2023

gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrari

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Ac

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions.

SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking

A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earli

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with no

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operat

VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest vi

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulne

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regis

Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.

ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).

Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName pa

An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Conten

Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS

An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker c

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticat

Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides

Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protecte

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrar

An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to

A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue

Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcem

In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsi

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lac

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force

A vulnerability was found in PHPGurukul Online Railway Catering System 1.0. It has been classified as critical. Affected

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user

Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow a

NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary

Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORI

The application interface allows users to perform certain actions via HTTP requests without performing any validity ch

A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical

Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbit

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various i

The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.

A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conv

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, p

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin

The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_ge

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into th

Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecifi