CVE-2025-30371

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

PT-2025-13608 · WordPress · So-Called Air Quotes

Name of the Vulnerable Software and Affected Versions: So-Called Air Quotes plugin for WordPress versions up to, and including, 0.1 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do...

PT-2025-13607 · WordPress · Checkout Mestres Wp

Name of the Vulnerable Software and Affected Versions: Checkout Mestres do WP for WooCommerce plugin for WordPress versions 8.6.5 through 8.7.5 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the cwmpUpdateOptio...

GHSA-5VMP-M5V2-HX47 tough root metadata version is not checked for sequential versioning

Summary When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the...

PT-2025-13597 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue could disclose sensitive user credentials from log files during the new installation of the product. Recommendations: For IBM InfoSphere Information Server version 11.7,...

PT-2025-13641

Name of the Vulnerable Software and Affected Versions Generic Plus PCL6 Printer Driver versions 3.12 and earlier Generic Plus UFR II Printer Driver versions 3.12 and earlier Generic Plus LIPS4 Printer Driver versions 3.12 and earlier Generic Plus LIPSLX Printer Driver versions 3.12 and earlier...

PT-2025-13570 · Unknown · Aliconnect /Sdk

Name of the Vulnerable Software and Affected Versions: Aliconnect /sdk version 0.0.6 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code via the aim function in the aim.js component. This issue enables attackers to potentially compromise systems by injecting...

PT-2025-13572 · Alizeait · Unflatto

Name of the Vulnerable Software and Affected Versions: alizeait unflatto versions 1.0.2 and earlier Description: The issue is related to a prototype pollution vulnerability via the exports.unflatto method at /dist/index.js. This allows attackers to execute arbitrary code or cause a Denial of...

PT-2025-13394

Name of the Vulnerable Software and Affected Versions FoxCMS version 1.2.5 Description An issue in FoxCMS allows a remote attacker to execute arbitrary code via the case display page in the index.html component. The vulnerability is related to a remote code execution issue. Recommendations For...

PT-2025-24371

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions through 8.0.0.28 Description The Quantenna Wi-Fi chipset has a local control script, router command.sh, that is vulnerable to command injection, specifically in the get syslog from qtn argument. This issue is...

PT-2025-24374

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions prior to 8.0.0.28 Description The Quantenna Wi-Fi chipset ships with a local control script, set tx pow, that is vulnerable to command injection. This issue is an instance of CWE-88, "Improper Neutralization of...

PT-2025-13085 · Smackcoders · Smackcoders Lead Form Data Collection To Crm

Name of the Vulnerable Software and Affected Versions: smackcoders Lead Form Data Collection to CRM versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, which allows Blind S...

PT-2025-13391 · Mitel · Mitel Micontact Center Business

Name of the Vulnerable Software and Affected Versions: Mitel OpenScape Accounting Management through V5 R1.1.0 Description: The issue is related to a path traversal attack due to insufficient sanitization of user input, which could allow an authenticated attacker with administrative privileges to...

PT-2025-13384 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A SQL Injection issue was identified in the "/WeGIA/html/funcionario/remuneracao.php" endpoint, specifically in the id funcionario parameter. This allows the execution of arbitrary SQL commands,...

PT-2025-22300 · Wavlink · Wavlink Wl-Wn579A3

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN579A3 version 1.0 Description: A command injection vulnerability in the /cgi-bin/adm.cgi component of Wavlink WL-WN579A3 allows attackers to execute arbitrary commands via a crafted input. This issue is related to the lack of...

PT-2025-13414

Name of the Vulnerable Software and Affected Versions Data::Entropy versions 0.007 and earlier Description The issue concerns the use of the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Recommendations For Data::Entropy versio...

PT-2025-13174 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical vulnerability was found in the function registration of the file /oews/classes/Users.php?f=registration of the component Registration. The manipulation of the ID argument...

PT-2025-24368 · Quantenna · Quantenna Wi-Fi Chipset

Name of the Vulnerable Software and Affected Versions: Quantenna Wi-Fi chipset versions prior to 8.0.0.29 Description: The Quantenna Wi-Fi chipset contains a local control script, router command.sh, that is vulnerable to command injection, specifically an instance of improper neutralization of...

PT-2025-24373

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions prior to 8.0.0.28 Description The Quantenna Wi-Fi chipset ships with a local control script, transmit file, that is vulnerable to command injection. This issue is an instance of CWE-88, "Improper Neutralization...

PT-2025-24372

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions prior to 8.0.0.28 Description The Quantenna Wi-Fi chipset has a local control script, router command.sh, that is vulnerable to command injection, specifically in the sync time argument. This issue is an instanc...