PT-2025-5807 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Defense Platform Home Edition versions 3.9.51.x and earlier Description: The issue is related to improper neutralization of argument delimiters in a command, also known as 'Argument Injection'. This can cause a denial-of-service DoS condition...

PT-2025-5801 · Woocommerce · Curcy – Multi Currency For Woocommerce

Name of the Vulnerable Software and Affected Versions: The CURCY – Multi Currency for WooCommerce versions up to, and including, 2.2.5 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to improper input validation (CVE-2024-52901)

Summary A vulnerability in IBM InfoSphere Information Server due to improper input validation was addressed. Vulnerability Details CVEID:CVE-2024-52901 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated user to GUI to not load or stop working due to improper input...

CVE-2020-2746

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Admin privilege with network access via HTTP to compromise...

CVE-2020-2549

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components. The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2024-29187

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...

CVE-2024-1358

The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on th...

CVE-2024-1773

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-1731

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arspoptions post meta option. This makes it possible for authenticated attackers, with contributor-level access and...

Advantive VeraCore 安全漏洞

Advantive VeraCore is a SaaS order and warehouse management software from Advantive. A security vulnerability exists in Advantive VeraCore version 2025.1.0 and earlier, which stems from the presence of an SQL injection in timeoutWarning.asp that allows remote attackers to execute arbitrary SQL...

CVE-2025-0970

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The...

Exploit for CVE-2025-24659

CVE-2025-24659 1️⃣ Component type WordPress plugin 2️...

PT-2025-1612

Name of the Vulnerable Software and Affected Versions The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress versions up to, and including, 1.5.9 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to...

PT-2025-4762 · Ctfd · Ctfd

Name of the Vulnerable Software and Affected Versions: CTFd version 3.7.5 Description: A Host Header Injection issue exists due to the application's failure to properly validate or sanitize the Host header. This allows an attacker to manipulate the Host header in HTTP requests, potentially leadin...

Unraid OS < 6.8.1 Web UI RCE Vulnerability - Version Check

Unraid OS is prone to a remote code execution RCE vulnerability in the Web UI. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-2127 · WordPress · Stockdio Historical Chart

Name of the Vulnerable Software and Affected Versions: Stockdio Historical Chart plugin for WordPress versions up to, and including, 2.8.18 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode due to insufficient input sanitizatio...

PT-2025-5608

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 1.6.1 Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.5 Description The issue is related to arbitrary remote code execution when accessing a malicious website while the Vitest API server is listening, due t...

PT-2025-3351 · Beautycam · Beautycam

Name of the Vulnerable Software and Affected Versions: BeautyCam iOS version 12.3.60 Description: An issue in BeautyCam iOS allows attackers to access sensitive user information via supplying a crafted link. Recommendations: For BeautyCam iOS version 12.3.60, update to a newer version that contai...

Dolibarr 安全漏洞

Dolibarr is a Dolibarr open source application. It can help manage the activities of user organizations. A security vulnerability exists in Dolibarr v21.0.0-beta, which stems from the vulnerability of the Product module to a cross-site scripting attack, where an attacker can execute arbitrary web...

PT-2025-5637 · Pypi · Uniapi

Name of the Vulnerable Software and Affected Versions: uniapi version 1.0.7 Description: The issue concerns code introduced in uniapi version 1.0.7 that executes upon import of the module. This code downloads a script from a remote URL and then runs the downloaded script in a thread, which harves...