2022

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdr

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdr

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.

Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arb

Online Fire Reporting System v1.0 was discovered to contain a SQL injection vulnerability via the GET parameter in /repo

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerab

Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vuln

A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: pos

DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 ve

Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrus

attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.

The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: userna

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATE

Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect

HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause dis

The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerab

AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affec

The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data co

The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confiden

The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulner

The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system ava

The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient es

The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in vers

The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in v

Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which ca

Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, includin

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them bac

A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execu

A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute

Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.

Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and includi

The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parame

The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow h

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow a

The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which c

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, w

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.

The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allo

The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could a

The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an ad

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is re

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which coul

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows c

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This

The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, whic

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t