2025

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter fram

In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operat

In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp

Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensiti

A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_sa

A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /c

A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an u

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious

Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicio

Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allow

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to do

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into

PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to uplo

PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to in

PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers

UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files w

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to uplo

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrati

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthe

SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible throug

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible thro

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible throug

Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated ad

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the a

Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject maliciou

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin user

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas in

USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allow

Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows auth

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access rol

Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logg

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to injec

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas in

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject m

ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Repo

ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnera

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the a

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in Free

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in Churc

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists i

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an er

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality doe