2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknow

A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerabili

PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in lo

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parame

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short pa

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin

PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-passwor

PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recov

Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These incl

Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted

A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the fi

Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. Wh

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file a

In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, whe

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admi

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authenticatio

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parame

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows sy

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticate

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regu

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to disc

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4

The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possib

IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remo

IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthe

Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote atta

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentiall

The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJA

Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a use

Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to

Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potential

Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform

Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform

Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allo

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document c

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist instal

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messa

Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vul

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the cl

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to ex