2024

Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue a

Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrar

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrar

The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which co

The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputt

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fai

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to

The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src'

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_wid

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and i

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing ca

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all ve

A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application passwo

Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose informat

The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supp

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initializati

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the p

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a has

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to ve

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0,

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML Ex

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc

A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to ex

Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on t

Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender al

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0,

A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment Sy

Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A hi

rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf f

A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows

IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to impro

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access c

A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php vi

ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` fie

An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_i

The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware d

An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malici

An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaw

The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vu

Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may

Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in