2022

There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme befo

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not in

The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature

The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputtin

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting for

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option me

A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.

Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.

A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parame

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its sett

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creatin

Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products.

A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attack

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks

RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.

In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memo

Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.

Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.

Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.

Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.

A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download ar

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon

mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.

usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.

Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.

Craft CMS before 3.7.29 allows XSS.

A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter

A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Ha

In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.

WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of

NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versi

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specia

A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pastin

Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vuln

The software does not perform any authentication for critical system functionality.

Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal env

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 all

Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-m