2025

A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execu

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote comman

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generati

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulati

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters i

The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerabl

The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Str

When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2

Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without

The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before o

The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.

The communication protocol used between the server process and the service control had a flaw that could lead to a local

The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the mid

The communication protocol used between client and server had a flaw that could lead to an authenticated user performing

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private po

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and w

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This

A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of

A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the functio

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the fun

A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoRebo

A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function f

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows

A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been declared as critical. This vulnerability affects the

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site

A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServle

A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). T

A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through Network

Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has th

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site

Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to d

A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServl

A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This i

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to anothe

A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() fun

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that

A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory tr

Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense agai

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site

A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been classified as critical. This affects the function fr