2021

College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters

An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in t

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (wit

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB

Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remo

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a l

Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privileg

SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filter

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAc

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordMo

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in custom

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and

HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. The USB laf gadget has a us

An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security pr

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. In preloaded applications,

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform

Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely pass

The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set p

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentica

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerabili

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution v

PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotel

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service

This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments

loklak is an open-source server application which is able to collect messages from various sources, including twitter. T

The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead

A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl

An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permi

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the na

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the na

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attacker

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance para

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail paramet

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, maliciou

Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters,

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request pa