CVE-2025-29877

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

PT-2025-24085

Name of the Vulnerable Software and Affected Versions ThemeGoods Photography versions prior to 7.5.3 Description The issue is related to Deserialization of Untrusted Data. This affects ThemeGoods Photography, allowing potential exploitation. Recommendations For versions prior to 7.5.3, update to...

PT-2025-24250 · Gamipress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions n/a through 7.4.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2025-24240 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.8.6 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24191 · Cubewp · Cubewp

Name of the Vulnerable Software and Affected Versions: CubeWP – All-in-One Dynamic Content Framework versions 1.1.23 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For CubeWP – All-in-One Dynamic...

PT-2025-24201 · Unknown · Everest Backup

Name of the Vulnerable Software and Affected Versions: Everest Backup versions n/a through 2.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.3.3, update to a version later than 2.3....

PT-2025-24072 · Quickcab · Quickcab

Name of the Vulnerable Software and Affected Versions: QuickCab versions 1.3.3 and earlier Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain features or...

PT-2025-24231 · Unknown · Wpsoul Greenshift

Name of the Vulnerable Software and Affected Versions: wpsoul Greenshift versions n/a through 11.5.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This means that an attacker coul...

PT-2025-24180 · Unknown · Advanced Post List

Name of the Vulnerable Software and Affected Versions: Advanced Post List versions 0.5.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Advanced Post List...

PT-2025-24305 · Unknown · Qsync Central

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.6 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, this issue could allow remote attackers who have gained user access to execute unauthorized code or...

PT-2025-24119 · Unknown · Simple Google Static Map

Name of the Vulnerable Software and Affected Versions: Simple Google Static Map versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS in Ángel C. Simple Google...

PT-2025-24164 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: Broadly for WordPress versions 3.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-24221 · WordPress · Wp Table Builder

Name of the Vulnerable Software and Affected Versions: WP Table Builder versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a malicious...

PT-2025-24117 · Unknown · Nir Complete Google Seo Scan

Name of the Vulnerable Software and Affected Versions: Nir Complete Google Seo Scan versions 3.5.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24182 · Unknown · Nexa Blocks

Name of the Vulnerable Software and Affected Versions: Nexa Blocks versions 1.1.0 and earlier Description: A Server-Side Request Forgery SSRF issue affects Nexa Blocks, allowing for Server Side Request Forgery. Recommendations: For versions 1.1.0 and earlier, update to a version that contains a f...

PT-2025-24141 · Woocommerce · Direct Checkout For Woocommerce Lite

Name of the Vulnerable Software and Affected Versions: Direct Checkout for WooCommerce Lite versions 1.0.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions...

PT-2025-24255 · Unknown · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership versions through 4.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24316 · Spicedb · Spicedb

Name of the Vulnerable Software and Affected Versions: SpiceDB versions prior to 1.44.2 Description: The issue affects SpiceDB, an open source database for storing and querying fine-grained authorization data. On schemas involving arrows with caveats on the arrow'ed relation, when the path to...

PT-2025-24252 · WordPress · Store Locator

Name of the Vulnerable Software and Affected Versions: Store Locator WordPress versions n/a through 1.5.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...