2023

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compa

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_requir

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_requir

A vulnerability was found in mapoor voteapp. It has been rated as critical. Affected by this issue is the function creat

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects t

Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on

Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Wid

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. Speci

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.

In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, p

In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return

The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 75

In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be abl

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive

workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits

The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputt

The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes befo

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes be

The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before o

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating setti

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could al

The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its set

The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings

The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could

The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it ba

The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the pa

The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting

The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which c

The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it bac

The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allo

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a te

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its

The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow hig

A vulnerability classified as critical has been found in CherishSin klattr. This affects an unknown part. The manipulati

A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.

Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted str

A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function g

A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unkno

A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageR

Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit t

Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped tok

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of ser

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with N

A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown co

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry ou

Information disclosure due to buffer overread in Core