2025

Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This iss

Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Ac

Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donation

Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-re

Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configure

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data

HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains acce

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data du

The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the

CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the

CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a use

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for author

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing

A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_

A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_

A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the component RTS

A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the componen

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prio

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA librari

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext pass

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification setti

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for m

Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add n

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025

A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the l

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, includi

A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown f

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save

Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL pa

Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject maliciou

Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious S

Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts wh

Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload m

NVClient 5.0 contains a stack buffer overflow vulnerability in the user configuration contact field that allows attacker

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with

SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a cr

Inventory Management System 1 was discovered to contain a SQL injection vulnerability.

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present i

IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM De

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration pri

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attac

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for proc

The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an export

A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attacker

A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management Syste