2025

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Ext

EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthentic

The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path valid

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Transla

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Found

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series fi

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, US

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_i

Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; B

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all ver

GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability v

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows at

There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerabilit

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_nam

Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Ac

SQL Injection vulnerability in opentext Flipper allows SQL Injection.  The vulnerability could allow a low privilege us

Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal.  The vulnerability could allow a user

Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Ac

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could a

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0.

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0.

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5

An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary cod

Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Pro

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Ti

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Ti

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB C

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation

Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects