PT-2025-24311 · Huawei · Huawei Eg8145V5 +2

Name of the Vulnerable Software and Affected Versions: Huawei EG8141A5 versions through V5R019C00S100 Huawei EG8145V5 versions through V5R019C00S100 Huawei EG8145V5-V2 versions through V5R021C00S184 Description: The issue allows the Epuser account to disable ONT firewall functionality. This can b...

PT-2025-24169 · Unknown · Taskbuilder

Name of the Vulnerable Software and Affected Versions: Taskbuilder versions 4.0.3 and earlier Description: The issue is related to a Missing Authorization vulnerability in Taskbuilder, which allows accessing functionality not properly constrained by ACLs. Recommendations: For Taskbuilder versions...

PT-2025-24012 · Unknown · Sourcecodester Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A vulnerability was found in the SourceCodester Student Result Management System, classified as problematic. This issue affects some unknown processing of the file...

PT-2025-24115 · Codelobster · Codelobster Responsive Flipbooks

Name of the Vulnerable Software and Affected Versions: codelobster Responsive Flipbooks versions n/a through 1.0 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-24096 · Idf +1 · Idf +1

Name of the Vulnerable Software and Affected Versions: IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04 Description: The devices improperly handle TLS requests associated with PROCOME sockets. This can cause the device to reboot, resulting in a denial of service when TLS requests are sent ...

PT-2025-24126 · Unknown · Bg Orthodox Calendar

Name of the Vulnerable Software and Affected Versions: Bg Orthodox Calendar versions 0.13.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-24224 · Wpforms · Pdf For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF for WPForms versions 5.5.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited through the add-ons.or...

PT-2025-24324 · Unknown · Laundry Laundry System +1

Name of the Vulnerable Software and Affected Versions: code-projects Laundry System version 1.0 Description: A vulnerability was found in the Laundry System, affecting some unknown processing of the file /data/insert type.php. The manipulation of the Type argument leads to cross-site scripting. T...

PT-2025-24090 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions prior to 6.4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject malicious...

PT-2025-24194 · WordPress · Wp Shopify

Name of the Vulnerable Software and Affected Versions: WP Shopify versions 1.5.3 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24280 · Code Projects · Code-Projects Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /view dental.php. The manipulation of the itr no argument leads to SQL injectio...

PT-2025-24006 · Signal · Signal App

Name of the Vulnerable Software and Affected Versions: Signal App version 7.41.4 Description: A vulnerability was found in the Biometric Authentication Handler component, which affects the authentication process by missing a critical step. The attack can be launched on a physical device and has a...

PT-2025-24192 · Otwthemes · Otwthemes Widgetize Pages Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widgetize Pages Light versions 3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-24271 · Unknown · Bp Profile As Homepage

Name of the Vulnerable Software and Affected Versions: BP Profile as Homepage versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-24065

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description The issue concerns an external control of file name or path vulnerability in the delete file function. This allows remote attackers to delete partial...

PT-2025-24174 · Unknown · Nexa Blocks

Name of the Vulnerable Software and Affected Versions: Nexa Blocks versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24168 · Otwthemes · Otwthemes Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: OTWthemes Post Custom Templates Lite versions 1.14 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24603 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T versions 4.1.2cu.5232 B20210713 and earlier Description: A critical issue was found in the HTTP POST Request Handler component, affecting an unknown function of the file /boafrm/formReflashClientTbl. The manipulation leads to...

Addressing API Security with NIST SP 800-228

According to the Wallarm Q1 2025 ThreatStats report, 70% of all application attacks target APIs. The industry can no longer treat API security as a sidenote; it’s time to treat it as the main event. NIST seems to be on board with this view, releasing the initial public draft of NIST SP 800-228, a...

PT-2025-23884 · Aerc · Aerc

Name of the Vulnerable Software and Affected Versions: aerc versions before 93bec0d Description: The issue allows directory traversal in the commands/msgview/open.go file due to direct path concatenation of the name of an attachment part. This is caused by the lack of proper validation of...