PT-2025-14462 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The endpoint "/zabbix.php?action=export.valuemaps" suffers from a Cross-Site Scripting issue via the backurl parameter. This is caused by the reflection of user-supplied data without...

PT-2025-14375 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: A low privilege Zabbix user with API access can use a SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

PT-2025-14060 · Wpquads · Wpquads

Name of the Vulnerable Software and Affected Versions: Ads by WPQuads versions prior to 2.0.87.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for unauthorized access. Recommendations: For...

PT-2025-14402

Name of the Vulnerable Software and Affected Versions Small Package Quotes – Worldwide Express Edition versions n/a through 5.2.18 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

PT-2025-14406 · Wbw · Product Table By Wbw

Name of the Vulnerable Software and Affected Versions: Product Table by WBW versions 2.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-14404 · Unknown · Infornweb News & Blog Designer Pack

Name of the Vulnerable Software and Affected Versions: InfornWeb News & Blog Designer Pack versions n/a through 4.0 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local Fil...

PT-2025-14175 · Unknown · Binsaifullah Posten

Name of the Vulnerable Software and Affected Versions: Binsaifullah Posten versions 0.0.0 through 0.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. Recommendations: For versions 0.0.0...

PT-2025-14388 · Bamboohr · Bamboohr

Name of the Vulnerable Software and Affected Versions: BambooHR Build version 25.0210.170831-83b08dd Description: The issue allows a remote attacker to escalate privileges via the /saml/index.php?r= HTTP GET parameter. This parameter is vulnerable to exploitation, enabling an attacker to gain...

PT-2025-14025 · WordPress · Import Export Suite For Csv/Xml Datafeed

Name of the Vulnerable Software and Affected Versions: Import Export Suite for CSV and XML Datafeed plugin for WordPress versions up to, and including, 7.19 Description: The issue is related to insufficient file path validation in the deleteImage function, allowing authenticated attackers with...

PT-2025-14440 · Elementor · Extensions For Elementor

Name of the Vulnerable Software and Affected Versions: Extensions for Elementor versions 2.0.40 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to be...

PT-2025-14082 · WordPress · Lana Downloads Manager

Name of the Vulnerable Software and Affected Versions: Lana Downloads Manager WordPress plugin versions prior to 1.10.0 Description: The issue concerns the Lana Downloads Manager WordPress plugin, which does not validate user input used in a path. This could allow users with an admin role to...

PT-2025-14064 · Joomsky · Joomsky Js Help Desk

Name of the Vulnerable Software and Affected Versions: JoomSky JS Help Desk versions 2.9.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized SQL commands to be execute...

PT-2025-14153 · WordPress · Photoshelter For Photographers Blog Feed Plugin

Name of the Vulnerable Software and Affected Versions: PhotoShelter for Photographers Blog Feed Plugin versions 1.5.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attack...

PT-2025-14274 · Unknown · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress versions 1.1.28 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2025-14027 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: The Awesome Support – WordPress HelpDesk & Support Plugin versions up to, and including, 6.3.1 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support...

PT-2025-14037 · Unknown · Notfound Flickr Set Slideshows

Name of the Vulnerable Software and Affected Versions: NotFound Flickr set slideshows versions 0.9 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-14428 · Unknown · Vimal Kava Ai Search Bar

Name of the Vulnerable Software and Affected Versions: Vimal Kava AI Search Bar versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the AI Search Bar...

PT-2025-14411 · Unknown · Pages Order

Name of the Vulnerable Software and Affected Versions: Pages Order versions 1.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in NotFound Pages Order. Recommendations:...

PT-2025-14088 · WordPress · The Real Estate 7

Name of the Vulnerable Software and Affected Versions: Real Estate 7 WordPress theme versions up to, and including, 3.5.4 Description: The Real Estate 7 WordPress theme is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file. This mak...

PT-2025-14227 · Unknown · Fbtemplates Nemesis All-In-One

Name of the Vulnerable Software and Affected Versions: fbtemplates Nemesis All-in-One versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attack...