PT-2025-28211

Name of the Vulnerable Software and Affected Versions LuaJIT versions through 2.1 Description LuaJIT is susceptible to a denial-of-service DoS condition due to an unsinking of IR FSTORE for a NULL metatable. Recommendations Update LuaJIT to a version later than 2.1...

PT-2025-28440 · Qualcomm · 315 5G Iot Modem Firmware +170

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A transient Denial of Service DOS occurs while processing received beacon frames. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

PT-2025-28205 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3 Description: A Reflected Cross-Site Scripting XSS issue was identified in the "cadastro dependente pessoa nova.php" endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in th...

PT-2025-28167

Name of the Vulnerable Software and Affected Versions: Dagster versions prior to 1.5.12 Description: A Directory Traversal issue allows remote attackers to obtain sensitive information via crafted requests to the "/logs" endpoint. This may be restricted to certain file names that start with a dot...

PT-2025-28173 · Hashview · Hashview

Name of the Vulnerable Software and Affected Versions: Hashview version 0.8.1 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header. Recommendations: For...

PT-2025-28163

Name of the Vulnerable Software and Affected Versions: run-llama/llama index versions 0.12.27 through 0.12.40 Description: A path traversal vulnerability exists, specifically within the encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read...

PT-2025-28223 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to 1.2.10 Description: An open redirect issue has been found in the originCheck middleware function of Better Auth, an authentication and authorization library for TypeScript. The affected routes include...

PT-2025-28125 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A vulnerability has been found in the component Course Module, affecting the file /intranet/educar curso det.php?cod curso=ID. The manipulation of the Curso argument leads to cross-site scripting...

PT-2025-28165 · Unknown · Campcodes Payroll Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Payroll Management System version 1.0 Description: A critical issue affects the processing of the file "/ajax.php?action=delete employee attendance single". The manipulation of the ID argument leads to SQL injection. The attack may ...

PT-2025-30226 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.06.50 Description: A critical vulnerability exists in Tenda AC6 due to a buffer overflow in the setparentcontrolinfo function of the httpd component. The issue is exploitable remotely. Recommendations: Update Tenda AC6...

PT-2025-28129 · Unknown · Nimesa Backup/Recovery

Name of the Vulnerable Software and Affected Versions: Nimesa Backup and Recovery affected versions not specified Description: A server-side request forgery SSRF issue exists, which may allow unintended requests to be sent to internal servers if exploited. Recommendations: At the moment, there is...

PT-2025-28175 · Jobcenter · Jobcenter

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2 Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header...

PT-2025-28124 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A problematic vulnerability was found in the School Module component, specifically affecting the /intranet/educar escola lst.php file. The manipulation of the Escola argument leads to cross-site...

PT-2025-28032 · Rustls · Rustls

Name of the Vulnerable Software and Affected Versions: rustls versions 0.23.13 through 0.23.17 Description: The issue allows a panic via a fragmented TLS ClientHello when rustls::server::Acceptor::accept is used. Recommendations: For rustls versions 0.23.13 through 0.23.17, update to version...

PT-2025-27910 · Rankie · Rankie

Name of the Vulnerable Software and Affected Versions: Rankie versions 1.8.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject malicio...

PT-2025-27918 · Unknown · Cmoreira Testimonials Showcase

Name of the Vulnerable Software and Affected Versions: cmoreira Testimonials Showcase versions 1.9.16 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-27846 · WordPress · Ycontributors

Name of the Vulnerable Software and Affected Versions: yContributors plugin for WordPress versions up to, and including, 0.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yContributors' page. This allows unauthenticated...

PT-2025-27888 · Unknown · Gopiplus Iframe Images Gallery

Name of the Vulnerable Software and Affected Versions: gopiplus iFrame Images Gallery versions prior to 9.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, which allows for SQL injection. This is a problem where an attacker can inject...

PT-2025-27905 · Click & Pledge · Click & Pledge Connect

Name of the Vulnerable Software and Affected Versions: Click & Pledge Connect versions 25.04010101 through WP6.8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for privilege escalation...

PT-2025-27889 · Unknown · Gopiplus Pixelating Image Slideshow Gallery

Name of the Vulnerable Software and Affected Versions: gopiplus Pixelating image slideshow gallery versions n/a through 8.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...