2025

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all ver

An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them m

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden g

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, makin

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certa

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information fr

Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive u

A flaw was found in the course overview output function where user access permissions were not fully enforced. This coul

Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious UR

Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated atta

Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS du

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with adm

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin p

A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-base

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Soft

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner S

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted in

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file path

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored b

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within t

Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Comm

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated us

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration

Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to e

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privil

Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initial

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerabilit

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an

VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to b

FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link i

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log expe

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 20

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Porta

A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file

Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function.

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast_setting_wifi_set

Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial o

Multiple buffer overflow vulnerabilities in the openSchedWifi function of Tenda AC6 v.15.03.06.50 allows attackers to ca