2025

Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows lo

Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attack

Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privile

Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memor

Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data acro

Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across m

The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions u

The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions u

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b

The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticat

The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting i

The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the

The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back

The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in

The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the pa

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the p

The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places,

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter

Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a ma

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymo

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protectin

Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive informat

access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to ex

SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1

Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the

ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.

Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the s

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '

The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and incl

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endp

Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malici

itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in regi

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. T

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address

An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vuln

An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vuln

The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any insta

lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell

Information disclosure while processing IO control commands.

Information disclosure during audio playback.

Information disclosure while processing information on firmware image during core initialization.

Memory corruption while processing frame packets.

Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.