PT-2025-20099 · Hash Form · Hash Form

Name of the Vulnerable Software and Affected Versions: Hash Form versions 1.2.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For versions 1.2.8 and earlier, update to a version that includes a fix for this...

PT-2025-20216 · Liveagent · Liveagent

Name of the Vulnerable Software and Affected Versions: LiveAgent versions n/a through 4.4.7 Description: A Cross-Site Request Forgery CSRF issue affects the LiveAgent software. This issue allows for Cross Site Request Forgery. Recommendations: For versions n/a through 4.4.7, update to a version...

PT-2025-20163 · Unknown · Themefic Instantio

Name of the Vulnerable Software and Affected Versions: Themefic Instantio versions n/a through 3.3.16 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

PT-2025-20072 · Lemeconsultoria · Galera.App

Name of the Vulnerable Software and Affected Versions: lemeconsultoria HCM galera.app version 4.58.0 Description: The issue allows an attacker to execute arbitrary code through multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing,...

PT-2025-20317

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.20 Django versions 5.1 through 5.1.8 Django versions 5.2 through 5.2.0 Description An issue was discovered in Django, where the django.utils.html.strip tags function is vulnerable to a potential denial-of-servic...

Do Not Install the HTTP Service

HyperText Transfer Protocol HTTP is a simple request-response protocol and usually runs over TCP. It specifies what messages the client may send to the server and what responses the client receives. Request and response messages include headers in ASCII, and the message content often uses a...

PT-2025-19987 · Libxmp +1 · Libxmp +1

Name of the Vulnerable Software and Affected Versions: Libxmp versions 4.6.2 and earlier Description: The issue is a stack-based buffer overflow in the depack pha function in loaders/prowizard/pha.c, which occurs when processing a malformed Pha format tracker module in a .mod file. Recommendation...

PT-2025-19953 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.06 Description: A critical vulnerability was found in the Tenda AC8 router. The issue affects the formGetRouterStatus function of the file /goform/MtuSetMacWan. The manipulation of the shareSpeed argument leads to a...

PT-2025-19917 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject SQL statements, enabling them to obtain, update, and delete all information in the database. The vulnerability is specifically found in the User...

PT-2025-19830 · Unknown · Itsourcecode Content Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Content Management System version 1.0 Description: A critical issue was discovered in the itsourcecode Content Management System, affecting the /admin/update main topic img.php file. The manipulation of the topic id argument lead...

PT-2025-19952

Name of the Vulnerable Software and Affected Versions Gym Management System version 1.0 Description A critical issue has been found in the Gym Management System, affecting the processing of the file "/ajax.php?action=end membership". The manipulation of the rid argument leads to SQL injection. Th...

PT-2025-19835 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin for WordPress versions up to and including 1.6 Description: The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the aha plugin page function. This allows unauthenticated...

PT-2025-19986 · Phpgt/Dom · Phpgt/Dom

Name of the Vulnerable Software and Affected Versions: phpgt/Dom versions prior to 4.1.8 Description: The issue exposes the GITHUB TOKEN in the Dom workflow run artifact. This occurs because the ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact, which is a zip of t...

PT-2025-19932 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical issue has been found in the function formEasySetupWizard3, where the manipulation of the host argument leads to a buffer overflow. This issue can be exploited remotely. It affects...

PT-2025-19921 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM version 11 Description: This issue allows an unauthenticated attacker to upload any file within the server, including malicious files, to obtain Remote Code Execution RCE. Recommendations: For TCMAN GIM version 11, consider disablin...

PT-2025-19916 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: This issue allows an unauthenticated attacker to inject an SQL statement to obtain, update, and delete all information in the database. The vulnerability is found in the User parameter of the...

PT-2025-19836 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A problematic issue has been found in the Edit Article Page component. The manipulation of the Title argument leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed ...

PT-2025-19939 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical vulnerability has been found in the D-Link DIR-600L, affecting the formSysCmd function. The manipulation of the host argument leads to command injection. This issue can be exploit...

PT-2025-19795 · Unknown +1 · League/Commonmark +1

Name of the Vulnerable Software and Affected Versions: league/commonmark versions 1.5.0 through 2.6.x Description: A cross-site scripting XSS vulnerability in the Attributes extension of the league/commonmark library allows remote attackers to insert malicious JavaScript calls into HTML. The...

PT-2025-19335 · Unknown · Zhangyanbo2007 Youkefu

Name of the Vulnerable Software and Affected Versions: zhangyanbo2007 youkefu version 4.2.0 and earlier Description: A vulnerability was found in the function impsave of the file mwebhandleradminsystemTemplateController.java. The manipulation of the argument dataFile leads to deserialization. The...