2022

The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da

The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirm

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could

The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which c

The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options v

The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous par

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in

The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before usi

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege u

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perfo

The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in

The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege

The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, whic

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting

The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which co

D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execut

RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url par

RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the

MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.

Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in `SetIPv6Status` function

D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli.

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog pe

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host

relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in cert

Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated us

Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of thi

A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restr

ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream positi

A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to

A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather cred

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist an

An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kio

In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were s

nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacke

A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remo

All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attribute

This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbi

The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when int

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom loc

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Ex

All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a ma

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeRepl

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks fo

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user inpu