2024

Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML int

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed

OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes

Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability

An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of

SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL comm

Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "P

Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languag

SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET r

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information

IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a loc

An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to us

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortco

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all v

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-S

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Req

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Req

Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affe

Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortco

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortco

A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allo

A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 a

A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allo

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensiti

A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files

Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and

SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive informatio

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.

A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue

An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated at

A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execut

Xbox Gaming Services Elevation of Privilege Vulnerability

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution.

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol

A vulnerability classified as problematic was found in Campcodes Complete Online DJ Booking System 1.0. Affected by this

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1

Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary cod

A vulnerability classified as problematic has been found in Campcodes Complete Online DJ Booking System 1.0. Affected is

A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been rated as problematic. This iss

A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management modul

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management modul