2025

EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote s

EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in a

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeov

In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative rea

The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and inclu

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in t

The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.2

The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.2

The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.2

The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and

The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and

Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over

Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges ov

Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.

A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in

TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the impr

TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /li

TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.

TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.

TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in pac

On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to

An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can us

TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter

An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.

WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in ve

A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client de

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds P

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Uplo

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the l

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the S

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the C

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on t

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Serve

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via

There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the we

SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes defa

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without a

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea

Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fun

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fun

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fun

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fun