PT-2025-19911 · WordPress · Peprodev Ultimate Profile Solutions

Name of the Vulnerable Software and Affected Versions: PeproDev Ultimate Profile Solutions plugin for WordPress versions 1.9.1 through 7.5.2 Description: The issue allows unauthorized modification of data due to a missing capability check on the handel ajax req function. This enables...

Do Not Install the HTTP Service

HyperText Transfer Protocol HTTP is a simple request-response protocol and usually runs over TCP. It specifies what messages the client may send to the server and what responses the client receives. Request and response messages include headers in ASCII, and the message content often uses a...

PT-2025-20089 · Unknown · Crm Perks Integration For Woocommerce/Salesforce

Name of the Vulnerable Software and Affected Versions: CRM Perks Integration for WooCommerce and Salesforce versions 1.7.5 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which can be used for Phishing attacks...

PT-2025-20034 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions prior to 1.4.3 Description: The issue is related to a Cross-Site Request Forgery CSRF problem. This allows for Cross-Site Request Forgery. Recommendations: For versions prior to 1.4.3, update to version 1.4.3 or later to...

PT-2025-20163 · Unknown · Themefic Instantio

Name of the Vulnerable Software and Affected Versions: Themefic Instantio versions n/a through 3.3.16 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-20317

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.20 Django versions 5.1 through 5.1.8 Django versions 5.2 through 5.2.0 Description An issue was discovered in Django, where the django.utils.html.strip tags function is vulnerable to a potential denial-of-servic...

PT-2025-19953 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.06 Description: A critical vulnerability was found in the Tenda AC8 router. The issue affects the formGetRouterStatus function of the file /goform/MtuSetMacWan. The manipulation of the shareSpeed argument leads to a...

PT-2025-19952

Name of the Vulnerable Software and Affected Versions Gym Management System version 1.0 Description A critical issue has been found in the Gym Management System, affecting the processing of the file "/ajax.php?action=end membership". The manipulation of the rid argument leads to SQL injection. Th...

PT-2025-19917 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject SQL statements, enabling them to obtain, update, and delete all information in the database. The vulnerability is specifically found in the User...

PT-2025-19987 · Libxmp +1 · Libxmp +1

Name of the Vulnerable Software and Affected Versions: Libxmp versions 4.6.2 and earlier Description: The issue is a stack-based buffer overflow in the depack pha function in loaders/prowizard/pha.c, which occurs when processing a malformed Pha format tracker module in a .mod file. Recommendation...

PT-2025-19835 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin for WordPress versions up to and including 1.6 Description: The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the aha plugin page function. This allows unauthenticated...

PT-2025-19830 · Unknown · Itsourcecode Content Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Content Management System version 1.0 Description: A critical issue was discovered in the itsourcecode Content Management System, affecting the /admin/update main topic img.php file. The manipulation of the topic id argument lead...

PT-2025-19969 · Auth0 · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions 3.0.5 through 4.6.3 Description: A vulnerability in passport-wsfed-saml2 allows an attacker to impersonate any user in the Auth0 tenant during SAML authentication by crafting a SAMLResponse. This can be done by...

PT-2025-19986 · Phpgt/Dom · Phpgt/Dom

Name of the Vulnerable Software and Affected Versions: phpgt/Dom versions prior to 4.1.8 Description: The issue exposes the GITHUB TOKEN in the Dom workflow run artifact. This occurs because the ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact, which is a zip of t...

PT-2025-19932 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical issue has been found in the function formEasySetupWizard3, where the manipulation of the host argument leads to a buffer overflow. This issue can be exploited remotely. It affects...

PT-2025-19836 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A problematic issue has been found in the Edit Article Page component. The manipulation of the Title argument leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed ...

PT-2025-19995

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 6.0.0 through 6.1.6 Apache ActiveMQ versions 5.18.0 through 5.18.7 Apache ActiveMQ versions 5.17.0 through 5.17.7 Apache ActiveMQ versions prior to 5.16.8 Description The issue is related to a Memory Allocation with...

PT-2025-19965 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was discovered in the runtime.ddnsStatus DynDNS function via the hostname parameter. This allows for potential exploitation. Recommendations: For Linksys E5600 version...

PT-2025-19921 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM version 11 Description: This issue allows an unauthenticated attacker to upload any file within the server, including malicious files, to obtain Remote Code Execution RCE. Recommendations: For TCMAN GIM version 11, consider disablin...

PT-2025-19939 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical vulnerability has been found in the D-Link DIR-600L, affecting the formSysCmd function. The manipulation of the host argument leads to command injection. This issue can be exploit...