PT-2025-30704

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2 Description XWiki Platform is a generic wiki platform. A SQL injection vulnerability exists in the getdeleteddocuments.vm template due to insufficient sanitization...

PT-2025-16882 · Tp Link · Tp-Link M7200

Name of the Vulnerable Software and Affected Versions: TP-Link M7200 4G LTE Mobile Wi-Fi Router version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection issue exists, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This issue...

PT-2025-15920

Name of the Vulnerable Software and Affected Versions: The Swatchly – WooCommerce Variation Swatches for Products plugin versions 1.2.8 through 1.4.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on th...

PT-2025-15939 · WordPress · Insert/Embed Articulate Content

Name of the Vulnerable Software and Affected Versions: Insert or Embed Articulate Content into WordPress versions 4.3000000025 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can ...

PT-2025-15989 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 6.2.6 Vite versions prior to 6.1.5 Vite versions prior to 6.0.15 Vite versions prior to 5.4.18 Vite versions prior to 4.5.13 Description: Vite is a frontend tooling framework for javascript. The contents of arbitrary...

PT-2025-15923 · WordPress · Embedder

Name of the Vulnerable Software and Affected Versions: Embedder plugin for WordPress versions 1.3 to 1.3.5 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the ajax set global option function. This enables...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

PT-2025-15844 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 23.1R1 through 23.2R2-S3 Junos OS versions 23.4 through 23.4R2-S3 Junos OS versions 24.2 through 24.2R2 Description: A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS...

PT-2025-15777 · Unknown · Oleglark Vkontakte Cross-Post

Name of the Vulnerable Software and Affected Versions: oleglark VKontakte Cross-Post versions 0.3.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-15816 · Unknown · Doppler Forms

Name of the Vulnerable Software and Affected Versions: Doppler Forms versions 2.4.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15723 · Unknown · Uzair Easyfonts

Name of the Vulnerable Software and Affected Versions: Uzair Easyfonts versions 1.1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 1.1.2 and earlie...

PT-2025-15762 · Microsoft · Windows Live Writer

Name of the Vulnerable Software and Affected Versions: Windows Live Writer versions 0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15740 · Unknown · Theode Language Field

Name of the Vulnerable Software and Affected Versions: theode Language Field versions n/a through 0.9 Description: A Cross-Site Request Forgery CSRF issue in theode Language Field allows for Stored XSS. Recommendations: For versions n/a through 0.9, consider disabling the Language Field...

PT-2025-15851 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.4R3-S9 Junos OS versions 22.2 prior to 22.2R3-S5 Junos OS versions 22.4 prior to 22.4R3-S4 Junos OS versions 23.2 prior to 23.2R2-S3 Junos OS versions 23.4 prior to 23.4R2-S3 Junos OS versions 24.2 prior to...

PT-2025-15797 · Chat2 · Chat2

Name of the Vulnerable Software and Affected Versions: Chat2 versions prior to 3.6.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 3.6.3, update to...

PT-2025-18397

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description A null pointer dereference issue has been identified in the Linux kernel. The problem occurs when the CIFS module is unloaded while a TCP socket is still alive, causing a discrepancy...

PT-2025-15673 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The WP MultiTasking WordPress plugin does not have a CSRF check when updating its permalink suffix settings, which could allow attackers to make logged-in administrator...

PT-2025-15680 · Unknown · Ac-Wps-11Ac Series

Name of the Vulnerable Software and Affected Versions: Wi-Fi AP UNIT 'AC-WPS-11ac series' affected versions not specified Description: The issue is related to improper restriction of rendered UI layers or frames. If a user views and clicks on content on a malicious page while logged in, unintende...

PT-2025-15366 · Sap · Sap Kmc Wpc

Name of the Vulnerable Software and Affected Versions: SAP KMC WPC affected versions not specified Description: The issue allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query, potentially exposing sensitive information and causing low impact on the...