2022

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated us

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-se

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form compo

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

Path Traversal in NPM w-zip prior to 1.0.12.

The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data befor

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthent

A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the

h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory.

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the auth

The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publi

The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauth

The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attack

The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore

The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when delet

The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputt

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sen

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests

The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high priv

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area pa

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter befor

The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it b

The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it i

The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow

The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthent

The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before o

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[sessio

The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_s

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not ha

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, whi

The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in

The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before

Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is v

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an i

gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a

In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`,

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f

Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessin

Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.