PT-2025-24564 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 11.0.0 Description: The issue allows an authenticated attacker to create a HAX site with a website block that can load another site in an iframe, potentially leading to phishing attacks. When a user visits the...

PT-2025-24543 · Vigybag · Vigybag

Name of the Vulnerable Software and Affected Versions: Vigybag versions 1.0 and before Description: The issue is related to Cross Site Scripting XSS via the upload profile picture function under the user's profile. This allows for potential malicious script execution. No information is provided...

PT-2025-24469 · Avaz · Avaz

Name of the Vulnerable Software and Affected Versions: Avaz versions n/a through 2.8 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in the Avaz them...

PT-2025-24524 · Unknown · Wc Myparcel Belgium

Name of the Vulnerable Software and Affected Versions: WC MyParcel Belgium versions 4.5.5 through beta Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-24479 · Lambertgroup · Lambertgroup Revolution Video Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Revolution Video Player versions through 2.9.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-24508 · Click5 · Click5 History Log

Name of the Vulnerable Software and Affected Versions: History Log by click5 versions 1.0.0 through 1.0.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

laravel-translation-manager Cross-Site Scripting Vulnerability

laravel-translation-manager is a barryvdh personal developer for managing Laravel translation files. A cross-site scripting vulnerability exists in laravel-translation-manager versions prior to 0.6.8, which stems from improper input validation and cleanup, and could lead to cross-site scripting...

CVE-2025-48328

Cross-Site Request Forgery CSRF vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through = 1.7.0...

CVE-2025-41365

CVE-2025-41365 describes a code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The flaw allows an attacker to store a malicious payload that runs in the victim’s browser. Exploitation requires authentication to the device and commands with permissions higher than the view...

RHSA-2025:8607 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

PT-2025-24054 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache versions prior to the fixed version Description: A missing protection against path traversal allows access to any file on the server. This issue affects the Apache software, allowing unauthorized access to files. Recommendations: For...

PT-2025-24120 · WordPress · Seerox Wp Media File Type Manager

Name of the Vulnerable Software and Affected Versions: Seerox WP Media File Type Manager versions 2.3.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For Seerox WP Media Fi...

PT-2025-24268 · Unknown · Minhlaobao Admin Notes

Name of the Vulnerable Software and Affected Versions: minhlaobao Admin Notes versions n/a through 1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For versions n/a through 1.1, update to a version that includes...

PT-2025-24207 · Unknown · Vova Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: Vova Shortcodes Ultimate versions 7.3.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-24266 · Unknown · Bacon Ipsum

Name of the Vulnerable Software and Affected Versions: Bacon Ipsum versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicio...

PT-2025-24240 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.8.6 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24198 · Unknown · Rtmkit Addons For Elementor

Name of the Vulnerable Software and Affected Versions: RTMKit Addons for Elementor versions 1.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2025-24176 · WordPress · Wp Gravity Forms Constant Contact Plugin

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Constant Contact Plugin versions 1.1.0 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing. This vulnerability can be...

PT-2025-24229 · Unknown · Bastien Ho Event Post

Name of the Vulnerable Software and Affected Versions: Bastien Ho Event post versions n/a through 5.10.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the Event post...

PT-2025-24114 · Unknown · Cmsminds Pay With Contact Form 7

Name of the Vulnerable Software and Affected Versions: cmsMinds Pay with Contact Form 7 versions 1.0.0 through 1.0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack...