PT-2025-20064

Name of the Vulnerable Software and Affected Versions Android versions prior to 15 Description The issue is an out-of-bounds write in libsavscmn, which allows local attackers to execute arbitrary code. This can be exploited by local attackers. Recommendations For versions prior to Android 15,...

PT-2025-20163 · Unknown · Themefic Instantio

Name of the Vulnerable Software and Affected Versions: Themefic Instantio versions n/a through 3.3.16 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-20027 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: The issue allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet. This is due to an out-of-bounds write in the affected software...

PT-2025-20034 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions prior to 1.4.3 Description: The issue is related to a Cross-Site Request Forgery CSRF problem. This allows for Cross-Site Request Forgery. Recommendations: For versions prior to 1.4.3, update to version 1.4.3 or later to...

PT-2025-20051 · Samsung · Samsung Gallery

Name of the Vulnerable Software and Affected Versions: Samsung Gallery versions prior to 14.5.10.3 in Global Android 13 Samsung Gallery version 14.5.09.3 in China Android 13 Samsung Gallery version 15.5.04.5 in Android 14 Description: The issue is related to improper access control in Samsung...

PT-2025-20297 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.34.1 Envoy versions prior to 1.33.3 Envoy versions prior to 1.32.6 Envoy versions prior to 1.31.8 Description: The issue arises from Envoy's URI template matcher incorrectly excluding the character from a set of vali...

Do Not Enable the DHCP Service

The Dynamic Host Configuration Protocol DHCP service provides dynamic allocation of IP addresses to machines. Unless a system is the designated DHCP server, you are advised to disable its DHCP service to reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions...

Do Not Enable the NFS Service

The Network File System NFS is one of the earliest and most widely used file systems in UNIX environments. It allows a system to mount file systems of other servers over the network. If the system does not share content through NFS, you are advised to disable NFS to reduce the remote attack...

PT-2025-20017 · WordPress · Login Lockdown & Protection

Name of the Vulnerable Software and Affected Versions: Login Lockdown & Protection plugin for WordPress versions up to, and including, 2.11 Description: The issue is related to unauthorized nonce access due to a missing capability check on the ajax run tool function. This allows authenticated...

PT-2025-20314

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.14 Description The issue affects Rack, a modular Ruby web server interface, when using the Rack::Session::Pool middleware. Simultaneous rack requests can restore a deleted rack session, allowing an unauthenticated us...

Do Not Install the HTTP Service

HyperText Transfer Protocol HTTP is a simple request-response protocol and usually runs over TCP. It specifies what messages the client may send to the server and what responses the client receives. Request and response messages include headers in ASCII, and the message content often uses a...

PT-2025-20186 · Unknown · Martins Free Monetized Ad Exchange Network

Name of the Vulnerable Software and Affected Versions: Martins Free Monetized Ad Exchange Network versions 1.0.0 through 1.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. Recommendations: For versions 1.0.0 through 1.0.5, update to a versio...

PT-2025-20312

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.15.3 Craft CMS versions prior to 5.7.5 Description Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent...

PT-2025-20072 · Lemeconsultoria · Galera.App

Name of the Vulnerable Software and Affected Versions: lemeconsultoria HCM galera.app version 4.58.0 Description: The issue allows an attacker to execute arbitrary code through multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing,...

PT-2025-20124 · Unknown · Jeff Starr Simple Blog Stats

Name of the Vulnerable Software and Affected Versions: Jeff Starr Simple Blog Stats versions from n/a through 20250416 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-20104 · Pimwick · Pw Woocommerce Bulk Edit

Name of the Vulnerable Software and Affected Versions: pimwick PW WooCommerce Bulk Edit versions prior to 2.134 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-20383

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 17.5, 16.9, 15.13, 14.18, and 13.21 Description The vulnerability is related to a buffer over-read in PostgreSQL's GB18030 encoding validation. This issue allows a database input provider to achieve temporary denia...

PT-2025-20054 · Samsung · Samsung Gallery

Name of the Vulnerable Software and Affected Versions: Samsung Gallery versions prior to 14.5.10.3 in Global Android 13 Samsung Gallery versions prior to 14.5.09.3 in China Android 13 Samsung Gallery versions prior to 15.5.04.5 in Android 14 Description: The issue is related to improper input...

PT-2025-19835 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin for WordPress versions up to and including 1.6 Description: The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the aha plugin page function. This allows unauthenticated...

PT-2025-19830 · Unknown · Itsourcecode Content Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Content Management System version 1.0 Description: A critical issue was discovered in the itsourcecode Content Management System, affecting the /admin/update main topic img.php file. The manipulation of the topic id argument lead...