PT-2025-21570 · Dumb Drop · Dumb Drop

Name of the Vulnerable Software and Affected Versions: DumbDrop versions prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b Description: The issue is related to a DOM cross-site scripting vulnerability in the upload functionality. A user could be tricked into uploading a file with a malicio...

PT-2025-21340 · Wamr +1 · Wamr +1

Name of the Vulnerable Software and Affected Versions: WAMR versions up to and including 2.2.0 WAMR built with libc-uvwasi on Windows Description: The issue is related to a symlink following vulnerability in the WebAssembly Micro Runtime WAMR. On WAMR running in Windows, creating a symlink pointi...

PT-2025-21284 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Vehicle Record Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS problem. It affects the /admin/profile.php endpoint through the name, email, and mobile parameters. Recommendations: For...

PT-2025-21589 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615 Description: A critical issue was found in the HTTP POST Request Handler component, specifically affecting unknown code of the file /boafrm/formFilter. The manipulation of the ip6addr...

PT-2025-21281 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Vehicle Record Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via Cross Site Scripting XSS in the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, and enginenumber...

PT-2025-21368 · Atheros · Atheos

Name of the Vulnerable Software and Affected Versions: Atheos versions prior to v602 Description: Atheos is a self-hosted browser-based cloud IDE. The $target parameter in "/controller.php" was not properly validated, which could allow an attacker to execute arbitrary files on the server via path...

PT-2025-21286 · Weberp · Weberp

Name of the Vulnerable Software and Affected Versions: WebERP version 4.15.2 Description: A SQL Injection issue allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to...

PT-2025-21510 · WordPress · Widgets Reset

Name of the Vulnerable Software and Affected Versions: Widgets Reset WordPress plugin versions 0.1 and earlier Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21243 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to 2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at the "/address/AddrController.java"...

PT-2025-21184 · Samsung · Exynos 2100 +18

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980 through 9825 Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 990 Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 850...

PT-2025-21229 · Samsung · Galaxy Buds 2 +1

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy Buds and Galaxy Buds 2 affected versions not specified Description: The issue concerns Samsung Galaxy Buds and Galaxy Buds 2 audio devices being Bluetooth pairable by default without requiring user input or providing a means to...

PT-2025-21178 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version V1.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It affects the /admin/profile.php endpoint via the website image, fname, lname, contact, username, and addre...

PT-2025-21182 · Unknown · Sma1000 Appliance

Name of the Vulnerable Software and Affected Versions: SMA1000 Appliance affected versions not specified Description: A Server-side request forgery SSRF vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthenticated attacker coul...

PT-2025-21146 · WordPress · Latepoint – Calendar Booking Plugin For Appointments/Events

Name of the Vulnerable Software and Affected Versions: LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress versions up to, and including, 5.1.92 Description: The issue allows unauthenticated attackers to retrieve appointment details, such as customer names and ema...

PT-2025-21248 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to 2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at the "/mail/MailController.java"...

PT-2025-21198 · Drupal · Enterprise Mfa - Tfa For Drupal

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in...

PT-2025-21923 · V-Sft · V-Sft

Name of the Vulnerable Software and Affected Versions: V-SFT versions 6.2.5.0 and earlier Description: The issue is related to a stack-based buffer overflow in the VS6File!CTxSubFile::get ProgramFile name function. Opening specially crafted V7 or V8 files may lead to a crash, information...

PT-2025-21244 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to v2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at the "/login/LoginsController.java" A...

PT-2025-21082 · Intel · Intel Graphics

Name of the Vulnerable Software and Affected Versions: IntelR Graphics software affected versions not specified Description: The issue is related to improper access control in some IntelR Graphics software, which may allow an authenticated user to potentially enable denial of service via local...

PT-2025-21043 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.8 and earlier Description: A stored Cross-Site Scripting XSS issue affects Adobe Connect, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page...