PT-2025-14835 · WordPress · Uncanny Automator

Name of the Vulnerable Software and Affected Versions: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress versions up to, and including, 6.3.0.2 Description: The issue is due to the add role and user role functions missing proper capability checks...

PT-2025-14640 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 7.0 through 9.1 Description: The issue concerns an insecure direct object reference IDOR in the /assets/stafffiles component. This allows unauthenticated attackers to access files that have been uploaded by staff member...

PT-2025-14578 · Unknown · Sourcecodester Online Medicine Ordering System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Medicine Ordering System version 1.0 Description: A critical vulnerability was found in the SourceCodester Online Medicine Ordering System. This issue affects unknown code in the file /manage category.php. The manipulati...

PT-2025-14706 · Tribulant · Snow Storm

Name of the Vulnerable Software and Affected Versions: Tribulant Software Snow Storm versions 1.4.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-14809 · Unknown · Projectworlds Online Doctor Appointment Booking System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Doctor Appointment Booking System version 1.0 Description: A critical issue was found in the projectworlds Online Doctor Appointment Booking System. This issue affects the file /patient/getschedule.php and allows for SQL...

PT-2025-14777 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2024.3 JetBrains IntelliJ IDEA version 2024.2.4 Description: The issue concerns the logging of source code in the idea.log file. Recommendations: For versions prior to 2024.3, update to version 2024.3...

PT-2025-14627 · Unknown · Project Worlds Online Lawyer Management System

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Lawyer Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /save user edit profile.php. The manipulation of the first Name argument leads ...

PT-2025-14767 · Hcl · Hcl Devops Deploy +1

Name of the Vulnerable Software and Affected Versions: HCL DevOps Deploy / HCL Launch affected versions not specified Description: The issue allows a user to embed arbitrary HTML tags in the Web UI, potentially leading to sensitive information disclosure. This is due to an HTML injection...

PT-2025-18661 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the CloudSrvUserdataVersionCheck function via the svn parameter. This issue allows attackers to execute arbitrary commands through a...

PT-2025-14705 · Unknown · Custom Post Type Updates

Name of the Vulnerable Software and Affected Versions: Latest Custom Post Type Updates versions 1.3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-18656 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was found in the recvUpgradeNewFw function via the fwUrl parameter, allowing attackers to execute arbitrary commands through a crafted request...

PT-2025-14744 · Unknown · Cheesefather Botnet Attack Blocker

Name of the Vulnerable Software and Affected Versions: cheesefather Botnet Attack Blocker versions n/a through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an...

PT-2025-18658 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the msg process function via the Url parameter. This allows attackers to execute arbitrary commands by crafting a specifi...

PT-2025-18657 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the setWebWlanIdx function through the webWlanIdx parameter. This issue allows attackers to execute arbitrary commands via a manipulated...

PT-2025-14581 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions prior to 2.94.9 Description: The issue concerns the MapPress Maps plugin for WordPress, where certain parameters are not properly sanitized and escaped when displayed on the page. This could allow users wi...

PT-2025-14541 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the...

PT-2025-14499 · Stmicroelectronics · X-Cube-Azrtos-Wl

Name of the Vulnerable Software and Affected Versions: STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0 Description: A buffer overflow issue exists in the FileX Internal RAM interface functionality, allowing code execution through specially crafted network packets. An attacker can trigger this...

PT-2025-14533 · Trend Micro · Trend Vision One

Name of the Vulnerable Software and Affected Versions: Trend Vision One affected versions not specified Description: A broken access control issue in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and...

PT-2025-14565 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.5.0 Description: A critical vulnerability has been found in WonderCMS, affecting the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload...

PT-2025-14423 · Unknown · Salesmate Add-On For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Salesmate Add-On for Gravity Forms versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...