PT-2025-17477 · Unknown · Codecanyon Rise Ultimate Project Manager

Name of the Vulnerable Software and Affected Versions: CodeCanyon RISE Ultimate Project Manager version 3.8.2 Description: A problem was found in the file /index.php/team members/save profile image/ of the component Profile Picture Handler. The manipulation of the argument profile image file lead...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17515 · Unknown · Vikrestaurants Table Reservations/Take-Away

Name of the Vulnerable Software and Affected Versions: VikRestaurants Table Reservations and Take-Away versions 1.3.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.3.3 and earlier,...

PT-2025-17565 · Unknown · Sacco Management System

Name of the Vulnerable Software and Affected Versions: Sacco Management system version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the password parameter at the "/sacco/ajax.php" API endpoint. Recommendations: For Sacco Management system version...

PT-2025-17627

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.1-44 Description The issue concerns the mishandling of image depth in MIFF image processing after the use of SetQuantumFormat. Recommendations For versions prior to 7.1.1-44, update to version 7.1.1-44 or late...

PT-2025-17561 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1 1 parameter. This enables attackers to potentially manipulate w...

PT-2025-17564 · Unknown · Student Management System

Name of the Vulnerable Software and Affected Versions: Student Management System version 1.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter on the "profile.php" page...

PT-2025-17557 · Open5Gs · Open5Gs Upf

Name of the Vulnerable Software and Affected Versions: Open5GS UPF versions up to v2.7.2 Description: The issue results in an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Session Establishment Request with PDN Type = 0, the UPF fails to handle the...

PT-2025-17505 · Unknown · Jeff Starr Simple Download Counter

Name of the Vulnerable Software and Affected Versions: Jeff Starr Simple Download Counter versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-17550 · Nvidia · Nvidia Nemo Framework

Name of the Vulnerable Software and Affected Versions: NVIDIA NeMo Framework affected versions not specified Description: The issue is related to improper control of code generation, which could be exploited through remote code execution. A successful exploit might lead to code execution and data...

PT-2025-17539 · Nextu · Nextu Fleta Ax1500 Wifi6 Router

Name of the Vulnerable Software and Affected Versions: NEXTU FLETA AX1500 WIFI6 Router version 1.0.3 Description: A stack overflow vulnerability was discovered, allowing attackers to cause a Denial of Service DoS via a crafted POST request. The issue is related to the url parameter at the...

PT-2025-17597 · Git +1 · 3X-Ui

Name of the Vulnerable Software and Affected Versions: 3X-UI versions prior to 2.5.3 Description: The issue allows a remote attacker to execute arbitrary code via the management script. This is possible because the x-ui passes the no check certificate option to wget when downloading updates, whic...

PT-2025-17508 · Woocommerce · Abandoned Cart Recovery For Woocommerce

Name of the Vulnerable Software and Affected Versions: Recover abandoned cart for WooCommerce versions n/a through 2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing...

PT-2025-17569 · Totolink · Totolink A830R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A830R version 4.1.2cu.5182 B20201102 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

PT-2025-17489 · Apache · Apache Kvrocks

Name of the Vulnerable Software and Affected Versions: Apache Kvrocks versions through 2.11.1 Description: The issue is related to improper input validation in the SETRANGE command, which fails to check if the offset input is a positive integer. This can cause the server to crash due to an...

PT-2025-17488 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership WordPress plugin version 4.1.2 and earlier Description: The issue concerns the User Registration & Membership WordPress plugin, where data in an AJAX action is not properly validated when the Membership Addon is...

PT-2025-17514 · Vform · Vform

Name of the Vulnerable Software and Affected Versions: VForm versions 3.1.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-17554 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: The issue concerns a hardcoded password for the telnet service, which is stored in the product.ini file. Recommendations: For version 4.1.2cu.5182 B20201026, consider changing the...

PT-2025-17577 · Cuba Jpa · Cuba Jpa

Name of the Vulnerable Software and Affected Versions: Cuba JPA versions prior to 1.1.1 Description: The Cuba JPA web API allows loading and saving entities defined in the application data model through simple HTTP requests. Prior to version 1.1.1, the input parameter, which includes a file path...

PT-2025-17492 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Post in page for Elementor versions 1.0.1 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows for DOM-Based XSS in Post in page for...