2023

The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Mu

The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate so

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and do

The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to

The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, le

The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting

The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate an

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it i

The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile A

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopwar

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbe

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, wri

A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size vali

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.

Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versi

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 ve

OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with t

Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions

A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with e

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on com

XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can

Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitat

The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitat

XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some c

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can ex

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can ex

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiM

The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability m

The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c

A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The

The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.p

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php f

front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive informati

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames

In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.

On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via t

Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagn

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file uplo