PT-2025-22729 · Unknown · Yamna Khawaja Mailing Group Listserv

Name of the Vulnerable Software and Affected Versions: Yamna Khawaja Mailing Group Listserv versions n/a through 3.0.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-22677 · Ancorathemes · Ancorathemes Umberto

Name of the Vulnerable Software and Affected Versions: AncoraThemes Umberto versions 1.2.8 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.2.8 and earlier, update to a version that fixes this issue...

PT-2025-22736 · Unknown · Crossword Compiler

Name of the Vulnerable Software and Affected Versions: Crossword Compiler Puzzles versions 5.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2025-22772 · Unknown · Wc Affiliate

Name of the Vulnerable Software and Affected Versions: WC Affiliate versions n/a through 2.9.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This is a problem where an application deserializes data from an untrusted source, potentially...

PT-2025-22679 · Ancorathemes · Ancorathemes Fish House

Name of the Vulnerable Software and Affected Versions: AncoraThemes Fish House versions 1.2.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For AncoraThemes Fish House versions 1.2.7 and earlier, update to a...

PT-2025-22762 · Unknown · Mojoomla School Management

Name of the Vulnerable Software and Affected Versions: mojoomla School Management versions n/a through 92.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-22797 · Unknown · Freefloat Ftp Server

Name of the Vulnerable Software and Affected Versions: FreeFloat FTP Server version 1.0 Description: A critical issue was found in the MGET Command Handler component of FreeFloat FTP Server, leading to a buffer overflow. This can be exploited remotely. The issue has been publicly disclosed...

PT-2025-22775 · Unknown · Letscms Mlm

Name of the Vulnerable Software and Affected Versions: LETSCMS MLM Software Binary MLM Plan versions n/a through 3.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-22576 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch plugin for WordPress versions up to and including 4.6.1 Description: The issue is related to Stored Cross-Site Scripting via the 'trn-ladder-registration-button' shortcode. This is due to insufficient input sanitization and output...

PT-2025-22780 · Woocommerce · Storekeeper For Woocommerce

Name of the Vulnerable Software and Affected Versions: StoreKeeper for WooCommerce versions through 14.4.4 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-22706 · Boldthemes · Boldthemes Medicare

Name of the Vulnerable Software and Affected Versions: BoldThemes Medicare versions n/a through 2.1.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 2.1.0, update to a version later than 2.1.0 to...

PT-2025-22785 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal versions n/a through 2.3.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in WP Job Portal. Recommendations: Fo...

PT-2025-22665 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Medical Card Generation System version 1.0 Description: The issue concerns stored cross-site scripting XSS vulnerabilities in the /admin/card-bwdates-report.php component. Attackers can execute arbitrary web scripts or HTML by...

PT-2025-22724 · Unknown · Svil4Ok Meta Keywords & Description

Name of the Vulnerable Software and Affected Versions: svil4ok Meta Keywords & Description versions n/a through 0.8 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allo...

PT-2025-22812 · Schule · Schule

Name of the Vulnerable Software and Affected Versions: Schule versions prior to 1.0.1 Description: The issue concerns a lack of proper rate limiting controls in the file forgot password.php, which is responsible for email-based OTP generation. This allows attackers to abuse the OTP request...

PT-2025-22682 · WordPress · Wp Post Modules For Elementor

Name of the Vulnerable Software and Affected Versions: WP Post Modules for Elementor versions n/a through 2.5.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-22673 · Unknown · Apustheme Capie

Name of the Vulnerable Software and Affected Versions: ApusTheme Capie versions 1.0.0 through 1.0.40 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-22687 · Unknown · Simple Business Directory Pro

Name of the Vulnerable Software and Affected Versions: Simple Business Directory Pro versions through 15.4.8 Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in Simple Business Directory Pro. Recommendations: For versions...

PT-2025-22815 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.9 Description: The issue concerns the DNN formerly DotNetNuke open-source web content management platform, which is part of the Microsoft ecosystem. In affected versions, uploaded SVG files could...

PT-2025-22689 · Acerola · Acerola

Name of the Vulnerable Software and Affected Versions: Acerola versions 1.6.5 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.6.5 and earlier, update to a version that fixes the Deserialization of...