PT-2025-20286

Name of the Vulnerable Software and Affected Versions: Dropbear SSH versions prior to 2025.88 Description: The issue allows command injection via an untrusted hostname argument, because a shell is used. This occurs when the dbclient in Dropbear SSH is used with an untrusted hostname...

PT-2025-20118 · Unknown · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks versions n/a through 3.2.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS attacks. Recommendations: For...

PT-2025-20095 · Unknown · Solace Extra

Name of the Vulnerable Software and Affected Versions: Solace Extra versions 1.3.1 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentially trick the server into making...

PT-2025-20170 · Unknown · Really Simple Under Construction Page

Name of the Vulnerable Software and Affected Versions: Really Simple Under Construction Page versions 1.4.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-20152 · Woocommerce · Pdf Invoices For Woocommerce + Drag/Drop Template Builder

Name of the Vulnerable Software and Affected Versions: PDF Invoices for WooCommerce + Drag and Drop Template Builder versions through 5.3.8 Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allow...

PT-2025-19915 · WordPress · Multiple Post Type Order

Name of the Vulnerable Software and Affected Versions: Multiple Post Type Order plugin for WordPress versions up to and including 1.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-20299 · Q2Apro · Q2Apro

Name of the Vulnerable Software and Affected Versions: q2apro q2apro-on-site-notifications versions up to 1.4.6 Description: A problematic issue was found, affecting the process request function of the file q2apro-onsitenotifications-page.php. This leads to cross-site scripting and can be initiat...

PT-2025-19914

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.24.3 Description The issue is related to Stored Cross-Site Scripting via the highlights functionality due to insufficient input sanitization and output escaping...

PT-2025-20316 · I-Educar · I-Educar

Name of the Vulnerable Software and Affected Versions: i-Educar version 2.9 Description: i-Educar is free, fully online school management software. The application fails to properly validate and sanitize user-supplied input, leading to a stored cross-site scripting issue that resides within the...

PT-2025-20036 · Unknown · Keymaster Trustlet

Name of the Vulnerable Software and Affected Versions: Keymaster trustlet versions prior to SMR May-2025 Release 1 Description: The issue is an out-of-bounds write in the Keymaster trustlet, allowing local privileged attackers to write out-of-bounds memory. This can be exploited by local privileg...

PT-2025-20043 · Unknown · Unifiedwfc

Name of the Vulnerable Software and Affected Versions: UnifiedWFC versions prior to SMR May-2025 Release 1 Description: The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to manipulate VoWiFi related behaviors. This could potentially be...

PT-2025-20039 · Unknown · Enrichedcall

Name of the Vulnerable Software and Affected Versions: EnrichedCall versions prior to SMR May-2025 Release 1 Description: The issue concerns the use of implicit intent for sensitive communication in EnrichedCall, allowing local attackers to access sensitive information. User interaction is requir...

PT-2025-20031 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions through 1.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in BOINC Server. Recommendations: For BOI...

Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

The Restrict route by IP module provides an interface to manage route restriction by IP address. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that you need to know the route machine name...

Ensure That a Common User Cannot Use pkexec for Privilege Escalation

The pkexec command enables a common user to have the permissions of the superuser or other users. After the authentication is successful, the common user runs the corresponding program with the permissions of the superuser. The pkexec command provides a convenient way for users to change their...

PT-2025-20021 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: A heap-based buffer overflow in RT-Labs P-Net allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. Recommendations: For RT-Labs P-Net...

PT-2025-20019 · Libplctag · Libplctag

Name of the Vulnerable Software and Affected Versions: libplctag versions 2.0 through 2.6.3 Description: The issue is related to an Out-of-bounds Read in the unpack response function, located in conn.c, which allows Overread Buffers via the network. This can be exploited to potentially access...

Gitlab -- vulnerabilities

Gitlab reports: Partial Bypass for Device OAuth flow using Cross Window Forgery Denial of service by abusing Github import API Group IP restriction bypass allows disclosing issue title of restricted project...

PT-2025-19962 · Mrdoc · Mrdoc

Name of the Vulnerable Software and Affected Versions: MrDoc versions 0.95 and before Description: The issue is related to Server-Side Request Forgery SSRF in the validate url function of the app doc/utils.py file. This allows for potential exploitation. Recommendations: For MrDoc versions 0.95 a...

PT-2025-19824 · WordPress · Reales Wp Stpt

Name of the Vulnerable Software and Affected Versions: Reales WP STPT plugin for WordPress versions up to and including 2.1.2 Description: The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as the password. This allows authenticat...