2021

bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee438

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no e

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command inje

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write

A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack a

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command inje

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Co

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary

An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to miss

Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' paramet

Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain pri

Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without res

Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.ph

Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.

Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.

SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.

An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain

A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an a

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can cha

Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be u

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP

The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in t

The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which cou

The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which

The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or B

The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and

The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising

The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before out

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to rese

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not esca

The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' fie

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, all

The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS)

The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes,

The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logg

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit

The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not san

The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, an