2022

The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privile

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a ro

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privi

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputt

The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking san

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad ac

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper author

A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation lea

A vulnerability has been found in Anvsoft PDFMate PDF Converter Pro 1.7.5.0 and classified as critical. The manipulation

There is an elevation of privilege breakout vulnerability in the Windows EXE installer in Scooter Beyond Compare 4.2.0 t

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view tem

Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to lea

Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker t

Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had com

Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a u

Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local at

Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote att

Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstal

Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.

Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.

Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testim

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacke

Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.

A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36. This issue affects

A vulnerability classified as critical was found in Itech Movie Portal Script 7.36. This vulnerability affects unknown c

A vulnerability classified as critical has been found in Itech Movie Portal Script 7.36. This affects an unknown part of

A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is

A vulnerability was found in Itech Movie Portal Script 7.36. It has been declared as critical. Affected by this vulnerab

Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to injec

Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the

A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scannin

Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/b

QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerabilit

Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.

The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and

The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions pri

The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Tem

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a membe

Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 ta

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.