2022

D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the F

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file informa

Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrar

A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certific

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is re

A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s):

A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager

A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s):

xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.

xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisa

xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisv

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lea

Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on caref

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual mess

Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repositor

The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an includ

The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an at

The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to

The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow hi

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before out

The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number paramet

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not valid

The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network s

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputti

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that

The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subti

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not valid

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which

The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting i

The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which co

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable befo

The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before ou

The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, whic

The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanit

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting

Code Injection in GitHub repository publify/publify prior to 9.2.8.

Improper Access Control in GitHub repository publify/publify prior to 9.2.8.

Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.

A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execut

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.

Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka super

xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a