PT-2025-21618 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.4-00 Description: The issue is related to a Missing Authorization vulnerability in the Hitachi Ops Center Analyzer detail view component. This vulnerability affects the specified...

PT-2025-21602 · Code Projects · Employee Records System

Name of the Vulnerable Software and Affected Versions: code-projects Employee Record System version 1.0 Description: A problematic issue has been found in the Employee Record System, affecting some unknown functionality of the file dashboardedit employee.php. The manipulation of the arguments...

The vulnerability of the Enable API Endpoints configuration of the ThinServer component on the Rockwell Automation ThinManager centralized application management platform allows a malicious individual to read arbitrary files.

The vulnerability of the Enable API Endpoints configuration of the ThinServer component of Rockwell Automation’s ThinManager centralized application management platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a...

CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8031

The CVE-2024-8031 vulnerability affects the Secure Downloads WordPress plugin (versions before 1.2.3). Root cause: the plugin does not properly restrict which files can be downloaded, enabling authenticated attackers with admin-level access to download arbitrary files (e.g., wp-config.php). Impac...

PT-2025-21571 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /pages/customer add.php. The manipulation of the last argument leads to SQL injection...

CVE-2025-48050

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script...

PT-2025-21578 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue was found in the itsourcecode Placement Management System, affecting an unknown functionality of the file /all student.php. The manipulation of the delete...

PT-2025-21525 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.9.0 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.9.0 do not properly sanitise and escape some of its settings. This could allow...

PT-2025-21453 · WordPress · Ditty

Name of the Vulnerable Software and Affected Versions: Ditty WordPress plugin versions prior to 3.1.52 Description: The issue concerns the Ditty WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as authors, to perform...

PT-2025-21579 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue has been found in the itsourcecode Placement Management System, affecting some unknown functionality of the file /student profile.php. The manipulation of the ...

PT-2025-21534 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.6 Description: The issue arises from the plugin's failure to properly sanitise and escape certain parameters when they are displayed on the page. This oversight could allow unauthenticated...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

PT-2025-21367 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro versions prior to 2.5.10 Description: The issue is related to a file upload vulnerability in the store.php component, which fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validatio...

PT-2025-21261 · Unknown · Uipress Lite

Name of the Vulnerable Software and Affected Versions: UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress versions up to, and including, 3.5.07 Description: The issue is related to Remote Code Execution in the UiPress lite plugin for WordPress. This is due to...

PT-2025-21573 · Sourcecodester · Sourcecodester Student Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Result Management System version 1.0 Description: A critical issue was found in the system, affecting the file academic/core/drop student.php. The manipulation of the img argument leads to path traversal. This issue can...

PT-2025-21330 · Unknown · Phpgurukul Vehicle Parking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Parking Management System version 1.13 Description: A critical issue was found in the PHPGurukul Vehicle Parking Management System. The problem affects the file /admin/view-incomingvehicle-detail.php, where the manipulation...

PT-2025-21356 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been discovered, affecting the /pages/account summary.php file. The manipulation of the cid argument leads to SQL injection. This issue can be exploited...

PT-2025-21380 · WordPress · Wp-Reply Notify

Name of the Vulnerable Software and Affected Versions: WP-Reply Notify WordPress plugin versions 1.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21265 · WordPress · Responsive Lightbox & Gallery

Name of the Vulnerable Software and Affected Versions: Responsive Lightbox & Gallery WordPress plugin versions prior to 2.5.1 Description: The issue concerns a Stored Cross-Site Scripting attack. Users with the contributor role and above can exploit this due to the plugin's failure to validate an...