2021

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of

The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course setting

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow u

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [av

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allow

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform an

The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fi

The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in mul

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in pl

The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in

The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape

The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes

The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its sh

The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allow

The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters fro

A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow att

A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attack

myfactory.FMS before 7.1-912 allows XSS via the Error parameter.

myfactory.FMS before 7.1-912 allows XSS via the UID parameter.

Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.

A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than th

A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPas

A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPas

Adobe Connect version 11.2.3 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an at

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-si

A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s):

vim is vulnerable to Heap-based Buffer Overflow

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation an

The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitizat

The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sa

The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and s

The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validat

The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose proj

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remot

Easytest bulletin board management function of online learning platform does not filter special characters. After obtain

The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s priv

The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’

The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title p

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploita

In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and p

Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.htm

In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross