PT-2025-5824 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.1 Description: A problematic issue was found in Webkul QloApps, affecting the logout function of the "/en/?mylogout" endpoint in the URL Handler component. This issue leads to cross-site request forgery and can be...

CVE-2022-39326

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the run-terraform reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a...

PT-2025-5746

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 4.3.1 Description: The issue arises when an attacker manually modifies the CFBundleIdentifier value in the Info.plist file by adding special characters, which are not allowed according to...

PT-2025-5610 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.20 Description: A stored cross-site scripting XSS issue exists in the admin panel's user management functionality, allowing an attacker to inject malicious payloads into the username field during user creation. Thi...

PT-2025-3458 · Sayski · Sayski Forestblog

Name of the Vulnerable Software and Affected Versions: sayski ForestBlog version 20241223 Description: The issue allows a remote attacker to escalate privileges via the article editing function. This is related to a Cross Site Scripting problem. Recommendations: For sayski ForestBlog version...

PT-2025-5606 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine affected versions not specified Description: The issue allows a user to inject commands via the nmap cmd parameters. This is a command injection issue in the reNgine automated reconnaissance framework for web applications. Users are...

PT-2025-2072 · WordPress · Fast Tube

Name of the Vulnerable Software and Affected Versions: Fast Tube WordPress plugin versions 2.3.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could b...

PT-2025-2074

Name of the Vulnerable Software and Affected Versions The WordPress Google Map Professional Map In Your Language WordPress plugin versions 1.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before...

PT-2025-1732 · WordPress · The Post Form – Registration Form – Profile Form For User Profiles – Frontend Content Forms For User Submissions

Name of the Vulnerable Software and Affected Versions: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress versions up to, and including, 2.8.13 Description: The issue is related to Stored Cross-Site Scripting v...

PT-2025-2970 · Openpanel · Openpanel

Name of the Vulnerable Software and Affected Versions: OpenPanel version 0.3.4 Description: An issue in the Copy and View functions of the File Manager component allows attackers to execute a directory traversal via a crafted HTTP request. Recommendations: For OpenPanel version 0.3.4, consider...

PT-2025-1973 · WordPress · Zalomení Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Zalomení WordPress plugin versions 1.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2025-2194 · WordPress · The Shared Files – Frontend File Upload Form & Secure File Sharing

Name of the Vulnerable Software and Affected Versions: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress versions up to, and including, 1.7.42 Description: The issue is related to Stored Cross-Site Scripting via dfxp File uploads due to insufficient input...

PT-2025-2885 · Sungrow · Sungrow Winet-Sv200

Name of the Vulnerable Software and Affected Versions: SunGrow WiNet-SV200 versions 0.001.00.P027 and earlier Description: The issue arises when copying the timestamp read from an MQTT message, as the underlying code does not check the bounds of the buffer used to store the message. This may lead...

PT-2025-1555

Name of the Vulnerable Software and Affected Versions Digiever DS-2105 Pro versions 3.1.0.71-11 Digiever DS-2105 Pro affected versions not specified Description The Digiever DS-2105 Pro network video recorder NVR has a flaw related to missing authorization, allowing for command injection via the...

PT-2025-7036

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.18 Description GLPI is an asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This allows an attacker to execute arbitrary SQL commands. A...

PT-2025-3072 · Spagobi · Spagobi

Name of the Vulnerable Software and Affected Versions: SpagoBI version 3.5.1 Description: A Cross-Site Request Forgery CSRF issue has been found in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in,...

PT-2025-1257 · Oracle · Oracle Agile Plm Framework

Name of the Vulnerable Software and Affected Versions: Oracle Agile PLM Framework version 9.3.6 Description: The issue is related to insufficient input validation in the Agile Integration Services component, allowing a low-privileged attacker with network access via HTTP to compromise the Oracle...

PT-2025-4268 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2025-2393 · Etic Telecom · Etic Telecom Remote Access Server

Name of the Vulnerable Software and Affected Versions: ETIC Telecom Remote Access Server RAS versions prior to 4.5.0 Description: The issue concerns reflected cross site scripting XSS attacks. This occurs in the get view method under the view parameter. The ETIC RAS web server uses dynamic pages...

PT-2025-3938 · Unknown · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical issue has been found in the system, allowing for remote SQL injection attacks. The manipulation of the m id argument in the file /dashboard/admin/new submit.php leads to this...