PT-2025-5500 · WordPress · Wp Multi Store Locator

Name of the Vulnerable Software and Affected Versions: WP Multi Store Locator versions 2.4.7 and earlier Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows for Reflected XSS attacks. This means that an attacker can inject malicious...

PT-2025-3357 · Baidu · Baidu Input Method

Name of the Vulnerable Software and Affected Versions: Baidu Input Method version 12.6.13 Description: The issue allows attackers to access user information by supplying a crafted link. Recommendations: For version 12.6.13, update to a newer version to mitigate the risk. At the moment, there is n...

PT-2025-1987

Name of the Vulnerable Software and Affected Versions Dyn Business Panel WordPress plugin version 1.0.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-1553 · Ibm · Ibm Common Licensing

Name of the Vulnerable Software and Affected Versions: IBM Common Licensing version 9.0 Description: The issue is related to the storage of user credentials in plain clear text, which can be read by a local user. This allows an attacker to gain unauthorized access to protected information. The...

PT-2025-1695 · WordPress · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet plugin for WordPress versions up to, and including, 1.50.3 Description: The issue is related to Stored Cross-Site Scripting via the zone parameter due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-5526 · Unknown · Radius Blocks

Name of the Vulnerable Software and Affected Versions: Radius Blocks versions 2.1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 2.1.2 and earlier,...

Medium: grpc

Issue Overview: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPCARGTCPTXZEROCOPYENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission...

Important: tomcat10

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

Important: python3.12

Issue Overview: Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the...

Important: redis6

Issue Overview: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional...

Medium: runfinch-finch

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...

PT-2025-5462 · WordPress · Orbisius Simple Notice

Name of the Vulnerable Software and Affected Versions: Orbisius Simple Notice versions 1.1.3 and earlier Description: The issue affects the Orbisius Simple Notice plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting...

PT-2025-5397 · Unknown · Caching Compatible Cookie Opt-In/Javascript

Name of the Vulnerable Software and Affected Versions: Caching Compatible Cookie Opt-In and JavaScript versions 0.0.0 through 0.0.10 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS...

PT-2025-5135 · Unknown · Notfound Bauernregeln

Name of the Vulnerable Software and Affected Versions: NotFound Bauernregeln versions 1.0.1 and below Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-5545 · Ip2Location · Ip2Location Country Blocker

Name of the Vulnerable Software and Affected Versions: IP2Location Country Blocker versions prior to 2.38.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS attacks. This means that an attacker can...

PT-2025-5509 · Unknown · Ubc People Lists

Name of the Vulnerable Software and Affected Versions: UBC People Lists versions 1.3.10 and earlier Description: The issue affects UBC People Lists due to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

Important: tomcat9

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

PT-2025-5171 · Unknown · Notfound Custom Page Extensions

Name of the Vulnerable Software and Affected Versions: NotFound Custom Page Extensions versions 0.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables attackers ...

PT-2025-4642 · Unknown · Mdjm Event Management

Name of the Vulnerable Software and Affected Versions: MDJM Event Management versions 1.7.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables an attacker to injec...

PT-2025-2222 · WordPress · Simple Gallery With Filter

Name of the Vulnerable Software and Affected Versions: Simple Gallery with Filter plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'c2tw sgwf' shortcode due to insufficient input sanitization and output...