2021

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and mod

SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An

Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 Th

A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unaut

fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.

Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenti

Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows una

Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unau

Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unau

The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data para

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before usi

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the l

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id par

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider par

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as w

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attri

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other p

The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the pa

The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before

The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using i

The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as c

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which

The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their conte

The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authentic

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when upda

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users

The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make

The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes,

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleti

The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a templat

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could al

The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could

The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields whe

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from lo

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_a

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response i

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_

An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable a

An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or a