PT-2025-14150 · Cacholong · Cache Control

Name of the Vulnerable Software and Affected Versions: Cache control by Cacholong versions n/a through 5.4.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-14053 · Bit Apps · Bit Assist

Name of the Vulnerable Software and Affected Versions: Bit Assist versions 1.5.4 and earlier Description: The issue is a Path Traversal vulnerability in Bit Apps Bit Assist, allowing unauthorized access to files and directories. Recommendations: For versions 1.5.4 and earlier, update to a version...

PT-2025-14260 · Unknown · Norse Rune Oracle Plugin

Name of the Vulnerable Software and Affected Versions: Norse Rune Oracle Plugin versions 1.4.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can...

PT-2025-14273 · Unknown · Json Structuring Markup

Name of the Vulnerable Software and Affected Versions: JSON Structuring Markup versions 0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application...

PT-2025-14061 · Joomsky · Joomsky Js Help Desk

Name of the Vulnerable Software and Affected Versions: JoomSky JS Help Desk versions n/a through 2.9.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability allows unauthorized access...

PT-2025-14374 · Codezips · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: CodeZips Gym Management System version 1.0 Description: The issue concerns SQL injection in the name parameter within the "/dashboard/admin/deleteroutine.php" API endpoint. This allows for potential exploitation. Recommendations: For CodeZips...

PT-2025-14271 · Infoway Llc · Ebook Downloader

Name of the Vulnerable Software and Affected Versions: Infoway LLC Ebook Downloader versions 1.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Ebook Downloader, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendation...

PT-2025-14223 · Unknown · Rohit Choudhary Theme Duplicator

Name of the Vulnerable Software and Affected Versions: Rohit Choudhary Theme Duplicator versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Rohit...

PT-2025-14042 · Postmash · Postmash

Name of the Vulnerable Software and Affected Versions: PostMash versions 1.0.0 through 1.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-14205 · Wombat Plugins · Wp Optin Wheel

Name of the Vulnerable Software and Affected Versions: Wombat Plugins WP Optin Wheel versions 1.4.7 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentially force the...

PT-2025-14378 · Infinxt · Infinxt Iedge 100

Name of the Vulnerable Software and Affected Versions: Infinxt iEdge 100 version 2.1.32 Description: An OS Command Injection issue exists in the Troubleshoot module, specifically in the tracertVal parameter of the Tracert function. Recommendations: For Infinxt iEdge 100 version 2.1.32, consider...

PT-2025-14078 · Unknown · Material Dashboard

Name of the Vulnerable Software and Affected Versions: Material Dashboard versions 1.4.5 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel, allowing unauthorized access. This problem affects the Material Dashboard, enabling attackers to...

PT-2025-14170 · Unknown · Embed Extended

Name of the Vulnerable Software and Affected Versions: Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more versions 1.4.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's...

PT-2025-14038 · Unknown · Include Url

Name of the Vulnerable Software and Affected Versions: NotFound Include URL versions 0.3.5 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability affects the Include URL...

PT-2025-14049 · Unknown · Better Wishlist Api

Name of the Vulnerable Software and Affected Versions: Better WishList API versions 1.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS in the Better WishList API...

PT-2025-14390 · Digiwidgets · Digiwidgets Image Editor

Name of the Vulnerable Software and Affected Versions: DigiWidgets Image Editor versions 1.10 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Remote Code Inclusion. This means that an attacker could potentiall...

PT-2025-14217 · Eventbee · Eventbee Rsvp Widget

Name of the Vulnerable Software and Affected Versions: Eventbee RSVP Widget versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS in the Eventbee RSVP Widget...

PT-2025-14238 · Unknown · Wporbit Support Perfect Font Awesome Integration

Name of the Vulnerable Software and Affected Versions: WPOrbit Support Perfect Font Awesome Integration versions n/a through 2.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an...

PT-2025-14177 · Unknown · Piotnet Forms

Name of the Vulnerable Software and Affected Versions: Piotnet Forms versions 1.0.0 through 1.0.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-14377 · Express +2 · Express +2

Name of the Vulnerable Software and Affected Versions: React Router versions 7.0.0 through 7.4.0 Remix versions 2.11.1 and later, prior to 2.16.3 Description: The issue allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part o...