2022

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index

This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.

This affects all versions of package node-latex-pdf.

This affects all versions of package curljs.

This affects all versions of package s3-kilatstorage.

This affects all versions of package monorepo-build.

Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.

Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname pa

Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_

Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoicep

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editprod

Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or passwo

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbran

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcate

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.

Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connect

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discu

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions a

Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custo

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized paymen

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsIn

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor tha

DSpace open source software is a repository application which provides durable access to digital resources. In affected

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames v

The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were foun

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulner

mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, eve

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to sen

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on N

Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static asset

PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to

Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injec

eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged i