PT-2025-27229 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP raspap-webgui version 3.3.1 Description: The issue allows an authenticated attacker to perform a Directory Traversal attack. This is achieved by sending a crafted POST request to the "ajax/networking/get wgkey.php" endpoint with a path...

PT-2025-27142 · Diyhi Bbs · Diyhi Bbs

Name of the Vulnerable Software and Affected Versions: diyhi bbs versions up to 6.8 Description: A critical issue has been discovered that affects the getUrl function of the /admin/login file in the HTTP Header Handler component. The manipulation of the Host argument leads to server-side request...

PT-2025-27210 · Onionbuzz · Onionbuzz

Name of the Vulnerable Software and Affected Versions: OnionBuzz versions n/a through 1.0.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Looks Awesome OnionBuzz. Recommendations: For OnionBuzz versions n/a through 1.0.7, update to a version...

PT-2025-27139 · Unknown · Uxper Nuss

Name of the Vulnerable Software and Affected Versions: uxper Nuss versions 1.3.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.3.3 and earlier, update to a version that contains a fix for this...

PT-2025-27279 · Mescius · Activereports.Net

Name of the Vulnerable Software and Affected Versions: Mescius ActiveReports.NET affected versions not specified Description: The issue concerns a deserialization of untrusted data remote code execution vulnerability in the TypeResolutionService. This allows for remote code execution. The estimat...

PT-2025-27231 · Ibm · Ibm Cloud Pak System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak System versions 2.3.3.6 through 2.3.5.0 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. This issu...

PT-2025-27108 · Unknown · Fw Gallery

Name of the Vulnerable Software and Affected Versions: FW Gallery versions n/a through 8.0.0 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-27039 · Flock Safety · Flock Safety Gunshot Detection

Name of the Vulnerable Software and Affected Versions: Flock Safety Gunshot Detection devices versions prior to 1.3 Description: The issue concerns a hardcoded password for a system in Flock Safety Gunshot Detection devices. This hardcoded password could potentially be exploited. Recommendations:...

PT-2025-27069 · WordPress · Fl3R Accessibility Suite

Name of the Vulnerable Software and Affected Versions: FL3R Accessibility Suite plugin for WordPress versions up to, and including, 1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode due to insufficient input sanitization and...

PT-2025-27192 · Unknown · Quick Favicon

Name of the Vulnerable Software and Affected Versions: Quick Favicon versions through 0.22.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables an attacker to inject malicious...

PT-2025-27238 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Medical Card Generation System version 1.0 Description: A Cross-Site Request Forgery CSRF issue exists in the Inquiry Management functionality, specifically at the "/mcgs/admin/readenq.php" endpoint. This allows an authenticated...

PT-2025-27211 · Unknown · Plumwd Twitch Tv Embed Suite

Name of the Vulnerable Software and Affected Versions: plumwd Twitch TV Embed Suite versions n/a through 2.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the plumwd Twitch TV Embed Suite. Recommendations: For versions n/a through 2.1.0,...

PT-2025-27046 · Unknown · Neacsafe64 Driver +1

Name of the Vulnerable Software and Affected Versions: NeacSafe64 Driver versions prior to 1.0.0.8 Description: The issue allows attackers to escalate privileges by sending crafted IOCTL commands to the NeacSafe64.sys component. Recommendations: For versions prior to 1.0.0.8, update to version...

PT-2025-27174 · Unknown · Hide Admin Bar From Front End

Name of the Vulnerable Software and Affected Versions: Hide Admin Bar From Front End versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a...

CVE-2025-52904 File Browser: Command Execution not Limited to Scope

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The...

PT-2025-27021

Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue affects the function sub 484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack...

PT-2025-26991

Name of the Vulnerable Software and Affected Versions: Beward N100 IP Camera version M2.1.6.04C014 Description: An authenticated command injection issue exists via the ServerName and TimeZone parameters in the "servetest" CGI page. An attacker with web interface access can inject arbitrary system...

PT-2025-26987 · Unknown · Phpgurukul Pre-School Enrollment System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System Project version 1.0 Description: The issue concerns a Directory Traversal vulnerability in the manage-classes.php file. Recommendations: For PHPGurukul Pre-School Enrollment System Project version 1.0,...

PT-2025-26872 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A critical issue has been found, affecting the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. This issue can be exploited...

PT-2025-26807 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end database. Thi...