2025

The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files

The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application impl

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal.  The vulnerability could

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role

LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can

HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the

The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard

Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifia

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1,

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1,

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 co

Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthen

Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability

Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An

QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass

The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could al

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other

daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.

daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.

GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.

Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. Thi

Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Perfor

Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Perf

Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Per

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attacker

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter

A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeer

A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in u

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypa

Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized

Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Di

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability

Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key u

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This a

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side aut

The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TC

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected b

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Info