PT-2025-17416 · Knowbe4 · Knowbe4 Security Awareness Training

Name of the Vulnerable Software and Affected Versions: KnowBe4 Security Awareness Training versions prior to 2020-01-10 Description: The issue concerns a redirect function in the application that fails to validate the destination URL before redirecting. This allows the response to contain a SCRIP...

PT-2025-17408

Name of the Vulnerable Software and Affected Versions SourceCodester Web-based Pharmacy Product Management System version 1.0 Description A problematic vulnerability was found in the SourceCodester Web-based Pharmacy Product Management System. This issue affects an unknown part of the file...

PT-2025-17397 · Unknown · Gnu Mailman

Name of the Vulnerable Software and Affected Versions: GNU Mailman versions 2.1.39 Description: The issue allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman, also known as the private archive authentication endpoint, using the username...

PT-2025-17411 · Unknown · Phpgurukul Men Salon Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Men Salon Management System version 1.0 Description: A critical issue was found in the PHPGurukul Men Salon Management System. The problem is related to an unknown function of the file /admin/sales-reports-detail.php. The...

PT-2025-17353 · WordPress · Aihub

Name of the Vulnerable Software and Affected Versions: AIHub theme for WordPress versions up to, and including, 1.3.7 Description: The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate image function. This makes it possible for...

PT-2025-17384 · Zhenfeng13 · My-Bbs

Name of the Vulnerable Software and Affected Versions: zhenfeng13 My-BBS version 1.0 Description: A critical vulnerability was found in the Upload function of the file src/main/java/com/my/bbs/controller/common/UploadController.java, affecting the Endpoint component. This leads to unrestricted...

PT-2025-17351 · WordPress · Urbango Membership

Name of the Vulnerable Software and Affected Versions: UrbanGo Membership plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to privilege escalation due to the plugin allowing users who are registering new accounts to set their own role or by supplying the...

PT-2025-32193

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions prior to the April 2025 Hot Fix Description A high-severity vulnerability CVE-2025-53786 exists in Microsoft Exchange Server hybrid deployments. This vulnerability allows attackers with administrative access ...

PT-2025-17291 · Pbootcms · Pbootcms

Name of the Vulnerable Software and Affected Versions: PbootCMS version 3.2.5 Description: A vulnerability was found in the Image Handler component, which can lead to server-side request forgery. The manipulation can be launched remotely. Recommendations: For PbootCMS version 3.2.5, consider...

PT-2025-17311 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue concerns the forum quick reply feature, specifically the view topic.php endpoint, which lacks a spam prevention mechanism. This allows authenticated users to post replies continuously...

PT-2025-17315

Name of the Vulnerable Software and Affected Versions Fastify versions 4.29.0 through 5.3.1 Fastify version 4.9.0 Description Fastify is a fast, low overhead web framework for Node.js. Applications specifying different validation strategies for different content types may bypass validation by...

PT-2025-17297 · Croogo · Croogo

Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...

PT-2025-17248 · Imagination Technologies +1 · Graphics Ddk +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. Recommendations: At the...

PT-2025-17343 · Qimou Cms · Qimou Cms

Name of the Vulnerable Software and Affected Versions: Qimou CMS version 3.34.0 Description: An issue in Qimou CMS allows a remote attacker to execute arbitrary code via the upgrade.php component. Recommendations: For Qimou CMS version 3.34.0, consider disabling the upgrade.php component until a...

PT-2025-17304 · Jmbroadcast · Jmbroadcast Jmb0150 Firmware

Name of the Vulnerable Software and Affected Versions: JMBroadcast JMB0150 Firmware version 1.0 Description: The issue is related to incorrect access control in the "HOME.php" endpoint, allowing attackers to access the Admin panel without authentication. Recommendations: For JMBroadcast JMB0150...

Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution

A critical security vulnerability has been disclosed in the Erlang/Open Telecom Platform OTP SSH implementation that could permit an attacker to execute arbitrary code sans any authentication under certain conditions. The vulnerability, tracked as CVE-2025-32433 , has been given the maximum CVSS...

PT-2025-17227 · Unknown · Datapatrol Screenshot Watermark

Name of the Vulnerable Software and Affected Versions: DataPatrol Screenshot watermark, printing watermark agent version 3.5.2.0 Description: An issue in the software allows a physically proximate attacker to obtain sensitive information. Recommendations: For version 3.5.2.0, at the moment, there...

PT-2025-17144

Name of the Vulnerable Software and Affected Versions JoomSky JS Job Manager versions n/a through 2.0.2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-17132 · Wooms · Wooms

Name of the Vulnerable Software and Affected Versions: aiiddqd WooMS versions through 9.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means an attacker can inject maliciou...

PT-2025-17135 · Buildium · Buildium

Name of the Vulnerable Software and Affected Versions: Listings for Buildium versions 0.1.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Stored XSS. This means an attacker could potentially trick a user into performing unintende...