2023

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart pl

A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a spec

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interf

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interf

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interf

An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rocket Apps Open Graphite plugin <= 1.6.0 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <= 1.1.8 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin <= 12.1.20 vers

The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user i

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page short

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outp

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to upda

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauth

The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow hi

The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in

The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which coul

The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the das

The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in att

The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settin

The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortco

The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is mis

The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow hig

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode at

The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcod

The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting

The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before o

The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updati

The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back

The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it

The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block option

The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortco

The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its sh

The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via

File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via

OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it g

Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts v

SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vu

Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via c