2025

The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.

The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authent

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upl

A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute

A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formA

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is

A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue af

A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulne

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Iden

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for

Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers

Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2

Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to exec

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __

A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This

A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by thi

A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected b

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 ha

SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensi

The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywher

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affecte

A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Th

A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting wh

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects a

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Ga

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and ser

A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as pro

A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulne

The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path vali

Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorre

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), sinc

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), un

An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled

An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP requ

An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will cr

An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that c

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open

An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or t

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may caus

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM E

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Fa