PT-2025-26928 · WordPress · Countdown

Name of the Vulnerable Software and Affected Versions: Countdown plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Stored Cross-Site Scripting via the clientId parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-26995

Name of the Vulnerable Software and Affected Versions: Fanwei E-Office versions = 9.4 Description: An unauthenticated file upload issue exists in the web management interface, affecting the "/general/index/UploadFile.php" endpoint. This endpoint improperly validates uploaded files when invoked wi...

PT-2025-26948

Name of the Vulnerable Software and Affected Versions: cloud-init versions through 25.1.2 Description: The issue concerns the systemd socket unit cloud-init-hotplugd.socket in cloud-init, which has a default SocketMode that grants 0666 permissions, making it world-writable. This affects the...

PT-2025-26923 · WordPress · Responsive Food/Drink Menu

Name of the Vulnerable Software and Affected Versions: The Responsive Food and Drink Menu plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's display pdf menus shortcode due to insufficient input sanitization an...

PT-2025-26942 · Unknown · Iroha Board

Name of the Vulnerable Software and Affected Versions: iroha Board versions v0.10.12 and earlier Description: A cross-site request forgery issue exists. If a user accesses a specially crafted URL while logged in to the affected product, arbitrary learning histories may be registered...

PT-2025-26952

Name of the Vulnerable Software and Affected Versions: System Information Reporter SIR versions 1.0.3 and prior Description: A sensitive information exposure issue allows an authenticated non-admin local user to extract sensitive information stored in a registry backup folder. Recommendations: Fo...

PT-2025-26947 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Ultra Addons for Contact Form 7 plugin for WordPress versions 3.5.11 through 3.5.19 Description: The issue is related to Stored Cross-Site Scripting via the Database module due to insufficient input sanitization and output escaping. The...

PT-2025-27422 · D Link · D-Link Di-7300G+

Name of the Vulnerable Software and Affected Versions: D-Link DI-7300G+ version 19.12.25A1 Description: A critical issue has been found in the D-Link DI-7300G+ router, affecting some unknown functionality of the file in proxy client.asp. The manipulation of the proxy srv, proxy lanport, proxy...

PT-2025-26945 · WordPress · Royal Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1024 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping on...

PT-2025-26989 · Xuxueli · Xuxueli Xxl-Sso

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue was found in the software, affecting the /xxl-sso-server/login file. The manipulation of the errorMsg argument leads to cross-site scripting. The attack can be initiated remotely...

PT-2025-27008 · Openmns · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenMNS Horizon versions 33.0.8 through 33.1.5 OpenMNS Meridian versions prior to 2024.2.6 Description: Multiple stored XSS issues were found in OpenMNS Horizon due to unsanitized parameters on different nodes, allowing an attacker to store a...

PT-2025-26981 · Unknown · Labredescefetrj Wegia

Name of the Vulnerable Software and Affected Versions: LabRedesCefetRJ WeGIA version 3.4.0 Description: A vulnerability was found in the Cadastro de Atendio component, specifically in the file /html/atendido/Cadastro Atendido.php. The manipulation of the Nome/Sobrenome argument leads to cross-sit...

PT-2025-27001 · Unknown · Linlinjava Litemall

Name of the Vulnerable Software and Affected Versions: linlinjava litemall version 1.8.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /wx/comment/post. The manipulation of the adminComment argument leads to improper authorization, allowing...

PT-2025-27000 · Xuxueli · Xuxueli Xxl-Sso

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue has been found in the software, affecting the processing of the file /xxl-sso-server/doLogin. The manipulation of the redirect url argument leads to an open redirect. This issue c...

PT-2025-27022 · Unknown · Juzawebcms

Name of the Vulnerable Software and Affected Versions: juzaweb CMS version 3.4.2 Description: A critical vulnerability has been found in juzaweb CMS, affecting an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is...

PT-2025-26876 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue affects the setUpgradeUboot function of the upgrade.so file, allowing os command injection through the manipulation of the FileName argument. This can be exploited remotely...

PT-2025-26866

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: OpenBao is a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The issue allows an attacker to perform unauthenticated, unaudited...

PT-2025-26827 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue was found in the system, affecting the /panel/edit-staff.php file. The manipulation of the editid argument leads to SQL injection. This issue can be exploit...

PT-2025-26873 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue was found, affecting the setUpgradeFW function of the upgrade.so file. The manipulation of the FileName argument leads to os command injection. This issue can be exploited...

PT-2025-26858 · Unknown · Registrator

Name of the Vulnerable Software and Affected Versions: Registrator versions prior to 1.9.5 Description: The issue concerns a GitHub app that automates creation of registration pull requests for julia packages. If the clone URL returned by GitHub is malicious, an argument injection is possible in...