2025

An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira D

HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing

Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to

A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated use

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other p

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the aff

A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenti

An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive info

A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fs

User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery funct

Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary c

Cross-site scripting (XSS) vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote att

Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary

Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and

Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Ma

Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and

Dell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redi

The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3

An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and

An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions start

An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting f

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publ

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Roundup Recipe Name field

The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable t

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Di

The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a mi

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi proven

An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specifi

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects Ale

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated

CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP s

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP

Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAl

A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisc

A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow

A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow

A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high priv

Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low

CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized use

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnera

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vuln