PT-2025-27569 · Ullu · Ullu

Name of the Vulnerable Software and Affected Versions: Ullu versions 2.9.929 Android and 2.8.0 IOS Description: The issue is related to incorrect access control, allowing attackers to bypass the parental pin feature via unspecified vectors. Recommendations: For Ullu version 2.9.929 Android and...

PT-2025-27449 · Unknown · Devinim Software Library

Name of the Vulnerable Software and Affected Versions: Devinim Software Library Software versions prior to 24.11.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2025-27414 · Code Projects · Code-Projects Movie Ticketing System

Name of the Vulnerable Software and Affected Versions: code-projects Movie Ticketing System version 1.0 Description: A critical issue affects the processing of the file "/ticketConfirmation.php". The manipulation of the Date argument leads to SQL injection. The attack may be initiated remotely...

PT-2025-27405 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version 15.03.06.47 Description: A critical issue has been found in the affected software, classified as critical. The issue affects an unknown functionality of the file /goform/openSchedWifi. The manipulation of the arguments...

PT-2025-27461 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.3 Frappe versions prior to 15.58.0 Description: A carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This issue can only be exploited on self-hosted...

PT-2025-30052 · Unknown · Mcp-Package-Docs

Name of the Vulnerable Software and Affected Versions: mcp-package-docs versions prior to 0.1.28 node-code-sandbox-mcp versions prior to 0.1.28 mcp-server-kubernetes versions prior to 0.1.28 git-mcp-server versions prior to 0.1.28 Description: A command injection vulnerability exists in multiple...

PT-2025-27415 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the Username argument in an unknown function of the file /php action/createUser.ph...

PT-2025-27447 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 3.2 Description: A critical vulnerability was found in the PHPGurukul Student Record System. This issue affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads...

PT-2025-27437 · Unknown · Code-Projects Car Rental System

Name of the Vulnerable Software and Affected Versions: code-projects Car Rental System version 1.0 Description: A critical issue affects an unknown functionality of the file /admin/add cars.php. The manipulation of the car name argument leads to SQL injection. The attack can be launched remotely...

PT-2025-27460 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.94.2 Frappe versions prior to 15.57.0 Description: The issue allows authenticated users to upload malicious files via Data Import, leading to cross-site scripting XSS. Recommendations: For versions prior to 14.94.2...

PT-2025-27440 · Unknown · Code-Projects Car Rental System

Name of the Vulnerable Software and Affected Versions: code-projects Car Rental System version 1.0 Description: A critical vulnerability was found in the code-projects Car Rental System, affecting unknown code in the file /book car.php. The manipulation of the fname argument leads to SQL injectio...

PT-2025-27347 · Unknown · Code-Projects Simple Forum

Name of the Vulnerable Software and Affected Versions: code-projects Simple Forum version 1.0 Description: A critical issue affects some unknown functionality of the file "/register1.php". The manipulation of the User argument leads to SQL injection. The attack may be launched remotely...

PT-2025-27365 · Unknown · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown part of the file /panel/pro sale.php. The manipulation of the fromdate and todate arguments leads to SQL injection...

PT-2025-27547 · Intelbras · Intelbras Rx1500 Router

Name of the Vulnerable Software and Affected Versions: Intelbras RX1500 Router versions prior to 2.2.17 Description: The vulnerability resides in the FirmwareUpload and GetFirmwareValidation functions due to improper access control. Exploitation may allow a remote attacker to gain unauthorized...

PT-2025-27288 · WordPress · Pt Project Notebooks

Name of the Vulnerable Software and Affected Versions: PT Project Notebooks plugin for WordPress versions 1.0.0 through 1.1.3 Description: The issue is related to missing authorization in the wpnb pto new users add function, which allows unauthenticated attackers to elevate their privileges to th...

PT-2025-27326 · Totolink · Totolink A702R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A702R versions up to 4.0.0-B20230721.1521 Description: A critical vulnerability was found in the HTTP POST Request Handler component of TOTOLINK A702R, affecting an unknown functionality of the file /boafrm/formWlSiteSurvey. The...

PT-2025-27296 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts affected versions not specified Description: The issue concerns a deserialization vulnerability. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

GHSA-3Q2W-42MV-CPH4 filebrowser Allows Shell Commands to Spawn Other Commands

!NOTE This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new...

PT-2025-27229 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP raspap-webgui version 3.3.1 Description: The issue allows an authenticated attacker to perform a Directory Traversal attack. This is achieved by sending a crafted POST request to the "ajax/networking/get wgkey.php" endpoint with a path...

PT-2025-27227 · Unknown · Devnex Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Devnex Addons For Elementor versions 1.0.9 and earlier Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP...