2025

Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affec

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Bus Ticke

Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injecti

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCar

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ult

Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from

The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.

An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and

A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the

A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical. Affected by this issue is some unknow

Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.

Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In

While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this a

Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.

DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in s

Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials becom

The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data

The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. If expl

An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registrat

gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for

openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.

A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory cor

An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory c

PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's

Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alib

Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation b

Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the netwo

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfg

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notific

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized a

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to v

Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to

Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due

An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows

A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account re

Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator

Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects

Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrat

An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privile

An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges

An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privilege

An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privi

An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate