PT-2025-27848 · Unknown · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.8 Description: The issue is related to missing file type validation in the dpwap plugin locInstall function, allowing authenticated attackers with Administrator-level access and above to uplo...

PT-2025-27930 · Woocommerce · Paytiko For Woocommerce

Name of the Vulnerable Software and Affected Versions: Paytiko for WooCommerce versions 1.3.14 and earlier Description: The issue affects the Paytiko - Payment Orchestration Platform Paytiko for WooCommerce, allowing exploitation due to incorrectly configured access control security levels. This ...

PT-2025-27892 · Unknown · Tony Zeoli Radio Station

Name of the Vulnerable Software and Affected Versions: Tony Zeoli Radio Station versions 2.5.12 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This vulnerability...

PT-2025-27894 · Unknown · Sharable Password Protected Posts

Name of the Vulnerable Software and Affected Versions: Sharable Password Protected Posts version 1.1.1 and earlier Description: The issue allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API. Recommendations: For...

PT-2025-27886 · Unknown · Aakif Kadiwala Posts Slider Shortcode

Name of the Vulnerable Software and Affected Versions: Aakif Kadiwala Posts Slider Shortcode versions 1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that an attacker...

PT-2025-27914 · Unknown · Privatecontent - Mail Actions

Name of the Vulnerable Software and Affected Versions: PrivateContent - Mail Actions versions 2.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows P...

PT-2025-27926 · Unknown · Gnuget Mf Plus Wpml

Name of the Vulnerable Software and Affected Versions: Gnuget MF Plus WPML versions 1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Gnuget MF Plus WPML...

Security Bulletin: IBM DataPower Gateway affected by issues in Java Runtime

Summary IBM DataPower Gateway does not itself use Java, but certain bundled integrations do e.g. JDBC, IMS Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacker to cause high confidentiali...

Mitsubishi Electric MELSEC iQ-F Series

RISK EVALUATION Successful exploitation of this vulnerability could result in a denial-of-service condition for legitimate users for a certain period by repeatedly attempting to log in with incorrect passwords. When the product repeatedly receives unauthorized logins from an attacker, legitimate...

Mitsubishi Electric MELSOFT Update Manager (Update B)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, disclose information, alter information, or cause a denial-of-service DoS condition. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk...

PT-2025-27800 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the SetSysTimeCfg function via the time parameter. Recommendations: For Tenda AC6 version 15.03.05.16 multi, consider restricting access to the...

PT-2025-27797 · WordPress · Jkdevkit

Name of the Vulnerable Software and Affected Versions: JKDEVKIT plugin for WordPress versions up to, and including, 1.9.4 Description: The issue is related to insufficient file path validation in the font upload handler function, allowing authenticated attackers with Subscriber-level access and...

PT-2025-27785 · Endress+Hauser · Endress+Hauser Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The login mechanism of the affected system does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to...

PT-2025-27791 · Unknown · Flatboard Pro

Name of the Vulnerable Software and Affected Versions: Flatboard Pro versions prior to 3.2.2 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability due to the lack of proper validation of user input. This occurs through the replace parameter in the "/config.php/tags" endpoint...

PT-2025-27768 · Opentext · Opentext Groupwise

Name of the Vulnerable Software and Affected Versions: OpenText GroupWise versions 7 through 17.5 OpenText GroupWise version 23.4 OpenText GroupWise version 24.1 OpenText GroupWise version 24.2 OpenText GroupWise version 24.3 OpenText GroupWise version 24.4 Description: The issue is related to an...

PT-2025-27804 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the fromSetRouteStatic function via the list parameter. This can be exploited by sending a malformed route list parameter. Recommendations: For Tend...

PT-2025-27821 · Mitsubishi · Melsec Iq-F Series Fx5-Cclgn-Ms +69

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F Series affected versions not specified Description: The software contains an overly restrictive account lockout mechanism. A remote, unauthenticated attacker can lockout legitimate users by repeatedly attemptin...

PT-2025-27799 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69 Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint. Recommendations: For...

PT-2025-27589 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an...

PT-2025-27605 · Red Hat · Red Hat Advanced Cluster Management

Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Management versions 2.10 through 2.10.6 Red Hat Advanced Cluster Management versions 2.11 through 2.11.3 Red Hat Advanced Cluster Management versions 2.12 through 2.12.3 Description: A flaw in Red Hat Advanced Cluster...