2023

OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications ea

In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll c

The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parame

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the bac

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputt

The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which

The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthentic

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users wit

The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers bef

The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a

The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of th

The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting a

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administra

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputti

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` A

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the ch

The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially un

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its

The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.

The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple

The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes befo

The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attack

Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName.

Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedSt

An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the f

Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitra

Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServl

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a v

Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface.

The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow

Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the devNam

Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpaps

Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitra

A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due

A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted mal

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafte

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due

A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted J

An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elem

Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execu

Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker t

A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such a

An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extensio

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious acto