PT-2025-26493 · Totolink · Totolink X15

Name of the Vulnerable Software and Affected Versions: TOTOLINK X15 version 1.0.0-B20230714.1105 Description: A critical vulnerability was found in the HTTP POST Request Handler component of TOTOLINK X15. The issue affects an unknown function of the file /boafrm/formIPv6Addr. The manipulation of...

PT-2025-25541 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System version 6.2.0 Description: A critical issue was found in the API component, specifically affecting an unknown part of the /IntraFieldVehicle/Search file. The manipulation of the Value argument leads to SQL...

PT-2025-25543 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System versions 6.2.0 Description: A critical issue affects the /vehicle/search API endpoint of the component, where manipulation of the vehicleTypeCode argument leads to SQL injection. The attack can be initiated...

PT-2025-25552 · Unknown · Code-Projects Restaurant Order System

Name of the Vulnerable Software and Affected Versions: code-projects Restaurant Order System version 1.0 Description: A critical vulnerability was found in the code-projects Restaurant Order System. This issue affects an unknown part of the file /table.php. The manipulation of the ID argument lea...

PT-2025-25593

Name of the Vulnerable Software and Affected Versions GNU ncurses versions up to 6.5-20250322 Description A stack-based buffer overflow issue has been identified, affecting the postprocess termcap function in the tinfo/parse entry.c file. This issue can be exploited locally. Recommendations For G...

PT-2025-25579 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /insertagent.php. The manipulation of the agent id argument leads to SQL...

PT-2025-25563 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A vulnerability was found in the PHPGurukul Rail Pass Management System. The issue affects an unknown functionality of the file /contact.php. The manipulation of the Name argumen...

PT-2025-25506 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FoxCMS versions 1.2.5 and earlier Description: A critical issue has been found in FoxCMS, affecting the batchCope function of the file app/admin/controller/Download.php. The manipulation of the ids argument leads to SQL injection. The attack...

PT-2025-25502 · Comfyui · Comfyui

Name of the Vulnerable Software and Affected Versions: comfyanonymous comfyui versions up to 0.3.39 Description: A vulnerability was found in the file /upload/image of the component, allowing for cross-site scripting through the manipulation of the image argument. This issue can be exploited...

PT-2025-25496

Name of the Vulnerable Software and Affected Versions Astun Technology iShare Maps version 5.4.0 Description A problematic issue has been identified, affecting the file atCheckJS.aspx. The manipulation of the ref argument leads to an open redirect. This issue can be initiated remotely...

CVE-2025-6070

CVE-2025-6070 (Restrict File Access plugin for WordPress) is a directory traversal vulnerability (via output()) exploitable by authenticated users with Subscriber+ privileges to read arbitrary server files on all versions up to 1.1.2. The connected documents confirm the attack vector is local fil...

PT-2025-25457 · WordPress · File Manager Pro – Filester

Name of the Vulnerable Software and Affected Versions: File Manager Pro – Filester plugin for WordPress versions 1.8.8 and earlier Description: The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible...

PT-2025-25484 · WordPress · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Name of the Vulnerable Software and Affected Versions: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress versions up to, and including, 1.6.8.30 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizatio...

PT-2025-25478 · WordPress · Kk Youtube Video

Name of the Vulnerable Software and Affected Versions: kk Youtube Video plugin for WordPress versions up to, and including, 0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode due to insufficient input sanitization and output escaping on...

XWiki allows remote code execution through preview of XClass changes in AWM editor

Impact Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. The detailed reproduction steps can be found in the original bug report. Patches This...

CVE-2025-4230

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this...

PT-2025-25409

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7866 B2022506 Description A Buffer Overflow issue allows a remote attacker to execute arbitrary code via the UPLOAD FILENAME component. This enables remote code execution. Recommendations For TOTOLINK N600R versi...

PT-2025-25369 · WordPress · Irm Newsroom

Name of the Vulnerable Software and Affected Versions: IRM Newsroom plugin for WordPress versions 1.2.17 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode due to insufficient input sanitization and output escaping on user-suppli...

PT-2025-25414 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue allows attackers to execute a directory traversal in the "/script-api/scripts/" endpoint. Recommendations: For OpenC3 COSMOS version 6.0.0, consider restricting access to the...

PT-2025-25371 · WordPress · Irm Newsroom

Name of the Vulnerable Software and Affected Versions: IRM Newsroom plugin for WordPress versions up to, and including, 1.2.17 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode due to insufficient input sanitization and output escaping o...