PT-2025-23375 · WordPress · Proforti

Name of the Vulnerable Software and Affected Versions: Proforti plugin for WordPress versions 2.0.6.0 through 2.1.1.3 Description: The issue is related to a missing capability check on the "stocktend object" endpoint. This allows unauthenticated attackers to trigger the save object as user functi...

PT-2025-23380 · WordPress · The Borderless – Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Borderless – Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing...

PT-2025-23400 · WordPress · The Newsletter Plugin

Name of the Vulnerable Software and Affected Versions: The Newsletters plugin for WordPress versions up to, and including, 4.9.9.9 Description: The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary files on the server via the file...

PT-2025-23407 · Unknown · Yifang Cms

Name of the Vulnerable Software and Affected Versions: Yifang CMS versions up to 2.0.2 Description: A vulnerability was found in the Article Management Module of Yifang CMS, where the manipulation of the Default Value argument leads to cross-site scripting. The attack may be launched remotely. Th...

PT-2025-23379 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1020 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

Trust Boundary Violation

Overview Affected versions of this package are vulnerable to Trust Boundary Violation due to the Browse method using URLs provided through API responses from authenticated GitHub hosts when users execute gh commands. An attacker in control of a malicious GitHub server can execute arbitrary comman...

CVE-2024-47056

SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2025-27789)

Summary IBM Security SOAR uses an older version of the babel runtime javascript module that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.6.0 Vulnerability Details CVEID:CVE-2025-27789...

CVE-2025-27522

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it. 1...

CVE-2020-36846

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a scrip...

PT-2025-23305 · Unknown · Service Process Engineer

Name of the Vulnerable Software and Affected Versions: Service Process Engineer versions 3DEXPERIENCE R2024x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS issue affects Service Items Management in Service Process Engineer, allowing an attacker to execute arbitrary...

PT-2025-23296 · Unknown · Vanquish Woocommerce Orders & Customers Exporter

Name of the Vulnerable Software and Affected Versions: Vanquish WooCommerce Orders & Customers Exporter versions n/a through 5.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions n/a...

PT-2025-23233 · Unknown · Tinxy Wifi Lock Controller

Name of the Vulnerable Software and Affected Versions: Tinxy WiFi Lock Controller version v1 RF Description: The issue concerns the transmission of sensitive information in plaintext, including control information and device credentials. This allows attackers to possibly intercept and access...

PT-2025-23295 · Dassault Systèmes · 3Dexperience

Name of the Vulnerable Software and Affected Versions: Collaborative Industry Innovator versions 3DEXPERIENCE R2023x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS vulnerability in the Compare feature allows an attacker to execute arbitrary script code in a user's...

PT-2025-23270

Name of the Vulnerable Software and Affected Versions: Airpointer version 2.4.107-2 Description: The issue concerns default credentials being present in the web portal, allowing an unauthenticated malicious actor to log in via the web portal. Recommendations: For Airpointer version 2.4.107-2,...

PT-2025-23298

Name of the Vulnerable Software and Affected Versions City Referential Manager versions 3DEXPERIENCE R2025x Description A stored Cross-site Scripting XSS issue affects City Discover within City Referential Manager. Exploitation allows an attacker to execute arbitrary script code within a user's...

PT-2025-23271 · Unknown · Airpointer

Name of the Vulnerable Software and Affected Versions: airpointer version 2.4.107-2 Description: The web portal on airpointer presented a local file inclusion issue. A malicious user with administrative privileges in the web portal could manipulate requests to view files on the filesystem...

PT-2025-23318 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue was found in the BYE Command Handler component, which can be exploited remotely. The manipulation leads to a buffer overflow. The issue has been publicly disclosed. Recommendation...

PT-2025-23278 · WordPress · Opensheetmusicdisplay

Name of the Vulnerable Software and Affected Versions: OpenSheetMusicDisplay plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the className parameter. This allo...

PT-2025-23297 · Unknown · 3Dexperience +1

Name of the Vulnerable Software and Affected Versions: City Referential Manager on Release 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS vulnerability in City Referential Manager allows an attacker to execute arbitrary script code in a user's browser session. This enables the...