2861 matches found
CVE-2023-53154
parsestring in cJSON before 1.7.18 has a heap-based buffer over-read via "1":1, with no trailing newline if cJSONParseWithLength is called...
PT-2025-22664 · Unknown · Phpgurukul Medical Card Generation System
Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Medical Card Generation System version 1.0 Description: The issue concerns stored cross-site scripting XSS vulnerabilities in the /mcgs/admin/contactus.php component. Attackers can execute arbitrary web scripts or HTML by injecting...
Google Chrome Security Update (stable-channel-update-for-desktop_27-2025-05) - Windows
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
CVE-2022-23669
A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...
CVE-2022-40975
Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7...
CVE-2022-1236
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0...
CVE-2022-36307
The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models...
CVE-2022-36458
TOTOLINK A3700R V9.1.2u.6134B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg...
CVE-2022-28438
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php=type=User=...
CVE-2022-28014
Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendanceedit.php...
CVE-2022-48327
Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 dataInicial, 2 dataFinal, 3 tipocliente, 4 format, 5 precoInicial, 6 precoFinal, 7 estoqueInicial, 8 estoqueFinal, 9 deid, 10 ateid, 11 clientesid, 12...
CVE-2022-24967
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...
CVE-2025-48371 OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...
CVE-2022-2290
Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...
CVE-2022-35648
Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers to cause a denial of service fall by connecting the power cord to a 120V circuit which may lead to...
CVE-2022-45352
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1...
CVE-2021-45889
An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as demonstrated by private/index.jsp?partners/ShowNonLocalPartners.do?localID= or private/index.jsp or private/index.jsp?database/databaseTab.jsp or...
CVE-2021-45619
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1.0.1.86, EX6250 before 1.0.0.134, EX7700 before 1.0.0.216, EX8000 before 1.0.1.232, LBR1020 before 2.6.3.58, LBR20 before 2.6.3.50, R7800 before 1.0.2.80, R8900 before 1.0.5.26,...