PT-2025-16180 · Unknown · Powercreator Cms

Name of the Vulnerable Software and Affected Versions: PowerCreator CMS version 1.0 Description: A critical issue was found in PowerCreator CMS, affecting an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the cid argument leads to sql injection. It is possible to launch...

Exploit for Cross-site Scripting in Moodle

PoC for CVE-2025-26529 – Moodle XSS to RCE Exploit This is a...

PT-2025-16378 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK N600R version 4.3.0cu.7647 B20210106 Description: A stack overflow issue was discovered via the pin parameter in the setWiFiWpsConfig function. Recommendations: For TOTOLINK N600R version 4.3.0cu.7647 B20210106, consider disabling th...

PT-2025-25408 · Blink · Bl-X10 Ac8 +7

Name of the Vulnerable Software and Affected Versions: Blink routers BL-WR9000 version 2.4.9 Blink routers BL-AC2100 AZ3 version 1.0.4 Blink routers BL-X10 AC8 version 1.0.5 Blink routers BL-LTE300 version 1.2.3 Blink routers BL-F1200 AT1 version 1.0.0 Blink routers BL-X26 AC8 version 1.2.8 Blink...

SurrealDB no JavaScript script function default timeout could facilitate DoS

Through enabling the scripting capability. SurrealDB allows for advanced functions with complicated logic, by allowing embedded functions to be written in JavaScript. These functions are bounded for memory and stack size, but not in time. An attacker could launch a number of long running function...

PT-2025-16119 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 macOS versions prior to Sonoma 14 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access sensitive user data. Recommendations: Fo...

PT-2025-16158 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue involves an out-of-bounds read in Microsoft Edge Chromium-based, allowing an unauthorized attacker to execute code over a network. This can potentially enabl...

ABB MV Drives

SUMMARY Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System v.3.5.15.0 is utilized in the firmware of ABB MV ACS6080 and ACS5000 drives to provide IEC 61131 programming capabilities. These vulnerabilities could lead...

PT-2025-15983 · Github +1 · Github Gist +1

Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.10.3 Description: The issue arises when a malicious SVG file is uploaded to HedgeDoc, potentially leading to cross-site scripting XSS when the file is opened in a new tab. This is possible due to the exploitation ...

PT-2025-16014 · Mediawiki +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.12 MediaWiki versions prior to 1.42.6 MediaWiki versions prior to 1.43.1 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting...

PT-2025-15916 · WordPress · Fedify

Name of the Vulnerable Software and Affected Versions: Feedify WordPress plugin versions prior to 2.4.6 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...

PT-2025-16011 · Mediawiki +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.12 MediaWiki versions prior to 1.42.6 MediaWiki versions prior to 1.43.1 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. It is associated with program files...

PT-2025-15929 · Unknown · Studi7 Qr Master

Name of the Vulnerable Software and Affected Versions: Studi7 QR Master versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-15975 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.8.7 and earlier, versions 17.9 prior to 17.9.6, and versions 17.10 prior to 17.10.4. Description: A denial of service DoS issue exists in GitLab CE/EE. The issue occurs when oversized payloads are injected into CI...

PT-2025-15917 · WordPress · Wp-Geshi-Highlight

Name of the Vulnerable Software and Affected Versions: WP-GeSHi-Highlight versions 1.4.3 and earlier Description: The WP-GeSHi-Highlight WordPress plugin processes user-supplied input as a regular expression via the wp geshi filter replace code function, which could lead to a Regular Expression...

PT-2025-15985 · Ibm · Ibm Sterling Control Center

Name of the Vulnerable Software and Affected Versions: IBM Sterling Control Center versions 6.2.1 through 6.4.0 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system, potentially exposing sensitive information. Recommendations: For...

PT-2025-15927 · Unknown · 5Sterrenspecialist

Name of the Vulnerable Software and Affected Versions: 5sterrenspecialist versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For versions n/a...

PT-2025-15970 · Panasonic · Panasonic Ir Control Hub

Name of the Vulnerable Software and Affected Versions: Panasonic IR Control Hub IR Blaster versions 1.17 and earlier Description: The issue allows an attacker with physical access to load unauthorized firmware onto the device. Recommendations: For versions 1.17 and earlier, update to a version...

GHSA-GMG8-593G-7MV3 Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...