PT-2025-15983 · Github +1 · Github Gist +1

Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.10.3 Description: The issue arises when a malicious SVG file is uploaded to HedgeDoc, potentially leading to cross-site scripting XSS when the file is opened in a new tab. This is possible due to the exploitation ...

PT-2025-15916 · WordPress · Fedify

Name of the Vulnerable Software and Affected Versions: Feedify WordPress plugin versions prior to 2.4.6 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...

PT-2025-15975 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.8.7 and earlier, versions 17.9 prior to 17.9.6, and versions 17.10 prior to 17.10.4. Description: A denial of service DoS issue exists in GitLab CE/EE. The issue occurs when oversized payloads are injected into CI...

PT-2025-15929 · Unknown · Studi7 Qr Master

Name of the Vulnerable Software and Affected Versions: Studi7 QR Master versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-15927 · Unknown · 5Sterrenspecialist

Name of the Vulnerable Software and Affected Versions: 5sterrenspecialist versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For versions n/a...

PT-2025-15970 · Panasonic · Panasonic Ir Control Hub

Name of the Vulnerable Software and Affected Versions: Panasonic IR Control Hub IR Blaster versions 1.17 and earlier Description: The issue allows an attacker with physical access to load unauthorized firmware onto the device. Recommendations: For versions 1.17 and earlier, update to a version...

PT-2025-15985 · Ibm · Ibm Sterling Control Center

Name of the Vulnerable Software and Affected Versions: IBM Sterling Control Center versions 6.2.1 through 6.4.0 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system, potentially exposing sensitive information. Recommendations: For...

PT-2025-15917 · WordPress · Wp-Geshi-Highlight

Name of the Vulnerable Software and Affected Versions: WP-GeSHi-Highlight versions 1.4.3 and earlier Description: The WP-GeSHi-Highlight WordPress plugin processes user-supplied input as a regular expression via the wp geshi filter replace code function, which could lead to a Regular Expression...

GHSA-GMG8-593G-7MV3 Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

PT-2025-15733 · Unknown · Abozain Albanna Customize Login Page

Name of the Vulnerable Software and Affected Versions: AboZain Albanna Customize Login Page versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-15819 · Unknown · Quantumcloud Seo Help

Name of the Vulnerable Software and Affected Versions: QuantumCloud SEO Help versions n/a through 6.6.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions n/a through 6.6.0, update to a...

PT-2025-15766 · WordPress · Wp-Planification

Name of the Vulnerable Software and Affected Versions: WP-Planification versions prior to 2.3.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker could potentially trick a user into performing unintended actions on ...

PT-2025-15840 · Totvs · Totvs Framework

Name of the Vulnerable Software and Affected Versions: TOTVS Framework Linha Protheus version 12.1.2310 Description: An issue in the software allows attackers to bypass multi-factor authentication MFA via a crafted websocket message. Recommendations: For version 12.1.2310, consider disabling...

PT-2025-15755

Name of the Vulnerable Software and Affected Versions: Koa versions prior to 2.16.1 Koa versions prior to 3.0.0-alpha.5 Description: The issue arises when passing untrusted user input to ctx.redirect, which can execute JavaScript code on the user's device, even after sanitizing the input...

PT-2025-15752 · Unknown · Mmx – Make Me Christmas

Name of the Vulnerable Software and Affected Versions: MMX – Make Me Christmas versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-15751 · Icyleaf · Icyleaf Ws Audio Player

Name of the Vulnerable Software and Affected Versions: icyleaf WS Audio Player versions 1.1.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 1.1.8 and earlier, update to a version that fixes th...

PT-2025-15693 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar IO versions prior to 3.0.11 Apache Pulsar IO versions prior to 3.3.6 Apache Pulsar IO versions prior to 4.0.4 Description: The issue affects Apache Pulsar IO's Apache Kafka connectors, where sensitive configuration properties ar...

PT-2025-15807 · Czater.Pl · Czater.Pl

Name of the Vulnerable Software and Affected Versions: Czater.pl – live chat i telefon versions 1.0.0 through 1.0.5 Description: The issue is related to a Missing Authorization vulnerability, which allows Cross Site Request Forgery. This means that an attacker can perform actions on behalf of...

PT-2025-15803 · Unknown · Ydesignservices Multiple Location Google Map

Name of the Vulnerable Software and Affected Versions: Ydesignservices Multiple Location Google Map versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions...