PT-2025-19761 · WordPress · External Image Replace Plugin

Name of the Vulnerable Software and Affected Versions: External image replace plugin for WordPress versions up to, and including, 1.0.8 Description: The issue is related to missing file type validation in the external image replace get posts::replace post function, allowing authenticated attacker...

PT-2025-19786

Name of the Vulnerable Software and Affected Versions jeeweb-mybatis-springboot version 0.0.1.RELEASE Description The issue is related to incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot, allowing attackers to access sensitive information via a...

PT-2025-19795

Name of the Vulnerable Software and Affected Versions league/commonmark versions 1.5.0 through 2.6.x Description A cross-site scripting XSS vulnerability in the Attributes extension of the league/commonmark library allows remote attackers to insert malicious JavaScript calls into HTML. The librar...

PT-2025-19792

Name of the Vulnerable Software and Affected Versions MobSF versions up to and including 4.3.2 Description MobSF is a mobile application security testing tool used by security teams across numerous organizations, typically deployed on centralized internal or cloud-based servers. The tool provides...

PT-2025-19752

Name of the Vulnerable Software and Affected Versions DBSyncer version 2.0.6 Description The issue is related to incorrect access control in the component /config/download of DBSyncer, allowing attackers to access a JSON file that contains sensitive account information, including the encrypted...

PT-2025-19770

Name of the Vulnerable Software and Affected Versions @misskey-dev/summaly versions 3.0.1 through 5.2.0 Description A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. This issue allows Misskey to follow...

PT-2025-19335

Name of the Vulnerable Software and Affected Versions zhangyanbo2007 youkefu version 4.2.0 and earlier Description A vulnerability was found in the function impsave of the file mwebhandleradminsystemTemplateController.java. The manipulation of the argument dataFile leads to deserialization. The...

PT-2025-19326

Name of the Vulnerable Software and Affected Versions zhangyanbo2007 youkefu versions up to 4.2.0 Description A critical issue was found in the function Upload of the file MediaController.java, where the manipulation of the argument imgFile leads to unrestricted upload. This issue can be exploite...

PT-2025-19777 · Kob · Kob

Name of the Vulnerable Software and Affected Versions: kob version 1.0.0-SNAPSHOT Description: The issue is related to incorrect access control in the doFilter function, which allows attackers to access sensitive information by sending a crafted payload. Recommendations: For version 1.0.0-SNAPSHO...

PT-2025-19780 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is related to incorrect access control, allowing attackers to bypass authentication. This can be achieved via a crafted GET request to the "/index" API endpoint. Recommendations: For xmall version 1.1,...

PT-2025-20029 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: The issue is related to an Out-of-bounds Write that allows an attacker to induce a crash in IO devices using the library. This can be achieved by sending a malicious RPC packet...

PT-2025-19807 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.3 Description: A vulnerability was found in the Group Edit Page component, specifically affecting some unknown functionality of the file /admin/group/edit.do. This issue leads to cross-site scripting and can be exploited...

PT-2025-19736 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 11.5.0 through 11.5.9 IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 12.1.0 through 12.1.1 Description: IBM Db2 for Linux, UNIX and Windows...

PT-2025-19775 · Unknown · Itranswarp

Name of the Vulnerable Software and Affected Versions: itranswarp version 2.19 Description: An issue in the component /manage/ of itranswarp allows attackers to bypass authentication via a crafted request. Recommendations: For version 2.19, consider restricting access to the /manage/ component...

PT-2025-19338 · Unknown · Phpgurukul Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online DJ Booking Management System version 1.0 Description: A critical issue affects the processing of the file /admin/booking-search.php, where the manipulation of the searchdata argument leads to SQL injection. The attack can be...

PT-2025-19800

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 12.1.0 through 12.1.1 Description The issue could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. Recommendation...

PT-2025-19713

Name of the Vulnerable Software and Affected Versions Gefen WebFWC In AV over IP products versions 1.70, 1.85h, 1.86v Description An issue in the /usr/local/bin/jncs.sh script allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute...

PT-2025-19783 · Yaoqishan · Yaoqishan

Name of the Vulnerable Software and Affected Versions: yaoqishan version 0.0.1-SNAPSHOT Description: The issue is related to incorrect access control in the "/admin/" API endpoint, which allows attackers to gain access to Admin rights via a crafted request. Recommendations: For yaoqishan version...

PT-2025-19788

Name of the Vulnerable Software and Affected Versions Keystone versions prior to 6.5.0 Description Keystone, a content management system for Node.js, has an issue where field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These...

PT-2025-19725

Name of the Vulnerable Software and Affected Versions osTicket versions 1.17.5 and earlier Description A SQL injection issue exists in the Search functionality of the tickets.php page, allowing authenticated attackers to execute arbitrary SQL commands. This is achieved via a combination of the...