2025

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to

An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Exe

An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Prote

An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to Uni

An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a

A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor w

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with

Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mi

A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to e

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a m

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response h

MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an a

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerab

PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is us

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improp

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improp

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improp

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside t

TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows a

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded t

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5

Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implem

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_dat

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on

Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposur

Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confide

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromi

The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details,

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attack

An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted

The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive info

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that cou

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper c

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to cred

Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category

Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate at

A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connect

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to exe

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page.