2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated use

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excess

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbea

Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the

Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence o

A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remot

A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute ar

A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An

BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker c

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions

Advantech WebAccess/SCADA  is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands

Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the ex

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system t

A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. Th

A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unkno

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Ch

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form v

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration inte

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the ri

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when sett

EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access fi

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers t

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject m

RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts t

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scrip

A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloa

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scrip

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts

An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submissi

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form r

A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improp

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via adm

A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-T

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error

An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln

A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem