PT-2025-17733 · Trpc · Trpc

Name of the Vulnerable Software and Affected Versions: tRPC versions 11.0.0 through 11.1.0 Description: The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocke...

PT-2025-17781 · John Weissberg · John Weissberg Print Science Designer

Name of the Vulnerable Software and Affected Versions: John Weissberg Print Science Designer versions 1.3.155 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in John Weissberg Print Science Designer. Recommendations: For versions 1.3.15...

PT-2025-17792 · Unknown · Metaloha Dropdown Content

Name of the Vulnerable Software and Affected Versions: metaloha Dropdown Content versions n/a through 1.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in metaloha Dropdown Content...

PT-2025-17791 · WordPress · Wp Customize Login Page

Name of the Vulnerable Software and Affected Versions: WP Customize Login Page versions 1.6.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17716

Name of the Vulnerable Software and Affected Versions Flynax Bridge plugin for WordPress versions up to and including 2.2.0 Description The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover. This issue arises because the plugin does not properly validat...

PT-2025-17874 · Allegra +1 · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this issue. The flaw exists within the implementatio...

PT-2025-17762

Name of the Vulnerable Software and Affected Versions Seriously Simple Podcasting versions prior to 3.9.0 Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means an attacker can inject malicious...

PT-2025-17681 · Westermo · Weos

Name of the Vulnerable Software and Affected Versions: Westermo WeOS versions 5 through 5.23.0 Description: The issue allows for a reboot via a malformed ESP packet. Recommendations: For Westermo WeOS versions 5 through 5.23.0, update to a version later than 5.23.0 to resolve the issue...

PT-2025-17673 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after logout. Recommendations: For IBM InfoSphere Information...

PT-2025-17638 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version V15.03.05.14 multi Description: The issue is a stack overflow vulnerability in the "/goform/WifiWpsStart" API endpoint, which may lead to remote arbitrary code execution. Recommendations: For Tenda ac9 version V15.03.05.14...

PT-2025-17643 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.6-milestone-1 through 15.10.16 XWiki versions prior to 16.4.6 XWiki versions prior to 16.10.1 Description: The issue allows a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection t...

PT-2025-17607 · WordPress · Wordpress Simple Shopping Cart

Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to and including 5.1.2 Description: The issue is related to a logic flaw in the plugin's cart addition process, specifically due to the inconsistent use of parameters. The plugin uses the...

PT-2025-17646 · Totolink · Totolink A800R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5032 B20200408 Description: The issue concerns a Command Injection vulnerability in the downloadFile.cgi file via the QUERY STRING parameter. This allows for potential exploitation. There is a high risk of...

PT-2025-17677 · Nih · Nih Brics

Name of the Vulnerable Software and Affected Versions: NIH BRICS aka Biomedical Research Informatics Computing System versions 14.0.0-67 and earlier Description: The issue allows users without the InET role to access the InET module by making direct requests to known endpoints. Recommendations: F...

PT-2025-17668 · Byd · Byd Qin Plus Dm-I Dilink Os

Name of the Vulnerable Software and Affected Versions: BYD QIN PLUS DM-i Dilink OS versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0 Description: The issue allows attackers to execute a man-in-the-middle attack because the affected software sends broadcasts to the manufacturer's clou...

PT-2025-17637 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda ac9 version 1.0 with firmware V15.03.05.14 multi Description: The issue is related to a stack overflow vulnerability in the rebootTime parameter of the "/goform/SetSysAutoRebbotCfg" API endpoint. This vulnerability can lead to remote...

CVE-2025-32965 Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

CVE-2025-26413 Apache Kvrocks: The server was crashed by the negative offset

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the offset input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. User...

PT-2025-17486

Name of the Vulnerable Software and Affected Versions Front End Users WordPress plugin versions 3.2.32 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where the Front End Users WordPress plugin does not properly sanitise and escape a parameter before...

PT-2025-17516 · Unknown · Kofimokome Message Filter For Contact Form 7

Name of the Vulnerable Software and Affected Versions: kofimokome Message Filter for Contact Form 7 versions 1.6.3.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...