PT-2025-21447

Name of the Vulnerable Software and Affected Versions: The Custom Field Manager WordPress plugin version 1.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-21437

Name of the Vulnerable Software and Affected Versions Advance Post Prefix WordPress plugin versions through 1.1.1 Description The Advance Post Prefix WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a Reflected Cross-Site Scripting issue. This...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

PT-2025-21407 · WordPress · Nokaut Offers Box

Name of the Vulnerable Software and Affected Versions: Nokaut Offers Box WordPress plugin versions 1.4.0 and earlier Description: The issue concerns the lack of CSRF check when updating settings in the Nokaut Offers Box WordPress plugin. This could allow attackers to make a logged-in admin reset...

PT-2025-21448 · WordPress · The Top Comments Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Top Comments WordPress plugin versions 1.0 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21523 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: Everest Forms versions prior to 3.0.3.1 Description: The issue concerns the Everest Forms WordPress plugin, where it fails to properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, to...

PT-2025-21529 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads versions prior to 1.11.7 Description: The issue concerns the Z-Downloads WordPress plugin, which does not properly validate uploaded files. This allows for the uploading of SVG files that contain malicious JavaScript...

PT-2025-21513 · WordPress · Ntz Antispam

Name of the Vulnerable Software and Affected Versions: Ntz Antispam WordPress plugin versions 2.0e and earlier Description: The issue concerns the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21325 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.2 Mattermost versions 9.11.x through 9.11.11 Description: The issue is related to improper verification of a user's permissions when accessing groups. This allows an attacker to view group information v...

PT-2025-21371 · WordPress · Travelpayouts: All Travel Brands In One Place

Name of the Vulnerable Software and Affected Versions: The Travelpayouts: All Travel Brands in One Place WordPress plugin versions prior to 1.1.13 Description: The issue concerns a lack of CSRF check when importing settings from v1, which could allow attackers to make a logged-in admin update som...

PT-2025-21174 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.2.1 Description: The issue allows a portal user to see any other contact's picture by changing the picture ID in the URL. Recommendations: For versions prior to 3.2.1, update to version 3.2.1 to resolve the issue...

PT-2025-21190 · Unknown · Oembed Providers

Name of the Vulnerable Software and Affected Versions: oEmbed Providers versions 0.0.0 through 2.2.1 Description: The issue affects oEmbed Providers, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: For versions 0.0.0 through...

CVE-2025-46721

A CSRF vulnerability in nosurf (Go) before v1.2.0 arises from misusing Go’s net/http, causing all incoming requests to be treated as plain-text and bypassing the Referer-origin check. An attacker controlling content on the target or a subdomain can forge cross-origin requests and potentially mani...

PT-2025-21042 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.8 and earlier Description: A stored Cross-Site Scripting XSS issue affects Adobe Connect, allowing an attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the...

PT-2025-20901

Name of the Vulnerable Software and Affected Versions: FortiClientMac versions 7.0 through 7.4.2 FortiClientMac versions 7.0 through 7.2.8 FortiVoiceUCDesktop version 3.0 Description: An improper isolation or compartmentalization issue may allow an authenticated attacker to inject code via Electr...

PT-2025-23243 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The application's logic allows access to a functional capability without correctly completing one or more actions in the required sequence. This issue leaves the attributes of the Mailbox objec...

PT-2025-20923 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A command injection issue was discovered via the FUN 00459fdc function. This allows for potential exploitation. Recommendations: For TOTOLINK A3002R version 4.0.0-B20230531.1404,...

PT-2025-20909 · Rebuild · Rebuild

Name of the Vulnerable Software and Affected Versions: rebuild versions 3.9.0 through 3.9.3 Description: The issue is related to a SQL injection vulnerability in the /admin/admin-cli/exec component. Recommendations: For versions 3.9.0 through 3.9.3, consider disabling access to the...

PT-2025-21044 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.21.0 and earlier Description: The issue is related to an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application reli...

PT-2025-21023 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Bridge versions 15.0.3, 14.1.6 and earlier Description: The issue is an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...