2023

Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect par

The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to per

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthen

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.

CRMEB 4.4.4 is vulnerable to Any File download.

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API com

Western Digital My Cloud devices before OS5 have a nobody account with a blank password.

A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by th

ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.

Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to impr

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to imp

A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unk

A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerab

A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin. Affected is an unknown

A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affect

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWik

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling

There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for Po

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks durin

Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.

Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.

Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.

A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some un

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerabili

A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of t

A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the func

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is s

A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown c

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is

A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function

Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any us

A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of serv

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new contain

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating us

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana c

In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the admini

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal P

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenD

A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects s

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthen

In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.

NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the serve

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) typ

Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b15