2021

Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via

Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to ex

Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute

SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. Thi

Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and

Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function. Thi

An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data.

ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scri

A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute

Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scriptin

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirs

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `D

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerab

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic

Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. This vu

Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in th

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the pat

Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitiv

Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder func

Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the pat

Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to

MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handlin

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumsta

Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to lo

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it al

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability al

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.

The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can l

The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to acco

The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontr

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read gl

The affected product’s web application does not properly neutralize the input during webpage generation, which could all

The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable f

The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide

The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps duri

In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to

In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deput

In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missin

In sanitizeSbn of NotificationManagerService.java, there is a possible way to keep service running in foreground and kee

In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage. This could lead to

In RevertActiveSessions of apexd.cpp, there is a possible way to share the wrong file due to an unintentional MediaStore

In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due t

In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to in

In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without

In multiple methods of AAudioService, there is a possible use-after-free due to a race condition. This could lead to loc