2023

Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary co

In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.

In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk

In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS ris

In Moodle, insufficient capability checks meant message deletions were not limited to the current user.

An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to

PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /ad

PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_

PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerabil

An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbi

PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /ad

ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via pac

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third p

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictio

In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion de

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.

A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an u

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and

Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addo

In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2

Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in ent

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. I

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a

FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `

Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed re

An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack

jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report c

A vulnerability was found in ehuacui bbs. It has been declared as problematic. This vulnerability affects unknown code.

Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.

A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData MedDataPAC

A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this i

The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options befor

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only

The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes

The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before ou

The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which

The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes befor

The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes befo

The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of it

The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before o

The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its sh

The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes b

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could

The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiatin