2025

The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible

The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authent

The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/Clini

The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session

The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is expos

The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal s

Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the

In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" par

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensi

A vulnerability has been found in macrozheng mall up to 1.0.3. This impacts an unknown function of the component Registr

A flaw has been found in editso fuso up to 1.0.4-beta.7. This affects the function PenetrateRsaAndAesHandshake of the fi

A vulnerability was identified in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code

Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a loc

Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vu

A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. The affected element is an u

A security flaw has been discovered in itsourcecode Apartment Management System 1.0. This issue affects some unknown pro

A vulnerability was detected in itsourcecode Apartment Management System 1.0. The impacted element is an unknown functio

Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects P

A weakness has been identified in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the f

A vulnerability has been found in Campcodes Online Loan Management System 1.0. This affects an unknown part of the file

A flaw has been found in Campcodes Online Loan Management System 1.0. Affected by this issue is some unknown functionali

A vulnerability was detected in Campcodes Online Loan Management System 1.0. Affected by this vulnerability is an unknow

Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin

A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown functi

A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the f

The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_repla

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object

Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Midd

Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The p

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticat

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fil

In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This cou

In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could

In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. Th

In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to loc

In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This

In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This c

In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. Th

In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free.

In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to loc

In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This

In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after

In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficien