2025

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE:

Unauthenticated attackers can query an API endpoint and get device details.

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

Unauthenticated attackers can rename "rooms" of arbitrary users.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT B

Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets a

Missing Authorization vulnerability in Crocoblock JetMenu jet-menu allows Accessing Functionality Not Properly Constrain

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Bloc

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home S

Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes AI Hub aihub allows Upload a Web Shell to

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá tai

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gurmehub Kargo Ent

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Del

Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Fo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Addition

Cross-Site Request Forgery (CSRF) vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced C

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware Spa

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator wi

An unauthenticated attacker can hijack other users' devices and potentially control them.

An attacker can export other users' plant information.

Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces o

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC R

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncann

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Ga

An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential D

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screens

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing componen

An authenticated attacker can obtain any plant name by knowing the plant ID.

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.

An unauthenticated attacker can check the existence of usernames in the system by querying an API.

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFm

An unauthenticated attacker can obtain a user's plant list by knowing the username.

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View). The support

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.26,

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page a

Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-