PT-2025-24492 · Fantasticplugins · Sumo Affiliates Pro

Name of the Vulnerable Software and Affected Versions: FantasticPlugins SUMO Affiliates Pro versions n/a through 10.7.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 10.7.0,...

PT-2025-24429 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to incorrect authorization, allowing an unprivileged attacker to modify user permissions by sending a POST request to "/PC/Options.aspx?Command=2&Page=-1". This enables the attacker to...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

PT-2025-24510 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions n/a through 2.12.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-24511 · Woocommerce · Holest Engineering Spreadsheet Price Changer

Name of the Vulnerable Software and Affected Versions: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions n/a through 2.4.37 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in ...

PT-2025-24521 · Unknown · Cryptocloud - Crypto Payment Gateway

Name of the Vulnerable Software and Affected Versions: CryptoCloud - Crypto Payment Gateway versions n/a through 2.1.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-24526 · Sprig +1 · Sprig +1

Name of the Vulnerable Software and Affected Versions: Listmonk versions 4.0.0 through 5.0.2 Description: Listmonk is a standalone, self-hosted, newsletter and mailing list manager. The env and expandenv template functions, enabled by default in Sprig, allow capturing of environment variables on...

PT-2025-24560 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido versions prior to 0.48.0 Description: Caido is a web security auditing toolkit that lacks protection for DNS rebinding, allowing it to be loaded on an attacker-controlled domain. This enables a malicious website to hijack the...

PT-2025-24567 · Vue.Js · Vue-Cli

Name of the Vulnerable Software and Affected Versions: vuejs vue-cli versions up to 5.0.8 Description: A vulnerability was found in the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficien...

PT-2025-24574 · Cyberdata · Cyberdata 011209 Intercom

Name of the Vulnerable Software and Affected Versions: CyberData 011209 Intercom affected versions not specified Description: The issue concerns the improper storage or protection of web server admin credentials. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-24539 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions up to 2.5.7 Description: A vulnerability was found in Emlog, affecting some unknown processing of the file /admin/article.php. The manipulation of the active post argument leads to cross-site scripting. The attack may be...

PT-2025-24405

Name of the Vulnerable Software and Affected Versions Broadstreet WordPress plugin versions prior to 1.51.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...

PT-2025-24485 · Unknown · Lambertgroup Sticky Radio Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky Radio Player versions n/a through 3.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-24360 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through getting permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-24361 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through the get permission. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. ...

PT-2025-24366 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp...

PT-2025-25572 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5232 B20210713 Description: A critical issue has been found in the HTTP POST Request Handler component, affecting the processing of the file /boafrm/formStats. This leads to a buffer overflow. The attack can b...

PT-2025-24346 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.02.13 Description: A critical vulnerability has been found in the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer...

PT-2025-24578 · Totolink · Totolink T10

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 version 4.1.8cu.5207 Description: A critical issue has been found in the TOTOLINK T10, affecting the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argumen...

PT-2025-24338 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 6.1.12 Description: The issue is related to Stored Cross-Site Scripting via the eael pricing item tooltip content parameter of the Pricing Table Widget. Th...