PT-2025-26927 · WordPress · Amazon Products To Woocommerce

Name of the Vulnerable Software and Affected Versions: Amazon Products to WooCommerce plugin for WordPress versions up to, and including, 1.2.7 Description: The issue allows unauthorized modification of data due to a missing capability check on the wcta2w get amazon product callback function. Thi...

PT-2025-30923 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: An authorization bypass issue exists in Salesforce Tableau Server on Windows and Linux due to a...

PT-2025-26917 · WordPress · Gc Social Wall

Name of the Vulnerable Software and Affected Versions: GC Social Wall plugin for WordPress versions up to, and including, 1.15 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gc social wall' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-26951

Name of the Vulnerable Software and Affected Versions: System Information Reporter versions 1.0.3 and prior Description: The issue allows a local user to manipulate the location of registry backup files by creating a junction symlink, potentially overwriting system files. This can be achieved by...

PT-2025-26919 · WordPress · Owl Carousel

Name of the Vulnerable Software and Affected Versions: Owl carousel responsive plugin for WordPress versions up to, and including, 1.9 Description: The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of...

PT-2025-26965 · Drupal · Drupal Simple Xml Sitemap

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site...

PT-2025-26940 · Unknown · Iroha Board

Name of the Vulnerable Software and Affected Versions: iroha Board versions 0.10.12 and earlier Description: The issue is related to a direct request problem, also known as forced browsing or navegación forzada, which could allow an attacker who has logged in to the affected product to access...

PT-2025-26943 · Puppet · Puppet Enterprise

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions 2018.1.8 through 2023.8.3 Puppet Enterprise version 2025.3 Description: A user with specific node group editing permissions and a specially crafted class parameter could execute commands as root on the primary host...

PT-2025-26955 · Hunt Electronic · Hunt Electronic Dvr

Name of the Vulnerable Software and Affected Versions: Hunt Electronic DVR models HBF-09KD and HBF-16NK Description: The issue allows remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device. This is due to an OS Command Injection vulnerability...

PT-2025-26922 · WordPress · Tournament Bracket Generator

Name of the Vulnerable Software and Affected Versions: Tournament Bracket Generator plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode due to insufficient input sanitization and output...

MAL-2025-5365 Malicious code in bar.app.bar_rights (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d42cf077f7eef742c0cd55680d97ae121015d7f7a43d7b81fc35ce75333b382 Any computer that has this package installed or running should be considered...

PT-2025-26827 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the system, affecting the /panel/edit-staff.php file. The manipulation of the editid argument leads to SQL injection. This issue can be exploit...

PT-2025-26877 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue has been found in the QuickSetting function of the file ap.so, allowing for os command injection through the manipulation of the hour/minute argument. This can be initiated...

PT-2025-26939 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.10 through 17.11.4 GitLab EE versions 18.0 through 18.0.2 GitLab EE versions 18.1 through 18.1.0 Description: An issue has been discovered that could have allowed authenticated users to assign unrelated compliance...

PT-2025-28078 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability affects the function formWpsStart of the file "/goform/formWpsStart" in the component webs. The manipulation of the argument pinCode leads to a stack-based buffer overflow...

PT-2025-28081 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability was found in the function formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to a stack-based buffer...

PT-2025-26848 · Hexagon · Hexagon Hxgn Oncall Dispatch Advantage

Name of the Vulnerable Software and Affected Versions: Hexagon HxGN OnCall Dispatch Advantage Web version 10.2309.03.00264 Hexagon HxGN OnCall Dispatch Advantage Mobile version 10.2402 Description: The issue allows a remote authenticated attacker with access to the Broadcast Person functionality ...

PT-2025-28080 · Belkin · Belkin F9K1122

Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33 Description: A critical vulnerability has been found in the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to a stack-based...

PT-2025-26818 · Unknown +1 · Mountain Duck +1

Name of the Vulnerable Software and Affected Versions: Cyberduck versions through 9.1.6 Mountain Duck versions through 4.17.5 Description: The issue is related to improper handling of TLS certificate pinning for untrusted certificates, such as self-signed certificates, in Cyberduck and Mountain...

PT-2025-26836 · Cadclick · Cadclick

Name of the Vulnerable Software and Affected Versions: CADClick versions 1.13.0 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the tree parameter, enabling Cross-Site Scripting XSS attacks. Recommendations: For CADClick versions 1.13.0 and...