2023

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page,

The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow a

The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high pr

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings,

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1

The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allo

The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over

phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versio

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Notifyvisitors NotifyVisitors plugin <= 1.0 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <= 3.5.1 versions.

The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.

An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF charac

The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in ve

The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in

AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.

AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai

A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers

Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via

An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list

A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F

A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving spe

An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges coul

A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover st

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Message

On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxm

On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tun

In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant r

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configu

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other

Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data

A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue

Buffer Overflow vulnerability in Libming Libming v.0.4.8 allows a remote attacker to cause a denial of service via a cra

An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated pri

An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated priv

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs coul