6716 matches found
CVE-2024-39897
zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...
CVE-2021-41189
DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a...
CVE-2025-23533
Cross-Site Request Forgery CSRF vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through = 0.4.1...
CVE-2025-23425
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in marekki Marekkis Watermark marekkis-watermark allows Reflected XSS.This issue affects Marekkis Watermark: from n/a through = 0.9.4...
CVE-2025-23888
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through = 0.6...
CVE-2025-23516
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through = 1.0...
CVE-2025-23949
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in dzeriho Improved Sale Badges – Free Version improved-sale-badges-free-version allows PHP Local File Inclusion.This issue affects Improved Sale Badges – Free Version: from n/a...
CVE-2019-20516
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...
CVE-2024-41174
The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker...
CVE-2024-39760
Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...
CVE-2025-1879
A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the physical device. It was not possible to...
CVE-2013-6828
admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sysusermng operation via the it parameter...
CVE-2022-27938
stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw...
CVE-1999-0106
Finger redirection allows finger bombs...
CVE-1999-0223
Solaris syslogd crashes when receiving a message from a host that doesn't have an inverse DNS entry...
CVE-1999-0421
During a reboot after an installation of Linux Slackware 3.6, a remote attacker can obtain root access by logging in to the root account without a password...
CVE-1999-0779
Denial of service in HP-UX SharedX recserv program...
CVE-1999-0188
The passwd command in Solaris can be subjected to a denial of service...