PT-2025-22077 · WordPress · Wordpress Video Robot - The Ultimate Video Importer

Name of the Vulnerable Software and Affected Versions: WordPress Video Robot - The Ultimate Video Importer versions 1.20.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious...

PT-2025-22092 · Potenzaglobalsolutions · Ciyashop

Name of the Vulnerable Software and Affected Versions: Potenzaglobalsolutions CiyaShop versions n/a through 4.18.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 4.18.0, update to a version later tha...

CVE-2025-47945

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47945 Donetick Has Weak Default JWT Secret

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47931

LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting XSS Vulnerability in the group name parameter of the http://localhost/poller/groups form. This vulnerability allows attackers to inject malicious scripts into web...

CVE-2024-13914

The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 file-manager-advanced-shortcode and 2.5.6 advanced-file-manager-pro-premium, via the 'filemanageradvanced' shortcode. This makes it possible for authenticated...

[SECURITY] Fedora 42 Update: webkitgtk-2.48.2-1.fc42

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...

WordPress ARForms Builder plugin < 1.7.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Malek Althubiany in WordPress Plugin ARForms Form Builder versions 1.7.1...

PT-2025-21782 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.5.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpmem user memberships shortcode due to insufficient input sanitization and output escaping on...

PT-2025-21810 · Mozilla +1 · Firefox +1

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Description: The issue allows an attacker to perform an out-of-bounds read or write on a JavaScript Promise object. Recommendations: For Firefox versions prior to 138.0....

CVE-2025-24022

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1...

WordPress Spotlight - Social Media Feeds (Premium) plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

WordPress Spotlight - Social Media Feeds Premium plugin = 1.7.1 - Sensitive Data Exposure vulnerability discovered by Abdi Pranata in WordPress Plugin Spotlight - Social Media Feeds Premium versions = 1.7.1...

PT-2025-21757

Name of the Vulnerable Software and Affected Versions: WatchGuard Fireware OS versions 12.0 through 12.1.1 is incorrect, the correct range is: WatchGuard Fireware OS versions 12.0 through 12.11.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, als...

PT-2025-21722 · Eventon · Eventon

Name of the Vulnerable Software and Affected Versions: EventON versions through 2.4.4 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions through 2.4.4, update to a version...

PT-2025-21725 · Unknown · Mapsvg Lite

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions n/a through 8.6.4 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects MapSVG Lite. This allows for Code Injection. Recommendations: For versions n/...

PT-2025-21714 · Roninwp · Roninwp Fat Services Booking

Name of the Vulnerable Software and Affected Versions: roninwp FAT Services Booking versions n/a through 5.5 Description: The issue affects the roninwp FAT Services Booking, allowing for PHP Local File Inclusion due to an Improper Control of Filename for Include/Require Statement in PHP Program...

PT-2025-21685 · Lambertgroup · Lambertgroup Apollo

Name of the Vulnerable Software and Affected Versions: LambertGroup Apollo versions through 3.6.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. To mitigate the...

PT-2025-21729 · Ultraaddons · Ultraaddons Elementor Lite

Name of the Vulnerable Software and Affected Versions: UltraAddons Elementor Lite versions prior to 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-21675 · Themeton · Themeton Spare

Name of the Vulnerable Software and Affected Versions: themeton Spare versions n/a through 1.7 Description: A Cross-Site Request Forgery CSRF issue affects themeton Spare, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For themeton Spare versions n/a through...

PT-2025-21694 · Thememove · Thememove Quickcal

Name of the Vulnerable Software and Affected Versions: ThemeMove QuickCal versions 1.0.13 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application...