2022

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set

Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page co

GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.

fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git re

The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_rep

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do no

IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could a

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which co

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper va

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability all

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by impro

IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to byp

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen

The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX

The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does n

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege

The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high priv

The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users

The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege use

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high priv

The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users su

The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_dat

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos par

The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter be

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or a

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s paramete

The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the pos

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in so

The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_s

The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter b

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting i

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby param

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact for

The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outpu

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 pa

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the u

The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outpu

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sa

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-s

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicio

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could

The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, le