2025

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.

Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP he

EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The ap

Photodex ProShow Producer version 5.0.3256 contains a stack-based buffer overflow vulnerability in the handling of plugi

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_wr

WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The a

Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The u

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection

XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitra

MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application f

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from

Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The appli

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec

Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php.

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were hand

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M30

The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to comm

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 conf

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client author

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This i

: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploade

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication.

Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are genera

Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE

Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain

A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the use

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physic

A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malic

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and be

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and be

The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Jansse

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture.

onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obta

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names a

Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based bu

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an uplo

A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fa

Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT comm

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specif

Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page.

BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supp