PT-2025-28631

Name of the Vulnerable Software and Affected Versions Windows versions prior to July 2025 Description A flaw exists in Windows related to the external control of file names or paths within Windows Storage. This issue allows an attacker to perform spoofing attacks over a network. The vulnerability...

PT-2025-28548

Name of the Vulnerable Software and Affected Versions: Microsoft Remote Desktop Client affected versions not specified Description: A relative path traversal flaw exists in the Remote Desktop Client, potentially allowing an unauthorized attacker to execute code over a network. Malicious Remote...

PT-2025-28635 · Unknown · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /user/fetch member.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-28391 · Siemens · Tia Project-Server +1

Name of the Vulnerable Software and Affected Versions: TIA Project-Server versions prior to V2.1.1 TIA Project-Server V17 versions Totally Integrated Automation Portal TIA Portal V17 versions Totally Integrated Automation Portal TIA Portal V18 versions Totally Integrated Automation Portal TIA...

PT-2025-28158 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue affects the processing of the file /admin/complaint-details.php, where the manipulation of the cid and uid arguments leads to SQL injection. This issue can be...

PT-2025-28145 · Unknown · Campcodes Complaint Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complaint Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the /users/complaint-details.php file. The manipulation of the cid argument leads to SQL injection. It ...

PT-2025-28202 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed...

PT-2025-28216 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3 Description: A Cross-Site Scripting XSS Injection issue was found in WeGIA, a web manager for charitable institutions. The vulnerability is located in the novo memorando.php file. When a memo is submitted, the...

PT-2025-28252 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Salon Management System version 1.0 Description: A problematic issue was found in the Update Staff Page component, specifically in the /panel/edit plan.php file, allowing for cross-site scripting. This can be exploited...

PT-2025-28033 · Dradis · Dradis

Name of the Vulnerable Software and Affected Versions: Dradis versions through 4.16.0 Description: Dradis allows referencing external images over HTTPS instead of requiring the use of embedded images. This can be exploited by an authorized author to attempt to steal the Net-NTLM hashes of other...

PT-2025-28029 · Alinto +1 · Sogo +1

Name of the Vulnerable Software and Affected Versions: Alinto SOPE SOGo versions 2.0.2 through 5.12.2 Description: This issue involves a NULL pointer dereference in sope-core/NGExtensions/NGHashMap.m that can lead to a crash of the SOGo application. The vulnerability occurs when a request contain...

PT-2025-27874 · Bplugins · Bplugins Video Gallery Block

Name of the Vulnerable Software and Affected Versions: bPlugins Video Gallery Block versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject...

PT-2025-27858 · WordPress · Uncode Core

Name of the Vulnerable Software and Affected Versions: Uncode Core plugin for WordPress versions up to, and including, 2.9.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the uncode hl...

PT-2025-27868 · Unknown · Contact Form 7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 reCAPTCHA versions 1.2.0 and earlier Description: The issue is related to a Cross Site Request Forgery CSRF problem. It affects the reCAPTCHA component of Contact Form 7, allowing unauthorized requests to be made on behalf of a...

PT-2025-27948 · Mtr +2 · Mtr +2

Name of the Vulnerable Software and Affected Versions: mtr versions 0.95 and earlier Description: The issue concerns the mishandling of execution of a program specified by the MTR PACKET environment variable in certain privileged contexts. It is noted that mtr on macOS may often have Sudo rules d...

PT-2025-27892 · Unknown · Tony Zeoli Radio Station

Name of the Vulnerable Software and Affected Versions: Tony Zeoli Radio Station versions 2.5.12 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This vulnerability...

PT-2025-27924 · WordPress · Bestwpdeveloper Woocommerce Product Multi-Action

Name of the Vulnerable Software and Affected Versions: BestWpDeveloper WooCommerce Product Multi-Action versions 1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited in the BestWpDeveloper WooCommerce Product...

PT-2025-27906 · Liquidthemes · Logisticshub

Name of the Vulnerable Software and Affected Versions: LiquidThemes LogisticsHub versions 1.1.6 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to significant security...

PT-2025-27944 · Ergon Informatik Ag · Airlock Iam

Name of the Vulnerable Software and Affected Versions: Ergon Informatik AG's Airlock IAM versions 7.7.9 through 8.3.1 Description: The issue is related to a timing difference in the password reset functionality, allowing unauthenticated attackers to enumerate usernames. Recommendations: For...

PT-2025-27855 · WordPress · Booking X

Name of the Vulnerable Software and Affected Versions: Booking X plugin for WordPress versions 1.0 through 1.1.2 Description: The issue allows unauthorized access to data due to a missing capability check on the export now function. This enables unauthenticated attackers to download all plugin...