2022

Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attac

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.

Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.

Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.

Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

The microweber application allows large characters to insert in the input field "post title" which can allow attackers t

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (loc

Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.

sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that u

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-al

Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compresse

Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compr

Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page co

IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper va

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability all

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by impro

IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to byp

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does n

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege

The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high priv

The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users

The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege use

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high priv

The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users su

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos par

The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter be

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or a

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s paramete

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in so

The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_s

The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter b