PT-2025-23743 · WordPress · Wp Easy Contact

Name of the Vulnerable Software and Affected Versions: WP Easy Contact plugin for WordPress versions up to, and including, 4.0.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the emd mb me...

CVE-2025-33004

IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction...

PT-2025-23586 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2025-23678

Name of the Vulnerable Software and Affected Versions aaluoxiang oa system versions up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 Description A vulnerability was found in the image function of the UserpanelController.java file, which can lead to path traversal. The attack may be launched remotel...

PT-2025-23568

Name of the Vulnerable Software and Affected Versions Unisoc devices affected versions not specified Description The issue is related to a possible command injection in the engineermode service due to improper input validation. This could lead to local escalation of privilege with no additional...

PT-2025-23616 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: Foxcms version 1.25 Description: The issue is related to a SQL time injection in the installdb.php script, specifically affecting the $ POST'dbname' parameter. This allows for potential exploitation. Recommendations: For Foxcms version 1.25,...

PT-2025-23604 · WordPress · Music Player For Elementor

Name of the Vulnerable Software and Affected Versions: The Music Player for Elementor plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the album b...

PT-2025-23669 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 Description: A bypass of the patch for a previous issue exists, allowing for the construction of a malicious JDBC statement. In a malicious payload, the getUrlType function retrieves the hostName. Since the...

PT-2025-23679 · Unknown · Aaluoxiang Oa System

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 Description: A problematic vulnerability has been found in aaluoxiang oa system, affecting the image function of the file...

PT-2025-23564 · WordPress · The Ninja Tables

Name of the Vulnerable Software and Affected Versions: The Ninja Tables – Easy Data Table Builder plugin for WordPress versions up to, and including, 5.0.18 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the argscallback parameter. This allow...

PT-2025-23590 · Unknown · Bit File Manager

Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-23601 · Baison · Baison Channel Middleware Product

Name of the Vulnerable Software and Affected Versions: Baison Channel Middleware Product version 2.0.1 Description: A critical issue was found in the Baison Channel Middleware Product, affecting an unknown functionality of the file "/e3api/api/main/ToJsonByControlName". The manipulation of the da...

PT-2025-23645 · Unknown · Quequnlong Shiyi-Blog

Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue has been found in quequnlong shiyi-blog, affecting some unknown processing of the file /dev api/app/album/photos/. This leads to improper authorization, and the attack m...

PT-2025-23624 · Unknown · Pekko Management

Name of the Vulnerable Software and Affected Versions: Pekko Management versions prior to 1.1.1 Description: The issue arises when Basic Authentication is enabled in Pekko Management using the Java DSL, potentially causing the authenticator to not be properly applied. This could affect users who...

NetScaler-13.1-Error "Not logged in" is displayed in console or SSH session to NetScaler

You may see error "Not logged in" displayed in the console session to NetScaler and you are not able to run any commands in this console session. Similar issue may also happen with SSH session to NetScaler...

PT-2025-23639

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions up to 1.2.1 Description A critical issue has been discovered, affecting an unknown part of the file /api/file/upload. The manipulation of the file/source argument leads to path traversal. This issue can be...

PT-2025-23603 · WordPress · Profile Builder

Name of the Vulnerable Software and Affected Versions: Profile Builder plugin for WordPress versions up to, and including, 3.13.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the user met...

PT-2025-23677 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.46.0 through 2.1.6 Description: The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks...

PT-2025-23646 · Unknown · Quequnlong Shiyi-Blog

Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper...

PT-2025-23531 · Unknown · Cotonti Siena

Name of the Vulnerable Software and Affected Versions: Cotonti Siena version 0.9.25 Description: A vulnerability has been found in Cotonti Siena. The issue affects the file "/admin.php?m=config&n=edit&o=core&p=title". The manipulation of the value of title leads to cross-site scripting...