2023

The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statem

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it

The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in use

The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high pr

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX actio

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s

The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high pri

The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow atta

The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outp

NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the defau

The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-si

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole ap

An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic all

The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database b

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an inte

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a smal

The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, a

XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents a

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not proper

wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to ver

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could

Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system

PowerShell Information Disclosure Vulnerability

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.

Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.

in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through t

The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could al

in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.

in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitia

in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservat

in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default

in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file t

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml htt

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this co

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to chan

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior