PT-2025-33709

Name of the Vulnerable Software and Affected Versions: Real Spaces - WordPress Properties Directory Theme versions prior to 3.7 Description: The Real Spaces - WordPress Properties Directory Theme for WordPress is susceptible to privilege escalation through the imic agent register function. This...

CVE-2025-53192

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities...

PT-2025-33693 · Apache +1 · Apache Commons Ognl +1

Name of the Vulnerable Software and Affected Versions: Apache Commons OGNL affected versions not specified Description: An improper neutralization of expression/command delimiters issue exists in Apache Commons OGNL. The OGNL engine, when used with the Ognl.getValue API, parses and evaluates...

PT-2025-33422

Name of the Vulnerable Software and Affected Versions: Online Medicine Guide version 1.0 Description: A SQL injection issue exists in Online Medicine Guide 1.0. The manipulation of the Search parameter in the /browsemdcn.php file allows for remote exploitation. The exploit for this issue has been...

PT-2025-33351 · Itsourcecode · Itsourcecode Online Tour/Travel Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Tour and Travel Management System version 1.0 Description: A SQL injection issue exists in itsourcecode Online Tour and Travel Management System version 1.0. The vulnerability is located in the /admin/operations/booking.ph...

PT-2025-33132 · Projectworlds · Visitor Management System

Name of the Vulnerable Software and Affected Versions: projectworlds Visitor Management System version 1.0 Description: A vulnerability was determined in projectworlds Visitor Management System 1.0. The manipulation of the argument rid in the file /front.php leads to SQL injection. The attack can...

PT-2025-33416 · Sourcecodester · Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A SQL injection issue exists in an unknown functionality of the file /profile.php. Manipulation of the mobilenumber argument can lead to SQL injection, allowing for...

PT-2025-33073 · Sourcecodester · Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A SQL injection issue exists in the SourceCodester COVID 19 Testing Management System. The Username parameter in the /login.php API endpoint is susceptible to...

PT-2025-33016 · Totolink · Totolink A7000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R firmware version 9.1.0u.6115 B20201022 Description: An attacker can bypass login by sending a specific request through the formLoginAuth.htm endpoint. Recommendations: Apply a configuration change to restrict access to the...

PT-2025-32378 · Unknown · Easy Hosting Control Panel

Name of the Vulnerable Software and Affected Versions: Easy Hosting Control Panel EHCP version 20.04.1.b Description: The Easy Hosting Control Panel EHCP contains a SQL injection issue via the id parameter in the Change Settings function. Recommendations: As a temporary workaround, consider...

PT-2025-32359 · Unknown · Statamic Core

Name of the Vulnerable Software and Affected Versions: Statamic Core versions prior to 2.11.8 Description: The /users endpoint is susceptible to cross-site scripting XSS, potentially allowing an attacker to add an administrator user. Exploitation can occur through Cross-Site Request Forgery CSRF...

PT-2025-32354 · Mobile Industrial Robots · Mobile Industrial Robots

Name of the Vulnerable Software and Affected Versions: Mobile Industrial Robots MiR versions prior to 3.0.0 Description: A path traversal vulnerability exists in an API endpoint within Mobile Industrial Robots MiR software. Authenticated users can extract files from the robot file system by...

PT-2025-32495 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 versions up to 20250801 Description: A vulnerability exists in Linksys range extenders that allows for remote OS command injection. The issue is related to the setDFSSetting function...

PT-2025-32501 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 versions up to 20250801 Description: A vulnerability exists in Linksys range extenders that allows for remote operating system command injection. The vulnerability is located in the...

PT-2025-32518 · Linksys · Linksys Re7000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 versions up to 20250801 Description: A vulnerability exists in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000. The issue is due to os command injection in the sub 3517C...

PT-2025-32517 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 versions up to 20250801 Description: A vulnerability exists in Linksys range extenders that allows for remote OS command injection. The issue is located in the um red function within t...

PT-2025-30339 · Dippy · Dippy

Name of the Vulnerable Software and Affected Versions: Dippy version 2 Description: An Insecure Direct Object Reference IDOR vulnerability exists in Dippy that allows attackers to gain sensitive information. The vulnerability is present in the conversation history API endpoint and is exploitable...

PT-2025-29982 · Code Projects · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: code-projects Online Appointment Booking System version 1.0 Description: A critical vulnerability exists in code-projects Online Appointment Booking System 1.0. The issue is a SQL injection vulnerability stemming from the manipulation of the...

Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

PT-2025-29493 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the pid parameter at the SEMCMS ct.php endpoint. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS ct.php...