2021

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before s

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attr

The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could all

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which co

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputtin

The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before u

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contrib

The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its

The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high pr

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, a

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL stateme

The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribut

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, whi

The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET pa

The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in th

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing se

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as report

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simpl

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a Lis

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass t

janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted with

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a mali

BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions use

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS.

A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-serv

Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (version

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin

Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-

ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW functi

HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to oper

The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket

An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before versi

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service p

An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerabil

A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability all

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execut

Gin-Vue-Admin before 2.4.6 mishandles a SQL database.

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and consol