PT-2025-19911 · WordPress · Peprodev Ultimate Profile Solutions

Name of the Vulnerable Software and Affected Versions: PeproDev Ultimate Profile Solutions plugin for WordPress versions 1.9.1 through 7.5.2 Description: The issue allows unauthorized modification of data due to a missing capability check on the handel ajax req function. This enables...

PT-2025-20317

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.20 Django versions 5.1 through 5.1.8 Django versions 5.2 through 5.2.0 Description An issue was discovered in Django, where the django.utils.html.strip tags function is vulnerable to a potential denial-of-servic...

PT-2025-20064

Name of the Vulnerable Software and Affected Versions Android versions prior to 15 Description The issue is an out-of-bounds write in libsavscmn, which allows local attackers to execute arbitrary code. This can be exploited by local attackers. Recommendations For versions prior to Android 15,...

PT-2025-20163 · Unknown · Themefic Instantio

Name of the Vulnerable Software and Affected Versions: Themefic Instantio versions n/a through 3.3.16 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-20027 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: The issue allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet. This is due to an out-of-bounds write in the affected software...

PT-2025-20312

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.15.3 Craft CMS versions prior to 5.7.5 Description Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent...

PT-2025-20104 · Pimwick · Pw Woocommerce Bulk Edit

Name of the Vulnerable Software and Affected Versions: pimwick PW WooCommerce Bulk Edit versions prior to 2.134 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

Do Not Install the HTTP Service

HyperText Transfer Protocol HTTP is a simple request-response protocol and usually runs over TCP. It specifies what messages the client may send to the server and what responses the client receives. Request and response messages include headers in ASCII, and the message content often uses a...

Do Not Enable the NFS Service

The Network File System NFS is one of the earliest and most widely used file systems in UNIX environments. It allows a system to mount file systems of other servers over the network. If the system does not share content through NFS, you are advised to disable NFS to reduce the remote attack...

PT-2025-20072 · Lemeconsultoria · Galera.App

Name of the Vulnerable Software and Affected Versions: lemeconsultoria HCM galera.app version 4.58.0 Description: The issue allows an attacker to execute arbitrary code through multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing,...

PT-2025-19835 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin for WordPress versions up to and including 1.6 Description: The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the aha plugin page function. This allows unauthenticated...

PT-2025-19830 · Unknown · Itsourcecode Content Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Content Management System version 1.0 Description: A critical issue was discovered in the itsourcecode Content Management System, affecting the /admin/update main topic img.php file. The manipulation of the topic id argument lead...

PT-2025-19836 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A problematic issue has been found in the Edit Article Page component. The manipulation of the Title argument leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed ...

PT-2025-19953 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.06 Description: A critical vulnerability was found in the Tenda AC8 router. The issue affects the formGetRouterStatus function of the file /goform/MtuSetMacWan. The manipulation of the shareSpeed argument leads to a...

PT-2025-19917 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject SQL statements, enabling them to obtain, update, and delete all information in the database. The vulnerability is specifically found in the User...

PT-2025-19952

Name of the Vulnerable Software and Affected Versions Gym Management System version 1.0 Description A critical issue has been found in the Gym Management System, affecting the processing of the file "/ajax.php?action=end membership". The manipulation of the rid argument leads to SQL injection. Th...

PT-2025-19939 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical vulnerability has been found in the D-Link DIR-600L, affecting the formSysCmd function. The manipulation of the host argument leads to command injection. This issue can be exploit...

PT-2025-19986 · Phpgt/Dom · Phpgt/Dom

Name of the Vulnerable Software and Affected Versions: phpgt/Dom versions prior to 4.1.8 Description: The issue exposes the GITHUB TOKEN in the Dom workflow run artifact. This occurs because the ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact, which is a zip of t...

PT-2025-19921 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM version 11 Description: This issue allows an unauthenticated attacker to upload any file within the server, including malicious files, to obtain Remote Code Execution RCE. Recommendations: For TCMAN GIM version 11, consider disablin...

PT-2025-19932 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical issue has been found in the function formEasySetupWizard3, where the manipulation of the host argument leads to a buffer overflow. This issue can be exploited remotely. It affects...