2024

The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local

TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple loca

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a si

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticat

CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template

An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while crea

The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes be

An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6

An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the

Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation wh

Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption B

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disab

gitingest before 9996a06 mishandles symbolic links that point outside of the base directory.

DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX do

An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote

An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to ca

File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized act

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulner

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and i

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms

The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' paramete

The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' s

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to

The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all

The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug

The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle'

The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' paramet

The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all

The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulner

The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to

The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortc

The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's

The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button'

The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p