The vulnerability of the ManageEngine ADSelfService Plus password reset software, related to deficiencies in authentication procedures, allows a malicious individual to gain access to user accounts.

The vulnerability of the ManageEngine ADSelfService Plus password reset software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to user accounts remotely...

VulnCheck KEV: CVE-2025-1315

The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2025-27506

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

GHSA-WF6C-HRHF-86CW NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

Summary The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. Details Throughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occur...

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

Summary The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. Details Throughout the source-code analysis, it has been found that the endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occur...

CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

CVE-2025-27506

NocoDB is affected by a Reflected Cross‑Site Scripting vulnerability in the password-reset API. The endpoint /api/v1/db/auth/password/reset/:tokenId can render unescaped user input due to an insecure EJS usage in resetPassword.ts (renderPasswordReset), enabling script execution in victims’ browse...

CVE-2024-13686

The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vwstorefrontresetallsettings function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

NocoDB 跨站脚本漏洞

NocoDB is an open source Airtable alternative. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb to a smart spreadsheet. A cross-site scripting vulnerability exists in NocoDB versions prior to 0.258.0, which stems from the lack of effective filtering and escaping of user-supplied data...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Bad drive in topology results kernel crash CVE-2023-53037 In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mrgetalltgtinfo CVE-2023-53320 In the Lin...

PT-2025-9998

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.258.0 Description The issue concerns a Reflected Cross-Site-Scripting vulnerability in the password reset function of NocoDB. The API endpoint "/api/v1/db/auth/password/reset/:tokenId" is affected. This flaw is cause...

CVE-2025-27094

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-0990 I Am Gloria <= 1.1.4 - Cross-Site Request Forgery

The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23gloriasettingspage function. This makes it possible for unauthenticated attackers to reset the tenan...

Linux Distros Unpatched Vulnerability : CVE-2022-49654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: dsa: qca8k: reset cpu port on MTU change It was discovered that the Documentation lacks...

Linux Distros Unpatched Vulnerability : CVE-2024-45231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password...

Linux Distros Unpatched Vulnerability : CVE-2022-49396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset...

Linux Distros Unpatched Vulnerability : CVE-2022-48790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: fix a possible use-after-free in controller reset during load Unlike .queuerq, in .submitasyncevent drivers may not check the ctrl readiness for AER...

Linux Distros Unpatched Vulnerability : CVE-2021-47400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: hns3: do not allow call hns3nicnetopen repeatedly hns3nicnetopen is not allowed to called repeatly, but there is no checking for this. When doing device...