322 matches found
PT-2026-6205
Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2 Description The Open eClass platform, previously known as GUnet eClass, is a course management system. A file upload validation bypass allows attackers to upload files with restricted extensions by including...
PT-2026-6196
Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2 Description The Open eClass platform, previously known as GUnet eClass, is a course management system susceptible to a username enumeration issue. An unauthenticated attacker can determine valid user accounts ...
Mocha Telnet Lite security vulnerabilities
Mocha Telnet Lite is an open-source terminal emulation tool developed by Mocha. Version 4.2 of Mocha Telnet Lite contains a security vulnerability, which stems from improper handling of user configuration inputs, potentially leading to application crashes...
CVE-2026-24408 sigstore has CSRF possibility in OIDC authentication during signing
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. OAuthSession creates a unique "state" and sends it as a parameter in the authentication request bu...
CVE-2025-68894
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shoutoutglobal ShoutOut shoutout allows Reflected XSS.This issue affects ShoutOut: from n/a through = 4.0.2...
CVE-2025-15537
Mapnik up to 4.2.0 is affected by a heap-based buffer overflow in the function mapnik::dbf_file::string_value (plugins/input/shape/dbfile.cpp). The issue requires local access to exploit and has publicly disclosed exploit information. Mapnik project was informed via issue report and has not respo...
SUSE CVE-2017-18894
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...
CVE-2021-47803
iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a malicious executable into the unquoted service path to run with LocalSystem privileges when the service...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003091)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003091 advisory. The rngapireset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service NULL pointer dereference. Tenable has extracted...
CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system...
CVE-2022-27365
Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component danceDance.phpdel...
CVE-2022-27366
Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component danceDance.phphy...
CVE-2017-6918
CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...
CVE-2025-69088
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through = 4.2...
CVE-2025-69088 WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through = 4.2...
CVE-2025-68983 WordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through = 4.2.11...
PT-2025-53916
Name of the Vulnerable Software and Affected Versions Vidish Combo Offers WooCommerce versions through 4.2 Description The software contains a flaw related to improper input handling during web page creation, specifically a DOM-Based Cross-site Scripting issue. This allows for the execution of...
CVE-2025-63060
Cross-Site Request Forgery CSRF vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through 4.25.0...
WordPress CSV to SortTable plugin <= 4.2 - Contributor+ LFI vulnerability
Contributor+ LFI vulnerability discovered by Ivan Cese in WordPress Plugin CSV to SortTable versions = 4.2...
