2025

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to uplo

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas in

HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access rol

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas in

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Repo

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists i

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the

A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown funct

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged use

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege e

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macO

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)

ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reload

ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in th

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata in

AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Response

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permi

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due

A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a

Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via d

CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary co

ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in th

Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside t

Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside th

RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_specia

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remot

KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-e

A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows re

An issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates

The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,

A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software v

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encry

A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthor

A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possi

Authorization Bypass Through User-Controlled Key vulnerability in GG Soft Software Services Inc. PaperWork allows Exploi

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Obj

ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replac

Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write while processing a specially crafted project fi

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated

Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exp

Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap

SIPGO is a library for writing SIP services in the GO language. Starting in version 0.3.0 and prior to version 1.0.0-alp

An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A

An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A