PT-2025-16968 · Vicente Ruiz Gálvez · Vr-Frases

Name of the Vulnerable Software and Affected Versions: Vicente Ruiz Gálvez VR-Frases versions 3.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means that an attacker...

PT-2025-17063 · WordPress · Wp Video Posts

Name of the Vulnerable Software and Affected Versions: WP Video Posts versions 3.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

SUNNET Wisdom Master Pro 安全漏洞

SUNNET Wisdom Master Pro is a Wisdom Master management platform from SUNNET. A security vulnerability exists in SUNNET Wisdom Master Pro 5.2 and earlier versions, which stems from a lack of authorization and could lead to a remote attacker obtaining some user data...

PT-2025-17192 · Unknown · Arigato Autoresponder/Newsletter

Name of the Vulnerable Software and Affected Versions: Arigato Autoresponder and Newsletter versions n/a through 2.7.2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means tha...

PT-2025-17070 · Woocommerce · 17Track For Woocommerce

Name of the Vulnerable Software and Affected Versions: 17TRACK for WooCommerce versions 1.2.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can...

PT-2025-17047 · Radiustheme · Radiustheme Classified Listing

Name of the Vulnerable Software and Affected Versions: RadiusTheme Classified Listing versions n/a through 4.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-17111 · Unknown · Hamburger Icon Menu Lite

Name of the Vulnerable Software and Affected Versions: Hamburger Icon Menu Lite versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker ca...

PT-2025-17069 · Woocommerce · Bappa Mal Qr Code For Woocommerce

Name of the Vulnerable Software and Affected Versions: Bappa Mal QR Code for WooCommerce versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...

PT-2025-17102 · Woocommerce · Wallet System For Woocommerce

Name of the Vulnerable Software and Affected Versions: Wallet System for WooCommerce versions n/a through 2.6.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-17036 · Unknown · Bitsstech Shipment Tracker For Woocommerce

Name of the Vulnerable Software and Affected Versions: bitsstech Shipment Tracker for Woocommerce versions 1.4.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...

PT-2025-17075 · Deetronix · Deetronix Booking Ultra Pro

Name of the Vulnerable Software and Affected Versions: Deetronix Booking Ultra Pro versions 1.1.19 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-17093 · Unknown · Terminal Africa

Name of the Vulnerable Software and Affected Versions: Terminal Africa versions 1.13.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that an attacker can...

CVE-2025-24909

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-32789 EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function

EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...

CVE-2025-32789

EspoCRM (open-source CRM) prior to version 9.0.7 is affected by a vulnerability in the user password hashing disclosure feature. The issue allows an attacker to infer other users’ password hashes by sorting the user list by the password hash, potentially enabling password changes if the attacker ...

CVE-2025-27929 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-24850

Growatt Cloud Applications vulnerability CVE-2025-24850 allows exporting other users’ plant information due to improper access control/auth handling. Documented effects include exposure of user plant data and other sensitive information across API endpoints. Connected sources cite the advisory fr...

SicommNet multiple vulnerabilities

RISK EVALUATION SicommNET BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain...

CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...

CVE-2025-3575

CVE-2025-3575 affects Deporsite from T-INNOVA. The vulnerability is an Insecure Direct Object Reference allowing an attacker to retrieve sensitive information from other users through the idUsuario parameter at /helper/Familia/establecerUsuarioSeleccion. The CVE entry notes a high impact with CVS...