2022

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting i

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact for

The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outpu

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the u

The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outpu

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sa

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicio

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could

The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin da

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter befor

The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, whic

The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high p

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_

The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an a

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with cla

The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any

GPAC 1.0.1 is affected by Use After Free through MP4Box.

GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().

Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.

A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: Sm

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.

Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.

Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have

phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).

An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as dem

An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of eve

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BH

An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitiv

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.

Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.

An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal.

An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the O

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Inform

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is p

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo param

Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugi

Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in

Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerabili

Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed

Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff fil