PT-2025-27888 · Unknown · Gopiplus Iframe Images Gallery

Name of the Vulnerable Software and Affected Versions: gopiplus iFrame Images Gallery versions prior to 9.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, which allows for SQL injection. This is a problem where an attacker can inject...

PT-2025-27905 · Click & Pledge · Click & Pledge Connect

Name of the Vulnerable Software and Affected Versions: Click & Pledge Connect versions 25.04010101 through WP6.8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for privilege escalation...

PT-2025-27942 · Unknown · Wpo-Hr Ngg Smart Image Search

Name of the Vulnerable Software and Affected Versions: wpo-HR NGG Smart Image Search versions 3.4.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27952 · Unknown +2 · Sumatrapdf +2

Name of the Vulnerable Software and Affected Versions: CHMLib versions through 2bef8d0 Description: The issue is related to an integer overflow in the chm decompress block function in chm lib.c, which leads to a heap-based buffer overflow in the chm fetch bytes function. This problem affects...

PT-2025-27838 · WordPress · Vikrentcar Car Rental Management System

Name of the Vulnerable Software and Affected Versions: VikRentCar Car Rental Management System plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is related to missing file type validation in the do updatecar and createcar functions, allowing authenticated attackers...

PT-2025-27808 · Mediawiki · Campaignevents Extension +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - CampaignEvents Extension versions 1.43.X through 1.43.1 Description: The issue affects the Mediawiki - CampaignEvents Extension, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

PT-2025-27776

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’...

PT-2025-27794 · Unknown · Melapress File Monitor

Name of the Vulnerable Software and Affected Versions: Melapress File Monitor version prior to 2.2.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior to...

PT-2025-27780 · Endress+Hauser · Endress+Hauser Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue arises from the application's behavior of returning different error messages for failed login attempts, depending on whether the failure was due to an incorrect password or a...

PT-2025-27829

Name of the Vulnerable Software and Affected Versions Remote for Mac versions prior to 2025.7 Description An unauthenticated remote code execution issue exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio. When the application is configured with authentication...

PT-2025-27832 · N8N · N8N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.99.1 Description: n8n is a workflow automation platform. An authorization issue was found in the "/rest/executions/:id/stop" endpoint, allowing an authenticated user to stop workflow executions they do not own or that...

PT-2025-27590 · WordPress · The Home Villas | Real Estate Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Home Villas | Real Estate WordPress Theme versions up to, and including, 2.8 Description: The issue is related to insufficient file path validation in the wp rem cs widget file delete function, allowing authenticated attackers with...

PT-2025-27646 · Thycotic · Thycotic Secret Server

Name of the Vulnerable Software and Affected Versions: Thycotic Secret Server versions 11.7 and earlier Description: The issue allows an administrator to gain access to restricted tables through a SQL report creation vulnerability. Recommendations: For Thycotic Secret Server versions 11.7 and...

PT-2025-27669 · Unknown · Nos Client

Name of the Vulnerable Software and Affected Versions: NSClient++ version 0.5.2.35 Description: A local privilege escalation issue exists when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and i...

PT-2025-27603

Name of the Vulnerable Software and Affected Versions: Filesystem versions prior to 0.6.3 Filesystem version 2025.7.1 and earlier Description: The issue allows access to unintended files when the prefix matches an allowed directory. Users can resolve the issue by upgrading to version 2025.7.1...

PT-2025-27489 · Unknown · Simple Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: code-projects Simple Pizza Ordering System version 1.0 Description: A critical issue has been found in the Simple Pizza Ordering System, affecting an unknown part of the /addpro.php file. The manipulation of the ID argument leads to SQL...

PT-2025-27505 · Mcafee · Ens Hx

Name of the Vulnerable Software and Affected Versions: ENS HX version 10.0.4 Description: A stored cross-site scripting issue allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data. Recommendations: For ENS HX version...

PT-2025-27540 · Avtech · Avtech Dvr +2

Name of the Vulnerable Software and Affected Versions: AVTECH IP camera, DVR, and NVR devices affected versions not specified Description: An OS command injection issue exists in the devices via the "PwdGrp.cgi" endpoint, which handles user and group management operations. Authenticated users can...

PT-2025-27557 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /mark.php. The manipulation of the ID argument leads to SQL injection. The attack ca...

PT-2025-27528 · Unknown · Bitto.Kazi Custom Login/Signup Widget

Name of the Vulnerable Software and Affected Versions: bitto.Kazi Custom Login And Signup Widget versions 1.0 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection. This vulnerability can potentially...