2025

Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory

The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Pri

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGE

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authen

Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vul

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Fir

Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.

For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary comman

Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP

A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Ecl

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulne

Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affect

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Wor

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level sec

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, c

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, c

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, c

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, c

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command v

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalatio

CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within

CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to versi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform My

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Mult

Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi all

Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-co

Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recov

Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using

Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme all

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Le

Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This i

Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Produ

Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML

Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authen

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketB

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across th

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of t