First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-10174

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding.

This issue affects PanCafe Pro: from < 3.3.2 through 23092025.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Pan Software & Information Technologies Ltd.	PanCafe Pro	>= < 3.3.2, <= 23092025

References

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-101756.5The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due CVE-2025-101767.2The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valida CVE-2025-101786.4The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode CVE-2025-101796.4The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, a CVE-2025-10185.3The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to per CVE-2025-101806.4The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versio CVE-2025-101816.4The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, CVE-2025-101826.4The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and CVE-2025-101839.1A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to e CVE-2025-101848.2The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provid CVE-2025-101854.9The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the CVE-2025-101865.3The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a mis

CVE-2025-10174: High severity, CVSS 8.3 | Vulnix