PT-2025-14060 · Wpquads · Wpquads

Name of the Vulnerable Software and Affected Versions: Ads by WPQuads versions prior to 2.0.87.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for unauthorized access. Recommendations: For...

PT-2025-14388 · Bamboohr · Bamboohr

Name of the Vulnerable Software and Affected Versions: BambooHR Build version 25.0210.170831-83b08dd Description: The issue allows a remote attacker to escalate privileges via the /saml/index.php?r= HTTP GET parameter. This parameter is vulnerable to exploitation, enabling an attacker to gain...

PT-2025-14406 · Wbw · Product Table By Wbw

Name of the Vulnerable Software and Affected Versions: Product Table by WBW versions 2.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-14402

Name of the Vulnerable Software and Affected Versions Small Package Quotes – Worldwide Express Edition versions n/a through 5.2.18 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

PT-2025-14404 · Unknown · Infornweb News & Blog Designer Pack

Name of the Vulnerable Software and Affected Versions: InfornWeb News & Blog Designer Pack versions n/a through 4.0 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local Fil...

PT-2025-14175 · Unknown · Binsaifullah Posten

Name of the Vulnerable Software and Affected Versions: Binsaifullah Posten versions 0.0.0 through 0.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. Recommendations: For versions 0.0.0...

PT-2025-14025 · WordPress · Import Export Suite For Csv/Xml Datafeed

Name of the Vulnerable Software and Affected Versions: Import Export Suite for CSV and XML Datafeed plugin for WordPress versions up to, and including, 7.19 Description: The issue is related to insufficient file path validation in the deleteImage function, allowing authenticated attackers with...

PT-2025-14440 · Elementor · Extensions For Elementor

Name of the Vulnerable Software and Affected Versions: Extensions for Elementor versions 2.0.40 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to be...

PT-2025-14082 · WordPress · Lana Downloads Manager

Name of the Vulnerable Software and Affected Versions: Lana Downloads Manager WordPress plugin versions prior to 1.10.0 Description: The issue concerns the Lana Downloads Manager WordPress plugin, which does not validate user input used in a path. This could allow users with an admin role to...

PT-2025-14064 · Joomsky · Joomsky Js Help Desk

Name of the Vulnerable Software and Affected Versions: JoomSky JS Help Desk versions 2.9.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized SQL commands to be execute...

PT-2025-14153 · WordPress · Photoshelter For Photographers Blog Feed Plugin

Name of the Vulnerable Software and Affected Versions: PhotoShelter for Photographers Blog Feed Plugin versions 1.5.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attack...

PT-2025-14274 · Unknown · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress versions 1.1.28 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2025-14027 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: The Awesome Support – WordPress HelpDesk & Support Plugin versions up to, and including, 6.3.1 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support...

PT-2025-14037 · Unknown · Notfound Flickr Set Slideshows

Name of the Vulnerable Software and Affected Versions: NotFound Flickr set slideshows versions 0.9 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-14428 · Unknown · Vimal Kava Ai Search Bar

Name of the Vulnerable Software and Affected Versions: Vimal Kava AI Search Bar versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the AI Search Bar...

PT-2025-14411 · Unknown · Pages Order

Name of the Vulnerable Software and Affected Versions: Pages Order versions 1.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in NotFound Pages Order. Recommendations:...

PT-2025-14088 · WordPress · The Real Estate 7

Name of the Vulnerable Software and Affected Versions: Real Estate 7 WordPress theme versions up to, and including, 3.5.4 Description: The Real Estate 7 WordPress theme is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file. This mak...

PT-2025-14227 · Unknown · Fbtemplates Nemesis All-In-One

Name of the Vulnerable Software and Affected Versions: fbtemplates Nemesis All-in-One versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attack...

CVE-2025-24221

This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychain data may be accessible from an iOS backup...

CVE-2025-31183

The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data...