PT-2025-21720

Name of the Vulnerable Software and Affected Versions: ShayanWeb Admin FontChanger versions 1.8.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-21596 · Unknown · Projectworlds Hospital Database Management System

Name of the Vulnerable Software and Affected Versions: projectworlds Hospital Database Management System version 1.0 Description: A critical issue was found in the projectworlds Hospital Database Management System. This issue affects an unknown part of the file /medicines info.php. The manipulati...

PT-2025-21732 · Aptivada · Aptivada

Name of the Vulnerable Software and Affected Versions: Aptivada for WP versions n/a through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

PT-2025-21750 · Unknown · Gongfuxiang Schoolcms

Name of the Vulnerable Software and Affected Versions: gongfuxiang schoolcms version 2.3.1 Description: A critical issue has been discovered, affecting the SaveInfo function of the file "/index.php?m=Admin&c=article&a=SaveInfo". The manipulation of the ID argument leads to SQL injection. This iss...

PT-2025-21751

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 5.3.0 through 5.3.42 Spring Framework versions 6.0.0 through 6.0.27 Spring Framework versions 6.1.0 through 6.1.19 Spring Framework versions 6.2.0 through 6.2.6 Description: The issue concerns a bypass of disallowed...

PT-2025-21674 · Lambertgroup · Lambertgroup Shout

Name of the Vulnerable Software and Affected Versions: LambertGroup SHOUT versions n/a through 3.5.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendation...

PT-2025-21597 · WordPress · Posts Per Cat

Name of the Vulnerable Software and Affected Versions: Posts per Cat plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-21628 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue was found in the PHPGurukul Zoo Management System. The problem affects an unknown function of the file /admin/contactus.php. The manipulation of the mobnum argument...

PT-2025-21668 · Wishlist · Wishlist

Name of the Vulnerable Software and Affected Versions: Wishlist versions 2.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For versions 2.1.0 and...

PT-2025-21629 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical vulnerability was found in PHPGurukul Zoo Management System. The issue affects an unknown functionality of the file /admin/profile.php. The manipulation of the contactnumber...

PT-2025-21594 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical vulnerability has been found in the Campcodes Sales and Inventory System, affecting an unknown functionality of the file /pages/product.php. The manipulation of the...

PT-2025-21677 · Lambertgroup · Uberslider

Name of the Vulnerable Software and Affected Versions: LambertGroup UberSlider versions n/a through 2.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to exploit the system...

PT-2025-21625 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical vulnerability has been found in the PHPGurukul Complaint Management System, affecting unknown code of the file /admin/admin-profile.php. The manipulation of the...

PT-2025-21624 · Unknown · Phpgurukul Beauty Parlour Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Beauty Parlour Management System version 1.1 Description: A critical issue has been discovered in the PHPGurukul Beauty Parlour Management System. The problem lies in an unknown function within the /contact.php file. Manipulation o...

PT-2025-21662 · Nextcloud · Nextcloud Enterprise Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 29.0.13, 30.0.7, and 31.0.1 Nextcloud Enterprise Server versions prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 Description: The issue allows an attacker on a multi-user system to re...

PT-2025-21654 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Park Ticketing Management System version 2.0 Description: A critical issue has been discovered, affecting the file /normal-search.php. The manipulation of the searchdata argument leads to SQL injection. This issue can be exploited...

PT-2025-21761 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue was found in the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument reboot time leads to a stack-based buffer overflow. This issue can b...

PT-2025-21605 · Netdragon · Bohua Netdragon Firewall

Name of the Vulnerable Software and Affected Versions: Bohua NetDragon Firewall version 1.0 Description: A critical issue affects the processing of the file /systemstatus/ip status.php. The manipulation of the subnet argument leads to command injection. The attack may be initiated remotely. The...

[SECURITY] [DSA 5920-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5920-1 [email protected] https://www.debian.org/security/ Andres Salomon May 15, 2025 https://www.debian.org/security/faq -...

GHSA-7MM3-VFG8-7RG6 Babylon Finality Provider `MsgCommitPubRandList` replay attack

Summary A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce that the submitted Commitment field is 32...