PT-2025-13589 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO version 6.4.0 Description: The issue is related to Server-Side Request Forgery SSRF in the Email Settings. This means an attacker could potentially forge requests from the server, leading to unauthorized access to internal systems or...

PT-2025-19963 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was found in the runtime.InternetConnection function. Recommendations: For version 1.1.0.26, consider restricting access to the runtime.InternetConnection function until a...

PT-2025-13036

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 4.1.2 Description The issue concerns a privilege escalation problem in the User Registration & Membership WordPress plugin. This problem allows unauthenticated users to gain adm...

PT-2025-13085 · Smackcoders · Smackcoders Lead Form Data Collection To Crm

Name of the Vulnerable Software and Affected Versions: smackcoders Lead Form Data Collection to CRM versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, which allows Blind S...

PT-2025-13060 · Wpguppy · Wpguppy

Name of the Vulnerable Software and Affected Versions: WPGuppy versions 1.1.3 and earlier Description: The issue is related to an SQL Injection vulnerability, which allows attackers to exploit the system. This is due to the improper neutralization of special elements used in an SQL command...

PT-2025-13241 · Code Projects · Payroll Management System

Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue was found in the Payroll Management System. The problem affects an unknown functionality of the file update employee.php. The manipulation of the emp type...

PT-2025-13426 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.4 and prior Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This could allow a low-privileged attacker with local access to...

PT-2025-13385 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A SQL Injection issue was identified in the "/WeGIA/html/socio/sistema/controller/query geracao auto.php" endpoint, specifically in the query parameter. This issue allows the execution of arbitrary S...

The vulnerability of the N-able N-central monitoring and management platform for IT infrastructure lies in the incorrect restriction on the path name to the catalog, allowing attackers to read arbitrary files.

The vulnerability of the N-able N-central monitoring and management platform relates to an incorrect limitation on the path name for the /WEB-INF directory in the Apache Tomcat application. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 4.2.0 Vulnerability Details CVEID:CVE-2022-36227 DESCRIPTION: libarchive s vulnerable to a denial of service, caused by a NULL pointer dereference flaw due to not check for an error after calling calloc function...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 4.1.1 Vulnerability Details CVEID:CVE-2023-26920 DESCRIPTION: Natural Intelligence fast-xml-parser could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in t...

The vulnerability of the `include` function in the Web Directory Free plugin of the WordPress content management system arises from an incorrect limitation on the path to the restricted catalog. This allows attackers to execute arbitrary code.

The vulnerability of the include function in the Web Directory Free plugin of the WordPress content management system is related to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2025-12869 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions up to and including 2024.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the advanced iframe shortcode. This allows...

PT-2025-12998

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.52 Description An issue was discovered in Appsmith where an incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must...

The vulnerability of the File Sharing function on the administrator web panel of microprogramming router software GL.iNet GL-MT3000 allows a hacker to read arbitrary files.

The vulnerability of the File Sharing function on the administrator web panel of the GL.iNet GL-MT3000 router software relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow an attacker, operating remotely, to read arbitrary files...

The vulnerability of the ABC Notation plugin for WordPress’ content management system arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the ABC Notation plugin in the WordPress content management system is related to errors in processing the relative path to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2025-12858 · WordPress · Booknetic

Name of the Vulnerable Software and Affected Versions: Booknetic WordPress plugin versions prior to 4.1.5 Description: The issue concerns a lack of CSRF check when creating Staff accounts, which could allow attackers to make logged-in admins add arbitrary Staff members via a CSRF attack. This cou...

PT-2025-13006 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: An issue was discovered where users invited as "App Viewer" incorrectly have access to development information of a workspace, specifically a list of datasources in a workspace they're a member of...

CVE-2025-27147: Improper Limitation of a Pathname to a Restricted Directory

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

PT-2025-13440 · Unknown · Choco Tei Watcher Mini

Name of the Vulnerable Software and Affected Versions: CHOCO TEI WATCHER mini IB-MCT001 all versions Description: A Direct request 'Forced Browsing' issue exists, allowing a remote attacker to send a specially crafted HTTP request to obtain or delete product data, and/or alter product settings...