PT-2025-23743 · WordPress · Wp Easy Contact

Name of the Vulnerable Software and Affected Versions: WP Easy Contact plugin for WordPress versions up to, and including, 4.0.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the emd mb me...

PT-2025-23870 · Unknown · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue was found in the PHPGurukul Online Fire Reporting System. This issue affects the file /admin/edit-team.php and is related to the manipulation of the teamid...

PT-2025-23848 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue allows a remote attacker to escalate privileges via the "/students/edit/id" endpoint. Recommendations: For Unifiedtransform version 2.0, as a temporary workaround, consider restricting acces...

PT-2025-23735 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A critical issue has been found in the PHPGurukul Rail Pass Management System, affecting some unknown functionality of the file /admin/pass-bwdates-reports-details.php. The...

PT-2025-23761 · WordPress · Filterprovider

Name of the Vulnerable Software and Affected Versions: File Provider versions 1.2.3 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via ...

PT-2025-23882 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 versions up to 15.03.06.47 Description: A critical issue was found in the HTTP Handler component, specifically affecting the formSetPPTPServer function of the /goform/SetPptpServerCfg file. The manipulation of the startIp and endIp...

CVE-2025-33004

IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction...

PT-2025-23568

Name of the Vulnerable Software and Affected Versions Unisoc devices affected versions not specified Description The issue is related to a possible command injection in the engineermode service due to improper input validation. This could lead to local escalation of privilege with no additional...

PT-2025-23604 · WordPress · Music Player For Elementor

Name of the Vulnerable Software and Affected Versions: The Music Player for Elementor plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the album b...

PT-2025-23616 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: Foxcms version 1.25 Description: The issue is related to a SQL time injection in the installdb.php script, specifically affecting the $ POST'dbname' parameter. This allows for potential exploitation. Recommendations: For Foxcms version 1.25,...

PT-2025-23586 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2025-23678

Name of the Vulnerable Software and Affected Versions aaluoxiang oa system versions up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 Description A vulnerability was found in the image function of the UserpanelController.java file, which can lead to path traversal. The attack may be launched remotel...

PT-2025-23564 · WordPress · The Ninja Tables

Name of the Vulnerable Software and Affected Versions: The Ninja Tables – Easy Data Table Builder plugin for WordPress versions up to, and including, 5.0.18 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the argscallback parameter. This allow...

PT-2025-23669 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 Description: A bypass of the patch for a previous issue exists, allowing for the construction of a malicious JDBC statement. In a malicious payload, the getUrlType function retrieves the hostName. Since the...

PT-2025-23590 · Unknown · Bit File Manager

Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-23679 · Unknown · Aaluoxiang Oa System

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 Description: A problematic vulnerability has been found in aaluoxiang oa system, affecting the image function of the file...

PT-2025-23624 · Unknown · Pekko Management

Name of the Vulnerable Software and Affected Versions: Pekko Management versions prior to 1.1.1 Description: The issue arises when Basic Authentication is enabled in Pekko Management using the Java DSL, potentially causing the authenticator to not be properly applied. This could affect users who...

PT-2025-23646 · Unknown · Quequnlong Shiyi-Blog

Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper...

PT-2025-23645 · Unknown · Quequnlong Shiyi-Blog

Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue has been found in quequnlong shiyi-blog, affecting some unknown processing of the file /dev api/app/album/photos/. This leads to improper authorization, and the attack m...

PT-2025-23677 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.46.0 through 2.1.6 Description: The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks...