2021

The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sa

The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and s

The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validat

The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose proj

A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manag

A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Poli

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remot

Easytest bulletin board management function of online learning platform does not filter special characters. After obtain

The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL c

The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s priv

The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’

The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user

The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title p

A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPas

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachmen

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Ref

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Obj

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploita

Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject

In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and p

A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.h

Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.htm

In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Ther

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do

The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a locati

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in u

The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a s

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, r

The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scri

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path trave

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation r

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect

A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC i

A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new

A stored cross-site scripting (XSS) vulnerability in the getClientIp function in /lib/tinwin.class.php of Chaoji CMS 2.3

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive da

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive da

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive da

A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive da

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read

A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 an

LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the Led