2025

The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-n

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly fi

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrato

Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficie

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/nul

Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accep

Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8,

OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp para

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou paramet

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the subm

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to i

A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitra

A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authe

** exclusively-hosted-service ** A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the Self

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products du

GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or

Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_d

Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all

Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad.

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS

HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to pro

A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_a

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the Graal

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows atta

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded conte

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML par

DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endp

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interfac

Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerabilit

Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel p

Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticat

Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI

Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run comma

Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known pass

Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerabilit

Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run comma

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute a

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute a

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory

A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticat

A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated,

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Servi

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obta

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticat

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticat