PT-2025-27948 · Mtr +2 · Mtr +2

Name of the Vulnerable Software and Affected Versions: mtr versions 0.95 and earlier Description: The issue concerns the mishandling of execution of a program specified by the MTR PACKET environment variable in certain privileged contexts. It is noted that mtr on macOS may often have Sudo rules d...

PT-2025-27858 · WordPress · Uncode Core

Name of the Vulnerable Software and Affected Versions: Uncode Core plugin for WordPress versions up to, and including, 2.9.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the uncode hl...

PT-2025-27874 · Bplugins · Bplugins Video Gallery Block

Name of the Vulnerable Software and Affected Versions: bPlugins Video Gallery Block versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject...

PT-2025-27944 · Ergon Informatik Ag · Airlock Iam

Name of the Vulnerable Software and Affected Versions: Ergon Informatik AG's Airlock IAM versions 7.7.9 through 8.3.1 Description: The issue is related to a timing difference in the password reset functionality, allowing unauthenticated attackers to enumerate usernames. Recommendations: For...

PT-2025-27894 · Unknown · Sharable Password Protected Posts

Name of the Vulnerable Software and Affected Versions: Sharable Password Protected Posts version 1.1.1 and earlier Description: The issue allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API. Recommendations: For...

PT-2025-27848 · Unknown · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.8 Description: The issue is related to missing file type validation in the dpwap plugin locInstall function, allowing authenticated attackers with Administrator-level access and above to uplo...

PT-2025-27852 · WordPress · Gozen Forms

Name of the Vulnerable Software and Affected Versions: GoZen Forms plugin for WordPress versions up to, and including, 1.1.5 Description: The issue allows unauthenticated attackers to perform SQL Injection via the forms-id parameter of the emdedSc function due to insufficient escaping on the...

PT-2025-28016 · Mediawiki · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - SecurePoll extension versions 1.39.X through 1.39.12 Mediawiki - SecurePoll extension versions 1.42.X through 1.42.6 Mediawiki - SecurePoll extension versions 1.43.X through 1.43.1 Description: The issue affects the Mediawiki -...

PT-2025-27924 · WordPress · Bestwpdeveloper Woocommerce Product Multi-Action

Name of the Vulnerable Software and Affected Versions: BestWpDeveloper WooCommerce Product Multi-Action versions 1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited in the BestWpDeveloper WooCommerce Product...

PT-2025-27855 · WordPress · Booking X

Name of the Vulnerable Software and Affected Versions: Booking X plugin for WordPress versions 1.0 through 1.1.2 Description: The issue allows unauthorized access to data due to a missing capability check on the export now function. This enables unauthenticated attackers to download all plugin...

PT-2025-27906 · Liquidthemes · Logisticshub

Name of the Vulnerable Software and Affected Versions: LiquidThemes LogisticsHub versions 1.1.6 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to significant security...

PT-2025-27930 · Woocommerce · Paytiko For Woocommerce

Name of the Vulnerable Software and Affected Versions: Paytiko for WooCommerce versions 1.3.14 and earlier Description: The issue affects the Paytiko - Payment Orchestration Platform Paytiko for WooCommerce, allowing exploitation due to incorrectly configured access control security levels. This ...

PT-2025-27892 · Unknown · Tony Zeoli Radio Station

Name of the Vulnerable Software and Affected Versions: Tony Zeoli Radio Station versions 2.5.12 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This vulnerability...

PT-2025-29168 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 version 1.0.0.123880 Description: A critical issue exists in Tenda O3V2 version 1.0.0.123880. This issue affects the fromTraceroutGet function within the /goform/getTraceroute file of the httpd component. Manipulation of the dest...

PT-2025-27914 · Unknown · Privatecontent - Mail Actions

Name of the Vulnerable Software and Affected Versions: PrivateContent - Mail Actions versions 2.3.2 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows P...

PT-2025-27886 · Unknown · Aakif Kadiwala Posts Slider Shortcode

Name of the Vulnerable Software and Affected Versions: Aakif Kadiwala Posts Slider Shortcode versions 1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that an attacker...

PT-2025-27926 · Unknown · Gnuget Mf Plus Wpml

Name of the Vulnerable Software and Affected Versions: Gnuget MF Plus WPML versions 1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Gnuget MF Plus WPML...

Security Bulletin: IBM DataPower Gateway affected by issues in Java Runtime

Summary IBM DataPower Gateway does not itself use Java, but certain bundled integrations do e.g. JDBC, IMS Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacker to cause high confidentiali...

Mitsubishi Electric MELSOFT Update Manager (Update B)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, disclose information, alter information, or cause a denial-of-service DoS condition. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk...

Mitsubishi Electric MELSEC iQ-F Series

RISK EVALUATION Successful exploitation of this vulnerability could result in a denial-of-service condition for legitimate users for a certain period by repeatedly attempting to log in with incorrect passwords. When the product repeatedly receives unauthorized logins from an attacker, legitimate...