PT-2025-13795 · Digital China · Dcme-520

Name of the Vulnerable Software and Affected Versions: Digital China DCME-520 up to 20250320 Description: A critical issue has been found in the processing of the file /usr/local/WWW/function/audit/newstatistics/mon merge stat hist.php. The manipulation of the type name argument leads to os comma...

PT-2025-13796 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3 Description: The issue concerns reflected cross-site scripting XSS in the AJAX Script interface, specifically in the layout listitems ajax.php file via the target parameter. This allows for potential XSS attack...

PT-2025-13710 · Unknown · Wphocus My Auctions Allegro

Name of the Vulnerable Software and Affected Versions: wphocus My auctions allegro versions 3.6.20 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the wphocus My auctions allegro software. This type of vulnerabilit...

PT-2025-14778

Name of the Vulnerable Software and Affected Versions XZ Utils versions 5.3.3alpha through 5.8.0 Description The multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null...

PT-2025-13802

Name of the Vulnerable Software and Affected Versions Xorcom CompletePBX versions prior to 5.2.35 Description The issue affects the administrator Task Scheduler functionality, allowing attackers to execute arbitrary commands as the root user. Recommendations For versions prior to 5.2.35, update t...

PT-2025-13622 · Unknown · Bluestar Micro Mall

Name of the Vulnerable Software and Affected Versions: Bluestar Micro Mall version 1.0 Description: A critical vulnerability was found in Bluestar Micro Mall, affecting an unknown functionality of the file "/api/api.php?mod=upload&type=1". The manipulation of the File argument leads to unrestrict...

CVE-2025-2713 Improper File Permission Handling in Google gVisor runsc

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork...

PT-2025-13586 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: The issue concerns Command Injection in the /bin/boa executable via the bandstr variable. This allows for potential execution of arbitrary commands. Recommendations: For TOTOLINK A3002...

PT-2025-13582 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2025.1000.4047 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. This vulnerability can be exploited via the Add Article feature. Recommendations: For maccms10 version 2025.1000.4047, as a...

PT-2025-13580 · Unknown · Sourcecodester Online Exam System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Exam System version 1.0 Description: The issue is related to SQL Injection via the dash.php file. This allows for potential exploitation. Recommendations: For Sourcecodester Online Exam System version 1.0, consider...

PT-2025-13589 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO version 6.4.0 Description: The issue is related to Server-Side Request Forgery SSRF in the Email Settings. This means an attacker could potentially forge requests from the server, leading to unauthorized access to internal systems or...

PT-2025-13598 · WordPress · Soj Soundslides

Name of the Vulnerable Software and Affected Versions: SoJ SoundSlides plugin for WordPress version 1.2.2 and earlier Description: The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj soundslides options subpanel function...

PT-2025-19963 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was found in the runtime.InternetConnection function. Recommendations: For version 1.1.0.26, consider restricting access to the runtime.InternetConnection function until a...

PT-2025-13036

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 4.1.2 Description The issue concerns a privilege escalation problem in the User Registration & Membership WordPress plugin. This problem allows unauthenticated users to gain adm...

PT-2025-13085 · Smackcoders · Smackcoders Lead Form Data Collection To Crm

Name of the Vulnerable Software and Affected Versions: smackcoders Lead Form Data Collection to CRM versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, which allows Blind S...

PT-2025-13060 · Wpguppy · Wpguppy

Name of the Vulnerable Software and Affected Versions: WPGuppy versions 1.1.3 and earlier Description: The issue is related to an SQL Injection vulnerability, which allows attackers to exploit the system. This is due to the improper neutralization of special elements used in an SQL command...

PT-2025-13426 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13385 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A SQL Injection issue was identified in the "/WeGIA/html/socio/sistema/controller/query geracao auto.php" endpoint, specifically in the query parameter. This issue allows the execution of arbitrary S...

PT-2025-13241 · Code Projects · Payroll Management System

Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue was found in the Payroll Management System. The problem affects an unknown functionality of the file update employee.php. The manipulation of the emp type...

The vulnerability of the N-able N-central monitoring and management platform for IT infrastructure lies in the incorrect restriction on the path name to the catalog, allowing attackers to read arbitrary files.

The vulnerability of the N-able N-central monitoring and management platform relates to an incorrect limitation on the path name for the /WEB-INF directory in the Apache Tomcat application. Exploiting this vulnerability allows a malicious actor to read arbitrary files...