2024

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartPar

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does no

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploadin

An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute ar

MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Ma

MangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active

A stored cross-site scripting (XSS) vulnerability in MangoOS before 5.2.0 allows attackers to execute arbitrary web scri

The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a miss

Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or ge

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploadin

A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id para

ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exp

Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame

An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.

Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted sc

A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jix

CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserTy

OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST r

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserLi

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfi

OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserr

File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary c

SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary

SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to exec

SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary

The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information fo

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfi

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWi

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Du

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.

Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLoca

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal`

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the devic

smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox vers

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password

This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management

A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0.

A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function ac

A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpme

Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in a

Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated