2025

HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of acco

HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tok

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URL

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URL

The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it ba

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This v

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofi

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Si

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitr

A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate file

An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malic

An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition d

HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which

HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulne

The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in

The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.3

The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulne

The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is

An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while perfo

An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users t

An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redire

An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject fiel

Specially constructed queries cause cross platform scripting leaking administrator tokens

Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application acce

A user with administrator privileges is able to retrieve authentication tokens

The administrator is able to configure an insecure captive portal script

A user with administrator privileges can perform command injection

On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA

A user with advanced report application access rights can perform actions for which they are not authorized

Backup uploads to ETM subject to man-in-the-middle interception

Specially constructed queries targeting ETM could discover active remote access sessions

Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under s

On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, whi

MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field

MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and

MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_nam

On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the Firs

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code v

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the camp

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated a

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping