2025

Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and be

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and be

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration

The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Jansse

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture.

onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParse

react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/wo

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versio

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversa

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obta

An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory travers

File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to

A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/d

Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names a

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an

Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based bu

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an uplo

A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH

A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fa

Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT comm

ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie para

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specif

Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page.

BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supp

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `v

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows auth

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerabilit

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnera

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Auth

A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly v

A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attack

A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ff_seek_f

The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS a

Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and be

Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-le

An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0

A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file u

An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log