2025

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Qui

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification

Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. T

The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject'

The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to

The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to

OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modifi

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remot

The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a

The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which co

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that,

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) pl

The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to

In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an a

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an adm

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-re

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an app

Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing s

ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient se

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator accou

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create en

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacke

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipu

The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all

The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to

ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via th

Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user p

Missing "no cache" headers in HCL Leap permits sensitive data to be cached.

Missing "no cache" headers in HCL Leap permits user directory information to be cached.

Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.

Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.

Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated a

Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.

Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.

Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the

Insufficient default configuration in HCL Leap allows anonymous access to directory information.

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeXpert Xpert T