PT-2025-2052 · Sucms · Sucms

Name of the Vulnerable Software and Affected Versions: Sucms version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/admin members.php?ac=search. The manipulation of the uid argument leads to SQL injection. The attack may be launched remotely. The exploit h...

PT-2025-4376 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the "/html/funcionario/dependente listar um.php" endpoint, specifically in the id dependente...

CVE-2024-56438: Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability...

PT-2025-2965

Name of the Vulnerable Software and Affected Versions composio versions 0.5.40 and later Description The issue allows for command execution in composio openai, composio claude, and composio julep via the handle tool calls function. This is due to improper user input sanitization, leading to...

WordPress Passster plugin <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Passster versions = 4.2.10...

CVE-2024-11282 Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that...

CVE-2024-46981

A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. Mitigation A workaround to mitigate the problem without patching the redis-server executable is to...

CVE-2024-11290

The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to...

PT-2025-1696 · WordPress · Quill Forms

Name of the Vulnerable Software and Affected Versions: Quill Forms plugin for WordPress versions up to, and including, 3.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode due to insufficient input sanitization and output escaping o...

PT-2025-4411 · Hasthemes · Hash Elements

Name of the Vulnerable Software and Affected Versions: HashThemes Hash Elements versions 1.4.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. This allows attackers to inject malicious scripts in...

PT-2025-1804 · WordPress · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global plugin for WordPress versions up to, and including, 2.9.8 Description: The issue is related to Reflected Cross-Site Scripting via the set type parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-4453 · WordPress · Wp-Tagmaker

Name of the Vulnerable Software and Affected Versions: WP-tagMaker versions 0.2.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables an attacker to inject malicious scripts...

PT-2025-4541 · Addfunc · Addfunc Mobile Detect

Name of the Vulnerable Software and Affected Versions: AddFunc Mobile Detect versions n/a through 3.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS in AddFunc Mobile Detect...

PT-2025-4370

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A critical issue was identified in the "/WeGIA/html/socio/sistema/controller/controla xlsx.php" endpoint, which accepts file uploads without proper validation. This allows the upload of malicious...

PT-2025-4607 · Splunk · Splunk App For Soar

Name of the Vulnerable Software and Affected Versions: Splunk App for SOAR versions 1.0.67 and lower Description: The issue is related to improper access control. In the affected versions of the Splunk App for SOAR, the documentation recommended adding the admin all objects capability to the splu...

PT-2025-1364 · Nmap +1 · Nmap +1

Name of the Vulnerable Software and Affected Versions: EyesOfNetwork EON versions 5.3.11 and earlier Description: An issue was discovered in EyesOfNetwork EON where privilege escalation can be accomplished on the server because nmap can be run as root. The attacker achieves total control over the...

PT-2025-3817 · Unknown · Code-Projects Online Book Shop

Name of the Vulnerable Software and Affected Versions: code-projects Online Book Shop version 1.0 Description: A critical issue has been found in the code-projects Online Book Shop, affecting unknown code in the /detail.php file. The manipulation of the id argument leads to SQL injection. This...

CVE-2024-46981 Redis' Lua library commands may lead to remote code execution

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate...

CVE-2024-46981

CVE-2024-46981 affects Redis where an authenticated user using a crafted Lua script can manipulate the Lua garbage collector, potentially leading to remote code execution. Affected Redis versions are fixed in 7.4.2, 7.2.7, and 6.2.17; advisories also note an added mitigation: restricting Lua exec...

PT-2025-1014

Name of the Vulnerable Software and Affected Versions go-git versions prior to v5.13 Description An argument injection vulnerability was discovered in go-git. The successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...