PT-2026-36672

Name of the Vulnerable Software and Affected Versions crmeb java versions prior to 1.3.5 Description An unrestricted file upload issue exists within the Admin Upload component, specifically affecting the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java...

GHSA-X57H-XX53-V53W stellar-xdr's StringM::from_str bypasses max length validation

Impact StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM::::fromstrs where s is longer than N bytes succeeds and returns an Ok value instead of ErrError::LengthExceedsMax, producing a StringM that violates its length invariant. This affec...

PT-2026-1482

Name of the Vulnerable Software and Affected Versions BBR Plugins Better Business Reviews versions through 0.1.1 Description An authorization issue exists in BBR Plugins Better Business Reviews, allowing exploitation due to incorrectly configured access control security levels. Recommendations...

PT-2025-53749

Name of the Vulnerable Software and Affected Versions Prasadkirpekar Advanced Custom CSS versions through 1.1.0 Description The software contains a flaw related to improper input handling during web page creation, which allows for Reflected Cross-Site Scripting XSS. This means an attacker could...

PT-2025-53091

Name of the Vulnerable Software and Affected Versions pixelgrade Category Icon versions through 1.0.2 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be...

PT-2025-47050

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.7 through 18.3.6 GitLab CE/EE versions 18.4 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 Description A flaw exists in GitLab CE/EE that could allow a blocked user to access sensitive information. This is...

PT-2025-45339

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.2.15.0 through 2025.3.5.0 Description A flaw in access control allows a View-only user to access sensitive, deeply nested data, specifically custom values within password lists, potentially leading to password...

PT-2025-44759

Name of the Vulnerable Software and Affected Versions CB Project Ltd. Co. CVLand versions 2.1.0 through 20251103 Description An authorization bypass exists in CB Project Ltd. Co. CVLand due to a parameter injection issue. This allows for unauthorized access through user-controlled keys...

PT-2025-44649

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description The software is missing security headers. This can potentially allow for various attacks, though specific details are not provided. Recommendations Update BLU-IC2 to a...

PT-2025-43232

Name of the Vulnerable Software and Affected Versions Barry Kooij Post Connector versions through 1.0.11 Description The software contains a flaw due to improper input neutralization during web page generation, leading to a Reflected Cross-Site Scripting XSS condition. This allows an attacker to...

PT-2025-6766 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: Progress® Telerik® Reporting versions prior to 2025 Q1 19.0.25.211 Description: Information disclosure is possible by a local threat actor through an absolute path vulnerability. This issue allows a local threat actor to potentially disclose...

PT-2025-5446 · Smackcoders · Smackcoders Wp Ultimate Exporter

Name of the Vulnerable Software and Affected Versions: Smackcoders WP Ultimate Exporter versions n/a through 2.9 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows Absolute Path Traversal. This means th...

PT-2025-4910 · Unknown · Notfound Customizable Captcha/Contact Us

Name of the Vulnerable Software and Affected Versions: NotFound Customizable Captcha and Contact Us versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows reflected XSS. This...

PT-2025-5032 · Unknown · Podčlánková Inzerce

Name of the Vulnerable Software and Affected Versions: Podčlánková inzerce versions n/a through 2.4.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-4641 · Unknown · Thomas Maier Image Source Control

Name of the Vulnerable Software and Affected Versions: Thomas Maier Image Source Control versions n/a through 2.29.0 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables...

PT-2025-5034 · Techmix · Event Countdown Timer Plugin

Name of the Vulnerable Software and Affected Versions: Event Countdown Timer Plugin by TechMix versions n/a through 1.4 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows reflected XSS. This problem...

PT-2025-4809 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - ArticleFeedbackv5 versions 1.42.X through 1.42.2 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables attackers to inject malicious scrip...

PT-2025-3238 · Envato · Envato Elements

Name of the Vulnerable Software and Affected Versions: Envato Elements versions n/a through 2.0.14 Description: The issue is related to a Server-Side Request Forgery SSRF problem, which allows for Server Side Request Forgery. This means an attacker can potentially trick the server into making...

PT-2025-1373 · Joomunited · Joomunited Wp Table Manager

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Table Manager versions 3.5.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in JoomUnited WP Table Manager, which allows exploiting incorrectly configured access control security levels...

PT-2025-3183 · Unknown · Kurt Payne Upload Scanner

Name of the Vulnerable Software and Affected Versions: Kurt Payne Upload Scanner versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...