PT-2025-25606 · WordPress · Wise Chat

Name of the Vulnerable Software and Affected Versions: Wise Chat plugin for WordPress versions up to, and including, 3.3.4 Description: The issue is related to Stored Cross-Site Scripting via the X-Forwarded-For header due to insufficient input sanitization and output escaping. This allows...

PT-2025-25686 · Unknown · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal versions n/a through 2.3.2 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can b...

PT-2025-25731 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.9.5.2 Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. Recommendations: For Metagauss ProfileGrid versions through 5.9.5.2, update to ...

PT-2025-25751

Name of the Vulnerable Software and Affected Versions: Sitecore PowerShell Extensions versions through 7.0 Description: Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager XM and Experience Platform XP, is vulnerable to an unrestricted file upload issue. A remote, authenticat...

PT-2025-25574

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.12 Description The verification of the second factor was not subject to rate limiting, allowing an attacker with valid credentials to automate OTP guessing via the second factor endpoint. Recommendations For version...

PT-2025-26478 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical issue affects the formSetACLFilter function of the file /goform/formSetACLFilter. The manipulation of the curTime argument leads to a stack-based buffer overflow. This issue can be...

PT-2025-25582 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown part of the file /insertClient.php. The manipulation of the client id argument leads to SQL injection. It i...

PT-2025-25514 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical issue has been found, affecting some unknown functionality of the file /billing/test accesscodelogin.php. The manipulation of the Password argument leads to os comman...

PT-2025-25548 · Otrs +1 · Otrs +1

Name of the Vulnerable Software and Affected Versions: OTRS versions prior to 8 OTRS Community Edition version 6.0.x Description: A vulnerability in the OTRS Admin Interface and Agent Interface allows parameter injection for an authenticated agent or admin user. This issue affects several version...

PT-2025-25529 · Unknown · Phoenix Site Cms

Name of the Vulnerable Software and Affected Versions: Phoenix Site CMS versions affected versions not specified Description: A Reflected Cross Site Scripting XSS issue was found in the "/search" endpoint, allowing remote attackers to execute arbitrary code via the s GET parameter. Recommendation...

PT-2025-25513 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical vulnerability was found in the Wifi-soft UniBox Controller, affecting an unknown functionality of the file /authentication/logout.php. The manipulation of the mac...

PT-2025-25575

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.12 Description The issue concerns the inclusion of the full IP address of the acting user in audit log notifications. This information could be obtained by third-party servers, such as SMTP relays or spam filters...

PT-2025-25543 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System versions 6.2.0 Description: A critical issue affects the /vehicle/search API endpoint of the component, where manipulation of the vehicleTypeCode argument leads to SQL injection. The attack can be initiated...

PT-2025-25515 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical issue was found in Wifi-soft UniBox Controller, affecting an unknown part of the file /billing/pms check.php. The manipulation of the ipaddress argument leads to os...

PT-2025-25592 · Unknown · Group-Office

Name of the Vulnerable Software and Affected Versions: Group-Office versions prior to 6.8.123 Group-Office versions prior to 25.0.27 Description: A stored and blind cross-site scripting XSS issue exists in the Name Field of the user profile. An attacker can change their name to a javascript...

PT-2025-25471 · Zagg · Zagg

Name of the Vulnerable Software and Affected Versions: Zagg - Electronics & Accessories WooCommerce WordPress Theme versions up to, and including, 1.4.1 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the load view function, which i...

PT-2025-25470 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro - Community and User Profile WordPress Plugin versions up to, and including, 5.1.10 Description: The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information...

PT-2025-25414 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue allows attackers to execute a directory traversal in the "/script-api/scripts/" endpoint. Recommendations: For OpenC3 COSMOS version 6.0.0, consider restricting access to the...

PT-2025-25429 · Drupal · Drupal Etracker

Name of the Vulnerable Software and Affected Versions: Drupal etracker versions 0.0.0 through 3.0.x Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...

PT-2025-25447 · Dell · Dell Controlvault3 +1

Name of the Vulnerable Software and Affected Versions: Dell ControlVault3 versions prior to 5.15.10.14 Dell ControlVault 3 Plus versions prior to 6.2.26.36 Description: An out-of-bounds write vulnerability exists in the cv upgrade sensor firmware function of Dell ControlVault3 and Dell ControlVau...