2025

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's file

A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_upda

A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/cla

A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 1

Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Prot

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protec

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorizatio

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when pars

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host na

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-

Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames.

Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and there

Due to missing authorization an unauthenticated remote attacker can cause a DoS attack by connecting via HTTPS and trigg

The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in al

The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plu

The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeov

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,

The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all version

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injectio

The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and includ

The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a funct

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege es

The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up

The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File up

The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable

The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of d

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potential

An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions fro

An issue has been discovered in access controls could allow users to view certain restricted project information even wh

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by th

The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions u

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity o

Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co.,

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to

The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_foote

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltra

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role t

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that de

IBM InfoSphere Information Server 11.7 DataStage Flow Designer  transmits sensitive information via URL or query parame

IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical erro

IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user