2021

The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the pa

The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as c

The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their conte

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when upda

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users

The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make

The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes,

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleti

The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a templat

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could al

The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could

The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields whe

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from lo

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response i

Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin pa

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a di

snipe-it is vulnerable to Improper Access Control

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.

All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.

All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-mid

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains

IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a s

Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), cou

openwhyd is vulnerable to URL Redirection to Untrusted Site

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a special

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan

A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclos

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local us

Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote

A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description pa

An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password r

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions