2025

Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a ma

Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primiti

A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated us

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA applicatio

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync`

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymo

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been fo

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protectin

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protectin

reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands v

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backend

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are

Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the us

ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against

Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which

A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less tha

Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low p

Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive informat

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.

An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected f

access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only

Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to ex

SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1

SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10

eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones

Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive inf

Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the

ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows

ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.

ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into

ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.

Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the s

An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF

The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '