2023

The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting a

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputti

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` A

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the ch

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its

The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple

The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes befo

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attack

Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitra

The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow

Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitra

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execu

A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such a

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious acto

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the d

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker w

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to differe

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user cli

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a me

Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink prev

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post.

The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is

A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects th

A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerabili

A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknow

A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management Sys

A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is

A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System

A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as c

A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionali

Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the

A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unkn

A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main

A vulnerability classified as problematic has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This a

A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown func

An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful lo

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an import

A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the

A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnera

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter t

Usedesk before 1.7.57 allows profile stored XSS.

Usedesk before 1.7.57 allows filter reflected XSS.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by