PT-2025-24431 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.4.4 Discourse version 3.5.0.beta5 and earlier of the beta branch Discourse version 3.5.0.beta6-dev and earlier of the tests-passed branch Description: Discourse is an open-source discussion platform. Sending a...

PT-2025-24572 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP version 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb Description: A critical issue was found in the parse variables option function of the file utilities/pspp-convert.c. This issue leads to the freeing of memory not on the heap. An attac...

PT-2025-24538

Name of the Vulnerable Software and Affected Versions Mikado-Themes Grill and Chow versions 1.6 and earlier Description The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability affects Mikado-Themes Grill and Chow, enabling potential access to sensitive...

PT-2025-24468 · Bzotheme · Bzotheme Giftxtore

Name of the Vulnerable Software and Affected Versions: BZOTheme GiftXtore versions 1.7.4 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24535 · Unknown · Unfoldwp Magze

Name of the Vulnerable Software and Affected Versions: Unfoldwp Magze versions 1.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local File...

PT-2025-24472 · Miniorange · Miniorange Password Policy Manager

Name of the Vulnerable Software and Affected Versions: miniOrange Password Policy Manager versions 2.0.4 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing Authentication Abuse. Recommendations: For miniOrange Password Policy...

PT-2025-24476 · Apptha · Apptha Slider Gallery

Name of the Vulnerable Software and Affected Versions: Apptha Slider Gallery versions n/a through 2.5 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the Apptha Slider Gallery...

PT-2025-24519 · Unknown · Alex Zaytseff Multi Cryptocurrency Payments

Name of the Vulnerable Software and Affected Versions: Alex Zaytseff Multi CryptoCurrency Payments versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injectio...

PT-2025-24481 · Redqteam · Wishlist

Name of the Vulnerable Software and Affected Versions: redqteam Wishlist versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-24470 · Unknown · Valen - Sport

Name of the Vulnerable Software and Affected Versions: Valen - Sport, Fashion WooCommerce WordPress Theme versions n/a through 2.4 Description: The issue affects the Valen - Sport, Fashion WooCommerce WordPress Theme, allowing for PHP Local File Inclusion due to improper control of filename for...

PT-2025-24533 · Unknown · Unfoldwp Magty

Name of the Vulnerable Software and Affected Versions: Unfoldwp Magty versions 1.0.0 through 1.0.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24565 · Pion · Pion Interceptor

Name of the Vulnerable Software and Affected Versions: Pion Interceptor versions v0.1.36 through v0.1.38 Description: Pion Interceptor is a framework for building RTP/RTCP communication software. The issue is caused by a bug in the RTP packet factory, which can be exploited by crafted RTP packets...

PT-2025-24465 · Bzotheme · Bzotheme Craftxtore

Name of the Vulnerable Software and Affected Versions: BZOTheme CraftXtore versions n/a through 1.7 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24520 · Unknown · Formulario De Contacto Salesup!

Name of the Vulnerable Software and Affected Versions: Formulario de contacto SalesUp! versions 1.0.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2025-24564 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the...

PT-2025-24473 · Payu · Payu India

Name of the Vulnerable Software and Affected Versions: PayU India versions through 3.8.5 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing authentication abuse. Recommendations: For versions through 3.8.5, update to a version later than 3.8...

PT-2025-24562 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...

PT-2025-24522 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX versions through 4.2.22 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions through 4.2.22, update to a version later...

PT-2025-24558 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase version 54.10 Description: A problematic issue was found in the function parseDataUri of the file frontend/src/metabase/lib/dom.js. This issue leads to inefficient regular expression complexity and can be initiated remotely...