2022

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upl

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php.

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code t

Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19

Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to ve

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be

Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG ima

Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19

A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges.

An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys (

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authenticatio

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM)

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, a

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lea

stored xss in GitHub repository getgrav/grav prior to 1.7.33.

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te

Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF).

Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code vi

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticati

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorr

flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a serve

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to ver

A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to t

SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with

Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on Word

Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an a

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload execut

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to pars

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting fr

Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at

Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at

Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7

Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.

PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects

IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an

The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it i

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include state

The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in requ

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address"

The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high priv

The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in v

The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in

The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high p