11336 matches found
CVE-2023-5711
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-27652
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the updateinfo field of the default.xml file...
CVE-2023-26526
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1...
CVE-2023-26134
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once...
CVE-2023-1961
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/?page=systeminfo. The manipulation of the argument System Name leads to cross site scripting. It is possible to launch the...
CVE-2023-1634
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...
CVE-2023-1276
A vulnerability, which was classified as critical, has been found in SUL1SSshop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has be...
CVE-2023-27566
Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file...
CVE-2023-37018
Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Capability Info Indication message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...
CVE-2023-24687
Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting XSS vulnerability in the Company Info Settings component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtCompanyName parameter...
Malicious code in fs-path-info (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bbb0034c7f631436e49a1e2a5c4a5f80204c56e46a101701eeb40d7947eb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4348 Malicious code in fs-path-info (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bbb0034c7f631436e49a1e2a5c4a5f80204c56e46a101701eeb40d7947eb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-47072
SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box...
CVE-2022-44400
Purchase Order Management System v1.0 contains a file upload vulnerability via /purchaseorder/admin/?page=systeminfo...
CVE-2022-43044
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gfisomgetmetaiteminfo at /isomedia/meta.c...
CVE-2022-4255
An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload...
CVE-2022-44367
Tenda i21 V1.0.0.144656 is vulnerable to Buffer Overflow via /goform/setUplinkInfo...