2023

Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulne

An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing applicatio

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on t

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbi

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbi

Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows att

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensu

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it

The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in use

The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high pr

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s

The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high pri

The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outp

NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the defau

The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not proper

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.

PowerShell Information Disclosure Vulnerability

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.

Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.

in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through t

in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.

in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitia

in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to chan

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior

A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from

Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This

Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3

Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Ess

Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML

Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a t

Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: fro

Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue af

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi

Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/

Cross-Site Request Forgery (CSRF) vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar:

Cross-Site Request Forgery (CSRF) vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best

Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Comm