2023

The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible t

This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a R

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCR

The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library th

A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl

An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDR

An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDR

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively w

A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affe

A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPre

A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPr

SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remot

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use t

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the log

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backen

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1

OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every versi

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command para

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser para

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnera

A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the

In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the ser

The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset func

PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP

IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed

Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afte

Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create m

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacke

A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial

In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.

A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vu

A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. Th

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, p

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups managemen

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management sect

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions managem

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definitio