2025

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ext

The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up t

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http

IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation

IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in

OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.

shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.

maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.

Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.

TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.

In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization

In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and t

In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus a

A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown func

An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWla

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary c

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HC

A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attac

InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerabilit

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() met

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function

A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache

A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the functi

A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl

A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected by this issue is the

A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unk

heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via  c

Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_

Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation vi

A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the

A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown

A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unkno

A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function rea

A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This iss

A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__a

A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the function H5FS__sinfo_Sri

A vulnerability was found in HDF5 up to 1.14.6. It has been rated as critical. Affected by this issue is the function H5

A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is t

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file a

Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross