2024

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type va

The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can l

The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to pr

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injecti

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul

The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to

The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file re

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 vi

The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Informatio

The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including

The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Reflecte

The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu

The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capab

The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capabilit

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient

The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin se

The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploa

The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Ob

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i

The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th

The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the db

The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions

The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the pa

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to per

Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticat

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.a

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing pe

MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has b

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Reques

Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access for

Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site

vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.

vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c.

sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is

vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_funct

vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.

vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_w

vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c.

vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser