2025

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext t

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext thro

TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_

TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.

An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data d

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a

The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vu

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restrict

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorizatio

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the ident

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tok

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secr

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated us

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certifica

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the T

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.  This vulnerability is e

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could all

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the ful

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenti

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component b

The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweigh

A security vulnerability has been detected in Municorn FAX App 3.27.0 on Android. This vulnerability affects unknown cod

A weakness has been identified in atlaszz AI Photo Team Galleryit App 1.3.8.2 on Android. This affects an unknown part o

A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Aff

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the func

A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/pos

A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Hand

openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEG

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authenticatio

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authen

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree P

A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngin

A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of

A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown function

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting

The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to

In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take adva

A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the f

A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the

The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to St