CVE-2023-25475

Cross-Site Request Forgery CSRF vulnerability in Vladimir Prelovac Smart YouTube PRO plugin = 4.3 versions...

CVE-2023-4158

Cross-site Scripting XSS - Stored in GitHub repository omeka/omeka-s prior to 4.0.3...

CVE-2023-4713

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-50423

SAP BTP Security Services Integration Library Python sap-xssec - versions 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-4280

An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region...

CVE-2023-40035

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable...

CVE-2021-41573

Hitachi Content Platform Anywhere HCP-AW 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and...

CVE-2025-14436 Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting

The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘userconnectionid’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system...

WordPress plugin Jobify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

UBUNTU-CVE-2025-13151

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1expendoctetstring...

PT-2026-2179

Name of the Vulnerable Software and Affected Versions CoreShop versions prior to 4.1.8 Description CoreShop is a Pimcore enhanced eCommerce solution. A blind SQL injection exists in the application that allows an authenticated administrator-level user to extract database contents using...

PT-2026-1959

Name of the Vulnerable Software and Affected Versions Asseco InfoMedica versions prior to 4.50.1 Asseco InfoMedica versions prior to 5.38.0 Description Asseco InfoMedica stores user passwords in an encoded format within a database. An attacker with access to these encoded passwords can decode the...

CVE-2026-0618

Devolutions PowerShell Universal is affected by a Cross-site Scripting vulnerability tracked as CVE-2026-0618. Vulnerable versions are before 4.5.6 and before 5.6.13. Root cause: improper input neutralization in user-supplied data, enabling script execution in web pages viewed by other users. Imp...

CVE-2022-27365

Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component danceDance.phpdel...

CVE-2022-27366

Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component danceDance.phphy...

CVE-2017-6918

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-1999-0356

ControlIT v4.5 and earlier uses weak encryption to store usernames and passwords in an address book...

CVE-2025-1142

IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

wangmarket 代码注入漏洞

wangmarket is a privatized deploy your own SAAS cloud builder system for xnx3 individual developers in China. A code injection vulnerability exists in wangmarket 4.9 and earlier versions, which stems from an incorrect manipulation of the Description parameter in the file...