2023

A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This i

An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interac

Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java c

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS)

Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your Wo

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenti

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenti

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspectin

An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redire

The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting

The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, lead

The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX acti

The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to em

A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic

VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product's

Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v

Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6

The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/ma

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerabil

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerabili

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prio

VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the p

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0

VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute a

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If th

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this

Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions

Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to r

PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability

openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of

A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is

The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local adm

Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/s

A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewp

In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base artic

An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Na

In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, whic

Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.

An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn

An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manage

An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewl