2024

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter

PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view

StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id par

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.

Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for An

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom -

Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3

The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape som

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which cou

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same loc

A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this

A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of

Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.

Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of i

In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially

ExpressionEngine before 7.4.11 allows XSS.

C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, whi

Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site S

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kerne

A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0.

A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulner

A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unk

A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some

A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerabi

A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’

The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusi

The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'ex

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortco

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site S

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and inclu

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and T

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_en

The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page i

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module i

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of se

MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while sign

The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerabili

A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML

Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result

user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into acceptin

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integra

The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder c

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachmen

An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an at

In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (