2023

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versio

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling pl

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Cancel order request / Return order / R

User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the de

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the de

Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Con

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Af

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Order date, Order pickup, Order date ti

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect,

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. Bloc

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affe

INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, pag

Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pi

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyIn

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the so

A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0. It has been declared as critical. Affected by t

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum

end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dep

In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.

Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_

The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' an

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible b

Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible b

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection

OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible bec

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server vers

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform

Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client sid

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform

PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Pr

AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in c

Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to v

Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task agains

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file s

POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename p

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parame

A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment

In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious inp