2022

Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /Admin/a

Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in changepa

A cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrar

UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image:

This update resolves a multi-factor authentication bypass attack

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The us

The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. R

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functional

The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 befo

Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrato

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Open

Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.

Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.

A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compressio

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.

IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Forc

Poultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/c

Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed passwo

Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.

Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.

Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).

AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara

Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions pr

Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlim

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML respon

An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a c

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow a

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is mi

The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow

The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high

The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, wh

The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high pri

The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allo

The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could

The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, whi

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could al

The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in

The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL sta

The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which coul

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2

The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could

The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded bel