2025

BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability al

CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability

A Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allow

TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING param

PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remo

PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allo

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shorten

A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modif

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scrip

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <L

An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization templa

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a spec

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to

A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions

A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Se

D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of cr

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated us

SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which

A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System

A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4

A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTT

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which co

CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPri

A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitra

A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTM

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an auth

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.

Multiple XSS (CWE-79)

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter i

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortc

The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Vi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit g

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUF

Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor a

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Acces

Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Reques

Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site

Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Explo

Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abando