11427 matches found
Blogbook Code Injection Vulnerability
Blogbook is a content management system project by the individual developer Chaitak Gorai. A code injection vulnerability exists in Blogbook 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and prior versions, which originates from a cross-site scripting attack on the parameter fullname in the file...
Lovable security vulnerabilities
Lovable is an AI full-stack application builder from Lovable. A security vulnerability exists in Lovable versions 2025-04-15 and earlier, which stems from an insufficient database row-level security policy that could allow an unauthenticated attacker to read and write arbitrary database tables...
Yandex Browser Resource Management Error Vulnerability
Yandex Browser is a desktop version of the web browser from the Russian company Yandex. A security vulnerability exists in Yandex Browser versions prior to 24.4.0.682, which stems from a reused memory corruption issue after release...
Math code issue vulnerabilities
Math is an open source math plugin for PHPOffice. A code issue vulnerability exists in versions of Math prior to 0.3.0 that stems from unfiltered XML data being loaded, which could lead to an XXE attack...
SUSE CVE-2025-5064
Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PT-2025-23195 · Discourse · Discourse Policy Plugin
Name of the Vulnerable Software and Affected Versions: Discourse Policy plugin versions prior to 0.1.1 Description: The issue concerns the Discourse Policy plugin, which allows confirming users have seen or done something. Prior to version 0.1.1, if a policy was posted to a public topic tied to a...
DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities
According to its self-reported version, the instance of DNN formerly DotNetNuke running on the remote web server is prior to 9.13.9. It is, therefore, affected by multiple vulnerabilities: - DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem...
Amazon Linux 2 : postgresql (ALAS-2025-2866)
The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2866 advisory. Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, an...
Drupal COOKiES Consent Management module < 1.2.15 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module COOKiES Consent Management versions 1.2.15...
Gibbon Cross-Site Request Forgery Vulnerability
Gibbon is a school platform from the Gibbon team that solves real-world problems that educators encounter every day. A cross-site request forgery vulnerability exists in Gibbon versions prior to 29.0.00 that stems from vulnerability to cross-site request forgery attacks...
Netcore’s various products have injection vulnerabilities
Netcore NBR1005GPEV2 and so on are products of China Leike Netcore.Netcore NBR1005GPEV2 is a full gigabit multi-WAN port POE-powered enterprise AP management multifunctional wired router.Netcore B6V2 is a full gigabit wireless router.Netcore COVER5 is an enterprise-class router. An injection...
CVE-2024-52268
Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product...
CVE-2024-6322
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...
CVE-2024-29191
gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page links.html appends the src GET parameter 0 in all of its links for 1-click previews. The context in which src is being appended is innerHTML 1, which will insert th...
CVE-2024-22547
WayOS IBR-7150 17.06.23 is vulnerable to Cross Site Scripting XSS...
CVE-2024-21164
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2024-36573
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656, reduce @almela/obx/build/index.js:470, Object.set obx/build/index.js:269 component...
CVE-2024-23679
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes...
CVE-2024-5077
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...