PT-2024-31580 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions prior to 2.11.2 Description: The issue allows for cross-site scripting, which can lead to the execution of an arbitrary script on the user's web browser if exploited. Recommendations: For versions prior to 2.11.2,...

PT-2025-6048

Name of the Vulnerable Software and Affected Versions npm-serialize-javascript versions up to 6.0.1 Description The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to injec...

PT-2024-9684

Name of the Vulnerable Software and Affected Versions Backup and Staging by WP Time Capsule plugin for WordPress versions up to, and including, 1.22.21 Description The issue is related to arbitrary file uploads due to missing file type validation in the UploadHandler.php file and no direct file...

PT-2024-31193 · Unknown · Itsourcecode Alton Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Alton Management System version 1.0 Description: The issue is related to SQL Injection in the /noncombo save.php endpoint via the menu parameter. This allows for potential exploitation. Recommendations: For itsourcecode Alton...

PT-2024-6316 · Veeam · Veeam One

Name of the Vulnerable Software and Affected Versions: Veeam ONE affected versions not specified Description: An improper access control issue allows low-privileged users to execute code with Administrator privileges remotely. This vulnerability is related to deficiencies in access control in the...

PT-2024-29396 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB version 2.21.1.0 Description: A buffer overflow issue was discovered in YugabyteDB via the insert into parameter. Recommendations: For YugabyteDB version 2.21.1.0, consider restricting the use of the insert into parameter until a...

PT-2024-29397 · Unknown +1 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: ClickHouse version 24.3.3.102 Description: A buffer overflow issue was discovered in ClickHouse via the component DB::evaluateConstantExpressionImpl. Recommendations: For ClickHouse version 24.3.3.102, consider disabling the...

PT-2024-5901 · Yandex +1 · Yandex Browser +1

Name of the Vulnerable Software and Affected Versions: Yandex Browser for Desktop versions prior to 24.7.1.380 Description: The issue is related to the use of an untrusted search path, which can lead to a DLL Hijacking Vulnerability. This vulnerability allows an attacker to execute arbitrary code...

PT-2025-18104 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.41.0 Description: A vulnerability in the update process of Docker Desktop for Windows could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts ...

PT-2024-5934 · Totolink · Totolink Ac1200 Wireless Router

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 Wireless Router A3002RU version V2.1.1-B20230720.1011 Description: The issue concerns a buffer overflow vulnerability related to the formWlEncrypt CGI handler in the boa program. This handler fails to limit the length of the...

PT-2024-31501 · Hyperledger · Hyperledger Fabric

Name of the Vulnerable Software and Affected Versions: Hyperledger Fabric versions 2.5.0 through 2.5.9 Description: The issue is related to Hyperledger Fabric not verifying that a request has a timestamp within the expected time window. This problem can be exploited due to the lack of proper...

PT-2024-30185 · Unknown · Acutoweb Server

Name of the Vulnerable Software and Affected Versions: AcuToWeb server version 10.5.0.7577C8b Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the "index.php" component. This enables the attacker to perform unauthorized actions on the affected syste...

PT-2024-30203 · Arrowcms · Arrowcms

Name of the Vulnerable Software and Affected Versions: ArrowCMS version 1.0.0 Description: A host header injection vulnerability exists in the forgot password functionality. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to...

PT-2024-38481 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight

Name of the Vulnerable Software and Affected Versions: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions up to, and including, 4.2.6 Description: The issue is related to limited SQL Injection via the app-builder-search parameter due to insufficient...

PT-2024-5917 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6613.113 Description: The issue is related to a type confusion in the V8 JavaScript engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML...

PT-2024-30089 · H3C · H3C Gr-1100-P

Name of the Vulnerable Software and Affected Versions: H3C GR1100-P version v100R009 Description: The issue is related to a hardcoded password in /etc/shadow, which allows attackers to log in as root. This enables unauthorized access to the system. Recommendations: For H3C GR1100-P version...

PT-2024-37643 · WordPress · The News Element Elementor Blog Magazine Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The News Element Elementor Blog Magazine WordPress plugin versions prior to 1.0.6 Description: The issue allows an unauthenticated attacker to include and execute PHP files on the server via the template parameter, enabling the execution of a...

PT-2024-37408 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.6 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-37670 · WordPress · Light Poll Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Light Poll WordPress plugin versions through 1.0.0 Description: The issue concerns a lack of CSRF checks when deleting polls, which could allow attackers to make logged-in users perform such actions via a CSRF attack. Recommendations: For...

PT-2024-29658

Name of the Vulnerable Software and Affected Versions Haystack versions prior to 2.3.1 Description The issue concerns Haystack clients that allow users to create and run Pipelines from scratch, making them vulnerable to remote code executions. Certain components in Haystack utilize Jinja2...