2024

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR . An attacker

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'w

The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Tempora

The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of da

The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t

The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it b

The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including,

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njte

The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versi

The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability c

The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' sho

The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox'

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link

A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the di

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metri

A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Di

APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed fo

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, a

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, t

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for externa

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, w

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects ca

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allo

Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the ser

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a

Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authentici

Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux)

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could expl

ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ p

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown funct

A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /

home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore functio

Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The produc

home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug

Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root pr

home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST n

A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. Thi

A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical.

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine functio

A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has

An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from

A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and clas