2025

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection

Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error d

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to

MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed be

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vul

TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the functi

Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated fr

When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream brid

Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast recei

Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "

Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.blu

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not p

The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-a

The Hospital Information System developed by UNIMAX has a SQL Injection vulnerability, allowing unauthenticated remote a

The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unk

A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of

The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.

A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_

A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handli

A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted messag

A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read ar

An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D

A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo

A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and inc

An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 1

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior t

A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into perfor

Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path trave

If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set

An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior

An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable t

The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` con

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to exec

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticate

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execut

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execut

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated,