2022

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.

Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend a

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outpu

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching boo

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attac

The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new soci

The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before

The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it

The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter befo

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it bac

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functio

The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in vari

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape t

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attri

A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware versi

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.

Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.

A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary

Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to a

Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers t

A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbi

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scr

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.

zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /ph

XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers

A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to

A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue a

A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a req

Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminf

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitc

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_pr

Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app int

A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account ta

Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local maliciou

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user wi

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user wi

Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation

Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged user

A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque

Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin

Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users ca