1490 matches found
Drupal Klaro Cookie & Consent Management module < 3.0.7 - Authenticated Cross Site Scripting (XSS) vulnerability
Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Klaro Cookie & Consent Management versions 3.0.7...
CVE-2025-41233
Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response with a maximum CVSSv3 base score of 6.8...
CVE-2025-6012
CVE-2025-6012 – WordPress Auto Attachments plugin suffers a stored XSS in admin settings for versions up to 1.8.5. The issue arises from insufficient input sanitization and output escaping, enabling authenticated attackers with administrator-level permissions (and above) to inject arbitrary scrip...
CVE-2025-36528 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports...
CVE-2025-27709
Affected product: Zohocorp ManageEngine ADAudit Plus, versions 8510 and prior. Description: authenticated SQL injection in the Service Account Auditing reports (root cause per sources). Impact: CVSSv3.1 base score 8.3 (HIGH) with confidentiality and integrity impacts; exploitation details not pro...
CVE-2024-25228
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution RCE via the getVerifydiyResult function in ManoeuvreHandler.class.php...
CVE-2024-22899
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the syncNtpTime function...
CVE-2024-46658
Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 was discovered to contain an authenticated command injection vulnerability...
CVE-2024-41136
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2024-54998
MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:id/debts/create...
CVE-2024-46625
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file...
CVE-2023-32962
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin = 1.3.4 versions...
CVE-2023-50466
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter...
CVE-2023-45627
An authenticated Denial-of-Service DoS vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point...
CVE-2023-37983
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Noël Jackson Art Direction plugin = 0.2.4 versions...
CVE-2023-41108
TEF portal 2023-07-17 is vulnerable to authenticated remote code execution...
CVE-2023-39267
An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service DoS condition in the switch...
CVE-2023-44262
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Renzo Johnson Blocks plugin = 1.6.41 versions...