PT-2025-14857 · M Files · M-Files Web

Name of the Vulnerable Software and Affected Versions: M-Files Web versions 25.1.14445.5 through 25.2.14524.4 Description: The issue allows an authenticated user to run scripts, which is a result of a stored XSS. This enables the execution of malicious scripts by authenticated users...

PT-2025-14957 · Unknown · Tockify Events Calendar

Name of the Vulnerable Software and Affected Versions: Tockify Events Calendar versions through 2.2.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker coul...

PT-2025-14984 · Woocommerce · Ni Woocommerce Cost Of Goods

Name of the Vulnerable Software and Affected Versions: Anzar Ahmed Ni WooCommerce Cost Of Goods versions 3.2.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject...

PT-2025-15019 · Jobwp · Jobwp

Name of the Vulnerable Software and Affected Versions: JobWP versions 2.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 2.3.9 and earlier, update to a versio...

CVE-2025-31483

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...

WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin CM Header and Footer versions = 1.2.4...

PT-2025-14755 · Unknown · Social Share/Social Locker

Name of the Vulnerable Software and Affected Versions: Social Share And Social Locker versions 1.4.2 and earlier Description: The issue is related to improper neutralization of special elements used in SQL commands, allowing Blind SQL Injection. This can be exploited due to the improper handling ...

PT-2025-14796

Name of the Vulnerable Software and Affected Versions API Platform Core versions prior to 4.0.22 Description The issue concerns a caching problem in GraphQL grants on properties, which can lead to incorrect caching with different objects. The...

PT-2025-14723 · Peprodev · Peprodev Cf7 Database

Name of the Vulnerable Software and Affected Versions: PeproDev CF7 Database versions through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can...

PT-2025-27665

Name of the Vulnerable Software and Affected Versions: llama index versions prior to 0.12.28 llama index version 0.12.28 Description: The JSONReader in the affected software is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This allows attackers to trigger a Denial of...

PT-2025-14868 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide versions prior to 0.42.0 Description: The issue arises from gitoxide's use of SHA-1 hash implementations without collision detection, making it vulnerable to hash collision attacks. This means two distinct Git objects with colliding...

PT-2025-14784 · Dowisp · Dowisp

Name of the Vulnerable Software and Affected Versions: DoWISP versions prior to 1.16.2.50 Description: The issue is related to a Stored Cross-Site Scripting XSS in DoWISP, where an attacker can upload a profile picture in SVG format containing malicious JavaScript code, leading to the execution o...

PT-2025-14777 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2024.3 JetBrains IntelliJ IDEA version 2024.2.4 Description: The issue concerns the logging of source code in the idea.log file. Recommendations: For versions prior to 2024.3, update to version 2024.3...

PT-2025-14609 · Fancybox +1 · Fancybox +1

Name of the Vulnerable Software and Affected Versions: Modula Image Gallery plugin for WordPress versions prior to 5.0.36 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the bundled FancyBox JavaScript library. This allows...

PT-2025-14741 · Frank P. Walentynowicz · Fpw Category Thumbnails

Name of the Vulnerable Software and Affected Versions: Frank P. Walentynowicz FPW Category Thumbnails versions 1.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

PT-2025-09: Path Traversal in TCPDF

The application performs insufficient validation of relative paths when processing SVG image. Bypassing validation using the payload allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequent inclusion of...

PT-2025-14786

Name of the Vulnerable Software and Affected Versions Vite versions 6.0.0 through 6.0.13 Vite versions 6.1.0 through 6.1.3 Vite versions 6.2.0 through 6.2.4 Vite version 4.5.11 and earlier Vite version 5.4.16 and earlier Description The issue allows the contents of arbitrary files to be returned ...

PT-2025-94: Local Privilege Escalation in Pritunl

The vulnerability was identified in Pritunl, version 1.3.4099.99. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 03.04.2025 Recommendations: Update to version 1.3.4220....

PT-2025-14711 · Unknown · Cm Header/Footer

Name of the Vulnerable Software and Affected Versions: CM Header and Footer versions 1.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...