PT-2025-3104 · Unknown · Vaultwarden

Name of the Vulnerable Software and Affected Versions: Vaultwarden version 1.32.5 Description: The issue is related to an authenticated reflected Cross-Site Scripting XSS vulnerability. This vulnerability is present in the /api/core/mod.rs component. Recommendations: For Vaultwarden version 1.32....

PT-2025-4723 · Unknown · Zephyr Admin Theme

Name of the Vulnerable Software and Affected Versions: Zephyr Admin Theme versions 1.4.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user...

PT-2025-4489 · Mattermost +1 · Mattermost +1

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.x through 10.2 Description: The issue arises from Mattermost's failure to accurately reflect missing settings, leading to confusion among administrators regarding a Calls security-sensitive configuration due to incorrec...

PT-2025-4713 · Unknown · Author Avatars List/Block

Name of the Vulnerable Software and Affected Versions: Author Avatars List/Block versions prior to 2.1.24 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables an attacker to...

PT-2025-2914 · Unknown · Fancy Product Designer

Name of the Vulnerable Software and Affected Versions: Fancy Product Designer versions n/a through 6.4.3 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as a SQL Injection vulnerability. This vulnerability can allow an attacke...

PT-2025-3833 · Unknown · Codezips Project Management System

Name of the Vulnerable Software and Affected Versions: Codezips Project Management System version 1.0 Description: A critical issue has been found in Codezips Project Management System, affecting an unknown part of the file /pages/forms/teacher.php. The manipulation of the argument name leads to...

PT-2025-1918 · WordPress · Yumpu E-Paper

Name of the Vulnerable Software and Affected Versions: Yumpu E-Paper publishing plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode due to insufficient input sanitization and output escaping ...

PT-2025-1041 · Drupal · File Entity

Name of the Vulnerable Software and Affected Versions: File Entity versions 7.X- through 7.X-2.38 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS attacks. This can enable a remote attacker to bypass security...

PT-2025-3842 · Code Projects · Code-Projects Admission Management System

Name of the Vulnerable Software and Affected Versions: code-projects Admission Management System version 1.0 Description: A critical issue has been found in the Login component of the system, specifically in the file index.php. The manipulation of the u id argument leads to SQL injection. This...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Pages Restriction Access versions 2.0.0 through 2.0.3, which stems from the inclusion of an authorization error vulnerability...

PT-2025-4376 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the "/html/funcionario/dependente listar um.php" endpoint, specifically in the id dependente...

PT-2025-3696 · Viwis Lms · Viwis Lms

Name of the Vulnerable Software and Affected Versions: VIWIS LMS version 9.11 Description: A vulnerability has been found in the File Upload component of VIWIS LMS, affecting an unknown functionality. The manipulation of the filename argument leads to cross-site scripting. The attack can be...

PT-2025-2051 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS versions prior to 4.8 Description: A critical issue has been found in SEMCMS, affecting an unknown functionality of the SEMCMS Images.php file in the Image Library Management Page component. This issue leads to a SQL injection. The...

PT-2025-1073

Name of the Vulnerable Software and Affected Versions Junos OS SRX Series versions prior to 21.4R3-S8 Junos OS SRX Series versions 22.2 through 22.2R3-S5 Junos OS SRX Series versions 22.3 through 22.3R3-S3 Junos OS SRX Series versions 22.4 through 22.4R3-S2 Junos OS SRX Series versions 23.2 throu...

PT-2025-2052 · Sucms · Sucms

Name of the Vulnerable Software and Affected Versions: Sucms version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/admin members.php?ac=search. The manipulation of the uid argument leads to SQL injection. The attack may be launched remotely. The exploit h...

PT-2025-1632

Name of the Vulnerable Software and Affected Versions WebinarPress plugin for WordPress versions up to, and including, 1.33.24 Description The WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the sync-import-imgs function and missing...

Vivo MinigameCenter 访问控制错误漏洞

Vivo MinigameCenter is a command line interface for rapid development of Vivo mini-games from the Chinese company Vivo. A security vulnerability exists in Vivo MinigameCenter versions prior to 2.2.4.0, which stems from an insufficient restriction on loading URLs and could lead to partial...

PT-2025-2965

Name of the Vulnerable Software and Affected Versions composio versions 0.5.40 and later Description The issue allows for command execution in composio openai, composio claude, and composio julep via the handle tool calls function. This is due to improper user input sanitization, leading to...

PT-2025-4293 · Unknown · Mzk-Dp300N

Name of the Vulnerable Software and Affected Versions: MZK-DP300N versions 1.05 and earlier Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the logged-in user's web browser when accessing a crafted URL, if an attacker logs in to the affected produc...

WordPress Passster plugin <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Passster versions = 4.2.10...