PT-2025-24476 · Apptha · Apptha Slider Gallery

Name of the Vulnerable Software and Affected Versions: Apptha Slider Gallery versions n/a through 2.5 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the Apptha Slider Gallery...

PT-2025-24474 · Unknown · Category Icon

Name of the Vulnerable Software and Affected Versions: Category Icon versions 1.0.2 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference vulnerability in Category Icon, which allows XML Entity Linking. Recommendations: For Category Icon version...

PT-2025-24466 · Ancorathemes · Ancorathemes Inset

Name of the Vulnerable Software and Affected Versions: AncoraThemes Inset versions 1.18.0 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local...

PT-2025-24537

Name of the Vulnerable Software and Affected Versions Mikado-Themes GrandPrix versions 1.6 and earlier Description The issue is related to a Path Traversal vulnerability that allows PHP Local File Inclusion. This vulnerability enables an attacker to access and potentially execute local files on t...

PT-2025-24471 · Unknown · Snstheme Sns Anton

Name of the Vulnerable Software and Affected Versions: snstheme SNS Anton versions n/a through 4.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-24510 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions n/a through 2.12.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-24492 · Fantasticplugins · Sumo Affiliates Pro

Name of the Vulnerable Software and Affected Versions: FantasticPlugins SUMO Affiliates Pro versions n/a through 10.7.0 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files. Recommendations: For versions n/a through 10.7.0,...

PT-2025-24497 · Frenify · Frenify Arlo

Name of the Vulnerable Software and Affected Versions: Frenify Arlo versions n/a through 6.0.3 Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion in Frenify Arlo. Recommendations: For versions n/a through 6.0.3, update to a version that fixes this issue,...

PT-2025-24511 · Woocommerce · Holest Engineering Spreadsheet Price Changer

Name of the Vulnerable Software and Affected Versions: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions n/a through 2.4.37 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in ...

CVE-2025-29871

An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later...

CVE-2025-29876

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

PT-2025-24358 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause an information leak through a race condition. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for this issue. At...

PT-2025-24348 · Mops App +1 · Mops App +1

Name of the Vulnerable Software and Affected Versions: moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618 Description: The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in...

CVE-2025-49127

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue...

CVE-2025-33035 File Station 5

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5...

RHSA-2025:8605 Red Hat Security Advisory: mod_security security update

Bulletin has no description...

RHSA-2025:8598 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

Multiple surveillance cameras provided by i-PRO Co., Ltd. vulnerable to cross-site request forgery

Overview Multiple surveillance cameras provided by i-PRO Co., Ltd. contain the following vulnerability. Cross-Site Request Forgery CSRF CWE-352 - CVE-2025-36513 Diego Giubertoni of Nozomi Networks Inc. reported this vulnerability to i-PRO Co., Ltd. and coordinated. After the coordination was...

PT-2025-24135 · WordPress · Viral Loops Wp Integration

Name of the Vulnerable Software and Affected Versions: Viral Loops WP Integration versions 3.8.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Viral Loops ...

PT-2025-24154 · Deetronix · Deetronix Booking Ultra Pro

Name of the Vulnerable Software and Affected Versions: Deetronix Booking Ultra Pro versions 1.1.20 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...