PT-2025-27259

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.20.3 Description: The issue concerns the Roo Code agent's search files tool, which did not respect the setting to disable reads outside of the VS Code workspace. This allowed an attacker who could inject a prompt...

PT-2025-27204 · Lucidcrew · Lucidcrew Wp Forum Server

Name of the Vulnerable Software and Affected Versions: lucidcrew WP Forum Server versions 1.8.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-27090 · Xtraffic · Wp-Optimize

Name of the Vulnerable Software and Affected Versions: WP Optimize By xTraffic versions through 5.1.6 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions through 5.1.6, update to a version later than 5.1.6 to resolve...

PT-2025-27093 · Unknown · Content No Cache

Name of the Vulnerable Software and Affected Versions: Content No Cache versions 0.1.3 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability affects the Content No Cache software...

PT-2025-27179 · Unknown · Opicron Image Cleanup

Name of the Vulnerable Software and Affected Versions: opicron Image Cleanup versions 1.9.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the opicron Image Cleanup, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For opicron Image...

PT-2025-27027 · Unknown · Huija Bicyclesharingserver

Name of the Vulnerable Software and Affected Versions: huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a Description: A critical vulnerability has been found in the huija bicycleSharingServer, affecting the function userDao.selectUserByUserNameLike of the file...

PT-2025-27128 · Unknown · John Russell National Weather Service Alerts

Name of the Vulnerable Software and Affected Versions: John Russell National Weather Service Alerts versions 1.3.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows...

PT-2025-27168 · WordPress · Wp Youtube Live

Name of the Vulnerable Software and Affected Versions: WP YouTube Live versions 1.10.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For WP YouTube Live versions 1.10.0 and earlier, update to a version that...

PT-2025-27246 · Mikopbx · Mikopbx

Name of the Vulnerable Software and Affected Versions: MikoPBX versions through 2024.1.114 Description: The issue allows uploading a PHP script to an arbitrary directory due to a problem in the PBXCoreREST/Controllers/Files/PostController.php file. Recommendations: For MikoPBX versions through...

PT-2025-27146 · Intelbras · Intelbras Incontrol

Name of the Vulnerable Software and Affected Versions: Intelbras InControl version 2.21.60.9 Description: A critical issue has been found in the HTTP PUT Request Handler component, affecting the processing of the file "/v1/operador/". This leads to permission issues and can be initiated remotely...

PT-2025-27237 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Manage Card functionality, specifically at the "/mcgs/admin/manage-card.php" endpoint. This allows an authorized admin to...

PT-2025-27100 · Ctusers · Ctusers

Name of the Vulnerable Software and Affected Versions: CTUsers versions through 1.0.0 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. Recommendations:...

PT-2025-27258 · Unknown · Code-Projects Food Distributor Site

Name of the Vulnerable Software and Affected Versions: code-projects Food Distributor Site version 1.0 Description: A vulnerability was found in the code-projects Food Distributor Site, affecting an unknown function of the file /admin/save settings.php. The manipulation of the argument site phone...

MAL-2025-5380 Malicious code in comp-base-btn-switch (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14384b4ee9a2e634b9dcaf1e9530d4080d824af4af82fdea8084b744f81c5d7f Any computer that has this package installed or running should be considered...

Mitsubishi Electric Air Conditioning Systems (Update B)

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to control the air conditioning system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform...

PT-2025-26919 · WordPress · Owl Carousel

Name of the Vulnerable Software and Affected Versions: Owl carousel responsive plugin for WordPress versions up to, and including, 1.9 Description: The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of...

PT-2025-26940

Name of the Vulnerable Software and Affected Versions: iroha Board versions 0.10.12 and earlier Description: The issue is related to a direct request problem, also known as forced browsing or navegación forzada, which could allow an attacker who has logged in to the affected product to access...

PT-2025-26927 · WordPress · Amazon Products To Woocommerce

Name of the Vulnerable Software and Affected Versions: Amazon Products to WooCommerce plugin for WordPress versions up to, and including, 1.2.7 Description: The issue allows unauthorized modification of data due to a missing capability check on the wcta2w get amazon product callback function. Thi...

PT-2025-26922 · WordPress · Tournament Bracket Generator

Name of the Vulnerable Software and Affected Versions: Tournament Bracket Generator plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode due to insufficient input sanitization and output...

PT-2025-26917 · WordPress · Gc Social Wall

Name of the Vulnerable Software and Affected Versions: GC Social Wall plugin for WordPress versions up to, and including, 1.15 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gc social wall' shortcode due to insufficient input sanitization and output escaping on...