2025

Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin

The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_repla

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticat

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fil

In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This cou

In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. Th

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficien

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission c

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This c

In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across us

In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of ser

An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part o

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side reques

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK,

A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated at

Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic

The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim.

traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists wh

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to exec

SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fie

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly hand

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.p

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.p

A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the se

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were disco

Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were disco

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discov

Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.8

In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows a

An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.

Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Contro

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user a

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a

Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Di

The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file s

A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/

A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. A

A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by t

A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected