PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include syste...

PT-2025-20360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference issue was found in the Linux kernel's cpufreq subsystem, specifically in the apple-soc driver. The apple soc cpufreq get rate function does not check if cpufre...

PT-2025-15316 · WordPress · Streamit

Name of the Vulnerable Software and Affected Versions: Sreamit theme for WordPress versions prior to 4.0.2 Description: The issue is related to insufficient file validation in the st send download file function, allowing authenticated attackers with subscriber-level access or higher to download...

PT-2025-15592

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Office affected versions not specified Microsoft Office Long Term Servicing Channel affected versions not specifi...

PT-2025-15278 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under a comment for an Article. Recommendations: For Typecho...

PT-2025-15292 · Unknown · Xiaozhi-Esp32-Server-Java

Name of the Vulnerable Software and Affected Versions: joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 Description: A critical issue has been found in the software, affecting the update function of the "/api/user/update" API endpoint. The manipulation of the sta...

PT-2025-15219

Name of the Vulnerable Software and Affected Versions code-projects Patient Record Management System version 1.0 Description A critical issue has been found in the code-projects Patient Record Management System. This issue affects an unknown part of the file /dental pending.php. The manipulation ...

PT-2025-15270 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server version 2.0.7 Description: A critical issue affects the CDUP Command Handler component, leading to a buffer overflow. This can be initiated remotely. Recommendations: For PCMan FTP Server version 2.0.7, consider disabling the...

PT-2025-14916 · Unknown · Eleopard Behance Portfolio Manager

Name of the Vulnerable Software and Affected Versions: eleopard Behance Portfolio Manager versions 1.7.4 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-14773 · Unknown · Thu-Pacman Chitu

Name of the Vulnerable Software and Affected Versions: thu-pacman chitu version 0.1.0 Description: A critical vulnerability has been found in thu-pacman chitu. This issue affects the torch.load function in the file chitu/chitu/backend.py. The manipulation of the ckpt path/quant ckpt dir argument...

PT-2025-14628 · Unknown · Project Worlds Online Lawyer Management System

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Lawyer Management System version 1.0 Description: A critical issue has been found, affecting the /single lawyer.php file. The manipulation of the u id argument leads to SQL injection. This issue can be exploited remotely...

PT-2025-14624 · Unknown · Project Worlds Online Lawyer Management System

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Lawyer Management System version 1.0 Description: A critical issue has been found in the processing of the file /lawyer booking.php, where the manipulation of the unblock id argument leads to sql injection. This issue ca...

PT-2025-14731 · Unknown · Minimalistic Event Manager

Name of the Vulnerable Software and Affected Versions: Minimalistic Event Manager versions 1.1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 1.1...

PT-2025-14745 · WordPress · Getbookingswp

Name of the Vulnerable Software and Affected Versions: GetBookingsWP versions 1.1.27 and earlier Description: The issue is related to a Missing Authorization vulnerability in the GetBookingsWP plugin, which allows exploitation of incorrectly configured access control security levels...

PT-2025-14720 · Unknown · Docxpresso

Name of the Vulnerable Software and Affected Versions: Docxpresso versions n/a through 2.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows Absolute Path Traversal in Docxpresso. Recommendations: For...

PT-2025-14543 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: A SQL injection vulnerability was discovered in OS4ED openSIS via the table parameter at "/attendance/AttendanceCodes.php". The remote, authenticated attacker requires the admin role to...

PT-2025-14062

Name of the Vulnerable Software and Affected Versions JoomSky JS Help Desk versions n/a through 2.9.2 Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For versions n/a through...

PT-2025-14378 · Infinxt · Infinxt Iedge 100

Name of the Vulnerable Software and Affected Versions: Infinxt iEdge 100 version 2.1.32 Description: An OS Command Injection issue exists in the Troubleshoot module, specifically in the tracertVal parameter of the Tracert function. Recommendations: For Infinxt iEdge 100 version 2.1.32, consider...

PT-2025-14419 · Shopper · Shopper

Name of the Vulnerable Software and Affected Versions: Shopper versions n/a through 3.2.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This could allow unauthorized database access, potentially...

PT-2025-13102 · Wpcafe · Wpcafe

Name of the Vulnerable Software and Affected Versions: WPCafe versions 2.2.31 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a...