PT-2025-24429 · Tcman · Tcman'S Gim

Name of the Vulnerable Software and Affected Versions: TCMAN's GIM version 11 Description: The issue is related to incorrect authorization, allowing an unprivileged attacker to modify user permissions by sending a POST request to "/PC/Options.aspx?Command=2&Page=-1". This enables the attacker to...

PT-2025-24517 · Unknown · Relentlo Styleai

Name of the Vulnerable Software and Affected Versions: relentlo StyleAI versions 1.0.0 through 1.0.4 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 1.0.0 through 1.0.4...

PT-2025-24534

Name of the Vulnerable Software and Affected Versions Unfoldwp Magways versions 1.2.1 and earlier Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. Thi...

PT-2025-24519 · Unknown · Alex Zaytseff Multi Cryptocurrency Payments

Name of the Vulnerable Software and Affected Versions: Alex Zaytseff Multi CryptoCurrency Payments versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injectio...

PT-2025-24393 · Unknown · Phpgurukul Nipah Virus Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Nipah Virus Testing Management System version 1.0 Description: A critical issue was found in the PHPGurukul Nipah Virus Testing Management System. The problem affects an unknown function of the file "/patient-report.php". The...

PT-2025-24485 · Unknown · Lambertgroup Sticky Radio Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Sticky Radio Player versions n/a through 3.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-24522 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX versions through 4.2.22 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions through 4.2.22, update to a version later...

PT-2025-24352 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A Cross-Site Request Forgery CSRF issue is mentioned, but details are limited due to the rejection or withdrawal of the associated identifier by its authority. No information is provided abo...

PT-2025-24348 · Mops App +1 · Mops App +1

Name of the Vulnerable Software and Affected Versions: moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618 Description: The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in...

Unauthenticated Remote Code Execution (RCE)

github.com/kro-run/kro is vulnerable to Unauthenticated Remote code execution RCE. The vulnerability is due to a confused-deputy scenario, where users with permission to create or modify ResourceGraphDefinition resources can supply arbitrary container images that kro's controllers deploy and run ...

PT-2025-24258 · Konami · Konami Easter Egg

Name of the Vulnerable Software and Affected Versions: Konami Easter Egg versions n/a through v0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Konami Easter Egg. Recommendations: For versions n/a through v0.4, update to a version that...

PT-2025-24224 · Wpforms · Pdf For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF for WPForms versions 5.5.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited through the add-ons.or...

PT-2025-24295 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4791 Description: An improper certificate validation issue has been reported, which could allow remote attackers with user access to compromise system security. Recommendations: For versions prior to...

PT-2025-24097 · Idf +1 · Idf +1

Name of the Vulnerable Software and Affected Versions: IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability that allows an attacker to store malicious JavaScript payload in the software, which will run in the victim's...

PT-2025-24241 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.8.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-24110 · Unknown · Whassan Ki Live Video Conferences

Name of the Vulnerable Software and Affected Versions: whassan KI Live Video Conferences versions n/a through 5.5.15 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For...

PT-2025-24179 · Unknown · Onoffice For Wp-Websites

Name of the Vulnerable Software and Affected Versions: onOffice for WP-Websites versions n/a through 5.7 Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For versions n/...

PT-2025-24145 · Unknown · Faaiq Custom Category/Post Type Post Order

Name of the Vulnerable Software and Affected Versions: faaiq Custom Category/Post Type Post order versions 1.5.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations:...

PT-2025-24389 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 Description: A critical issue has been found in the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely...

PT-2025-24300 · Synology · File Station

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4847 Description: A NULL pointer dereference issue allows a remote attacker with a user account to launch a denial-of-service DoS attack. Recommendations: For versions prior to 5.5.6.4847, update to...