2025

It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to byp

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which t

The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missin

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of t

The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u

The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version

The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is v

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up

The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions u

The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions u

The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter

The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an

The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' pa

The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' short

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of dat

The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to m

The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cro

A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability

A vulnerability has been found in Seismic App 2.4.2 on Android. Affected is an unknown function of the file AndroidManif

The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branc

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs f

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being ap

Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest we

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior

A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/for

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the

Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a

Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impa

Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or b

Substance3D - Modeler versions 1.22.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a cra

Substance3D - Modeler versions 1.22.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that c

Substance3D - Modeler versions 1.22.2 and earlier are affected by a Use After Free vulnerability that could result in ar

Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service

Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denia

Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authentic

Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via net

A vulnerability was detected in UTT 1250GW up to 3.2.2-200710. This vulnerability affects the function sub_453DC of the

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that c

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Nod

DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering compo

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site