2023

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions start

A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.

Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.

Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.

A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass aut

A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function

react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to

bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Ne

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11

Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.

Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.

An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attacker

SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/l

ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.

A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vu

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via Calendar

ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such

In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additio

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated

ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CK

Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Acce

Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session

Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated at

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the a

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCl

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.

Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate priv

Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plu

Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker

The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin

The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before o

The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before o

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes befor

The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputt

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using

The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode at

The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attrib

The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it

The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using i

The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before u

The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a

The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using