2023

Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even wh

Discourse is an open source platform for community discussion. A malicious request can cause production log files to qui

Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Sc

dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar i

IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a spec

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of servic

Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a cra

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custo

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been ide

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been ide

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). I

SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allo

Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin p

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of servic

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attacke

The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existen

The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activi

This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted header

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect W

The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher fr

The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which co

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffe

The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could

The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some p

The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores

The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS b

The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments wh

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dan

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url f

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded

The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could

The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users s

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed

The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes

The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attrib

The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before

The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimite

The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could all

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a

The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post

The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server fr

The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes befo

The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which

The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privil

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting i

The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server wa