PT-2025-29542 · WordPress · Restrict File Access

Name of the Vulnerable Software and Affected Versions: Restrict File Access plugin for WordPress versions up to and including 1.1.2 Description: The Restrict File Access plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2025-29578 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.38 10.3.30 Description: A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the share name parameter. Recommendations: Apply update...

PT-2025-30062 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in the formWebTypeLibrary function within the /goform/webtypelibrary file. Manipulation of the webSiteId argument can lead to a stack-based buffer overflow, allowing for remote...

PT-2025-29470 · Code Projects · Electricity Billing System

Name of the Vulnerable Software and Affected Versions: code-projects Electricity Billing System version 1.0 Description: A critical issue exists in code-projects Electricity Billing System version 1.0. The vulnerability is due to a SQL injection flaw within the /user/change password.php file...

PT-2025-29472 · Code Projects · Mobile Shop

Name of the Vulnerable Software and Affected Versions: code-projects Mobile Shop version 1.0 Description: A critical issue exists in code-projects Mobile Shop 1.0, affecting unknown code within the /login.php file. The email parameter is susceptible to SQL injection, allowing for remote...

The vulnerability of the graphical SFTP and SCP client for the Windows operating system, WinSCP, arises from incorrect path name restrictions for access-controlled directories. This allows attackers to create a special file and control its path on a remote server.

The vulnerability of the graphical SFTP and SCP client programs for the Windows operating system is related to incorrect path name restrictions for access to restricted directories. Exploiting this vulnerability allows an attacker to create a special file and control its path on a remote server...

The vulnerability of the PHP Snappy library relates to incorrect restrictions on the path to the restricted directory. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the PHP Snappy library is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to local files and directories on the server when...

PT-2025-29434 · Phpgurukul · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue exists in PHPGurukul Online Fire Reporting System version 1.2 related to SQL injection. The vulnerability is located in the processing of the /admin/add-team.ph...

PT-2025-29449 · Code Projects · Job Diary

Name of the Vulnerable Software and Affected Versions: code-projects Job Diary version 1.0 Description: A critical issue exists in code-projects Job Diary 1.0. The manipulation of the ID argument in the /view-emp.php file leads to a SQL injection. The attack can be initiated remotely, and the...

PT-2025-29496 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the ID parameter at the SEMCMS Link.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Link.php fil...

PT-2025-29511

Name of the Vulnerable Software and Affected Versions: Indico versions 2.2 through 3.3.7 Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. An endpoint used to display details of users listed in certain fields could be...

PT-2025-29464 · Avl Rooms · Avl Rooms

Name of the Vulnerable Software and Affected Versions: AVL Rooms version 1.0 Description: A critical issue exists in AVL Rooms that allows for SQL injection. The vulnerability is located in the /city.php file, where manipulation of the city argument can trigger the attack remotely. The exploit fo...

PT-2025-29497 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection issue via the lgid parameter at the SEMCMS Link.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Link.php file to...

PT-2025-29495 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability. The vulnerability is located in the pid parameter at the SEMCMS Quanxian.php file. Recommendations: As a mitigation, restrict access to the SEMCMS...

PT-2025-29492 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection issue via the pid parameter at the SEMCMS Categories.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Categories.php fi...

PT-2025-29406 · Phpgurukul · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue exists in PHPGurukul Online Fire Reporting System 1.2. The vulnerability is due to a SQL injection within the /admin/workin-progress-requests.php file...

PT-2025-29473 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 Description: A critical issue exists in TOTOLINK T6 version 4.1.5cu.748. The vulnerability is located within the CloudSrvVersionCheck function of the /cgi-bin/cstecgi.cgi file, part of the HTTP POST Request...

PT-2025-29386 · Code Projects · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: code-projects Online Appointment Booking System version 1.0 Description: A critical issue exists in code-projects Online Appointment Booking System. The vulnerability is located in the /get town.php file and involves SQL injection through...

The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

PT-2025-29475 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 Description: A critical vulnerability exists in the HTTP POST Request Handler component of TOTOLINK T6. The vulnerability is due to command injection in the clearPairCfg function within the /cgi-bin/cstecgi.cgi...