PT-2025-24174 · Unknown · Nexa Blocks

Name of the Vulnerable Software and Affected Versions: Nexa Blocks versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24324 · Unknown · Laundry Laundry System +1

Name of the Vulnerable Software and Affected Versions: code-projects Laundry System version 1.0 Description: A vulnerability was found in the Laundry System, affecting some unknown processing of the file /data/insert type.php. The manipulation of the Type argument leads to cross-site scripting. T...

PT-2025-24065

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description The issue concerns an external control of file name or path vulnerability in the delete file function. This allows remote attackers to delete partial...

PT-2025-24271 · Unknown · Bp Profile As Homepage

Name of the Vulnerable Software and Affected Versions: BP Profile as Homepage versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-24194 · WordPress · Wp Shopify

Name of the Vulnerable Software and Affected Versions: WP Shopify versions 1.5.3 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24168 · Otwthemes · Otwthemes Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: OTWthemes Post Custom Templates Lite versions 1.14 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24192 · Otwthemes · Otwthemes Widgetize Pages Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widgetize Pages Light versions 3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-24603 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T versions 4.1.2cu.5232 B20210713 and earlier Description: A critical issue was found in the HTTP POST Request Handler component, affecting an unknown function of the file /boafrm/formReflashClientTbl. The manipulation leads to...

Addressing API Security with NIST SP 800-228

According to the Wallarm Q1 2025 ThreatStats report, 70% of all application attacks target APIs. The industry can no longer treat API security as a sidenote; it’s time to treat it as the main event. NIST seems to be on board with this view, releasing the initial public draft of NIST SP 800-228, a...

PT-2025-23884 · Aerc · Aerc

Name of the Vulnerable Software and Affected Versions: aerc versions before 93bec0d Description: The issue allows directory traversal in the commands/msgview/open.go file due to direct path concatenation of the name of an attachment part. This is caused by the lack of proper validation of...

PT-2025-23984 · Microsoft +1 · Azure Entra Id +2

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.0 through 0.9.14 Himmelblau version 1.00-alpha Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. The issue arises when Entra ID group-based access restrictions are configured...

PT-2025-23893 · Unknown · Phpgurukul Notice Board System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Notice Board System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Notice Board System, affecting an unknown functionality of the file /admin-profile.php. The manipulation of the mobilenumber...

PT-2025-23878 · Campcodes · Campcodes Online Teacher Record Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Teacher Record Management System version 1.0 Description: A critical issue affects the processing of the file /search-teacher.php, where the manipulation of the searchteacher argument leads to SQL injection. This issue can be...

PT-2025-23931 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.7.0 and earlier Description: The issue is related to inadequate access control in the Multi-Factor Authentication MFA feature for users in Devolutions Server. This allows a user with user management permissi...

PT-2025-23924 · Unknown · Media Gallery

Name of the Vulnerable Software and Affected Versions: RSMediaGallery component versions 1.7.4 through 2.1.6 Description: A SQL injection issue was discovered due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker ...

PT-2025-23986 · Code Projects · Code-Projects Real Estate Property Management System

Name of the Vulnerable Software and Affected Versions: code-projects Real Estate Property Management System version 1.0 Description: A critical issue was found in the code-projects Real Estate Property Management System. The problem affects an unknown function of the file /Admin/Property.php...

PT-2025-23897 · Qt Company +1 · Qt +1

Name of the Vulnerable Software and Affected Versions: Qt versions 6.3.0 through 6.5.9 Qt versions 6.6.0 through 6.8.4 Qt version 6.9.0 Description: The issue occurs when a specifically crafted ICNS format image file is loaded in QImage, triggering a crash. Recommendations: For Qt versions 6.3.0...

PT-2025-23912 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical vulnerability was found in the PHPGurukul Complaint Management System. The issue affects an unknown function of the file /admin/between-date-complaintreport.php. The...

PT-2025-23909 · Unknown · 1000 Projects Online Notice Board

Name of the Vulnerable Software and Affected Versions: 1000projects Online Notice Board version 1.0 Description: A critical vulnerability was found in the 1000projects Online Notice Board, affecting unknown code of the file /register.php. The manipulation of the argument fname leads to SQL...

PT-2025-23887 · Unknown · Code-Projects/Anirbandutta9 Content Management System/News-Buzz

Name of the Vulnerable Software and Affected Versions: code-projects/anirbandutta9 Content Management System and News-Buzz version 1.0 Description: A critical issue was found in the code-projects/anirbandutta9 Content Management System and News-Buzz. The problem affects an unknown functionality o...