2022

Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /

The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC

Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted

Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing

Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Comman

Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands”

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_con

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/use

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_aler

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) o

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) o

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_sav

DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadat

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2

QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine a

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebu

Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.

SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.

SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.

SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress.

An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all vers

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions start

SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.

SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.

Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.

Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.

Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.

Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /p

Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_acti

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depe

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disab

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect

It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'

A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing o