pipes...

PT-2025-24428 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to an incorrect authorization vulnerability. This vulnerability allows an attacker with a low privilege level to change the password of other users through a POST request using the...

PT-2025-24504 · Unknown · Moreconvert Mc Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: moreconvert MC Woocommerce Wishlist versions 1.9.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potentia...

PT-2025-24529 · Unknown · Unfoldwp Blogmine

Name of the Vulnerable Software and Affected Versions: Unfoldwp Blogmine versions 1.1.7 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24463 · Woocommerce · Ticketbai Facturas Para Woocommerce

Name of the Vulnerable Software and Affected Versions: TicketBAI Facturas para WooCommerce versions 3.19 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-24483 · Unknown · Pimp - Creative Multipurpose

Name of the Vulnerable Software and Affected Versions: PIMP - Creative MultiPurpose versions 1.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.7 and earlier, update to a version that contains a fi...

PT-2025-24541 · Unknown · Keeperchat

Name of the Vulnerable Software and Affected Versions: KeeperChat IOS Application version 5.8.8 Description: An issue in the KeeperChat IOS Application allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module. Recommendations: For KeeperChat IOS...

PT-2025-24402 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.5 Description: The issue concerns a lack of validation and escaping of certain Widget options in the plugin, which can lead to Stored Cross-Site Scripting attacks. This can be exploited by...

PT-2025-24475 · Elfsight · Elfsight Contact Form Widget

Name of the Vulnerable Software and Affected Versions: elfsight Contact Form widget versions n/a through 2.3.1 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For versions...

PT-2025-24433 · Unknown · Feng Office

Name of the Vulnerable Software and Affected Versions: Fengoffice Feng Office version 3.2.2.1 Description: A problematic issue has been found in the Document Upload Handler component, specifically affecting some unknown functionality of the file /application/models/ApplicationDataObject.class.php...

PT-2025-24566 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.3 Description: The gitImportSite functionality in HAX CMS PHP obtains a URL string from a POST request and insufficiently validates user input. The set remote function later passes this input into proc open,...