678 matches found
CVE-2022-3237
The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-31356
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit=...
CVE-2021-24554
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue...
CVE-2021-32742
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the Data.initbase32Encoded: function opens up the potential for exposing server memory and/or crashing the server Denial of Service for applications where untrusted data can end up in said function. Vapor does not currently...
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
CVE-2025-39507
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in NasaTheme Nasa Core allows PHP Local File Inclusion. This issue affects Nasa Core: from n/a through 6.3.2...
CVE-2023-37535
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters...
CVE-2025-32886
creationtimestamp| type| source ---|---|--- 2025-05-01 18:15:53+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14357...
CVE-2025-32833
A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'UnlockProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read...
PT-2025-16281 · Veritas +1 · Vault Enterprise +1
Name of the Vulnerable Software and Affected Versions: Arctera eDiscovery Platform versions prior to 10.3.2 Description: The issue concerns the Arctera eDiscovery Platform, where a cleartext password is placed on a command line in EVSearcher when the Enterprise Vault Collection Module is used...
HPESBCR04838 rev.1 - HPE Cray Operating System, Local Denial Of Service
Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Cray Supercomputing Operating System Software prior to cos-base-3.2 - https://support.hpe.com/hpesc/docDisplay?docLocale=enUS&docId=a00146084enus CVSS Scores: | CVE | CVSS...
CVE-2023-43037 IBM Maximo Application Suite improper access control
IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation...
CVE-2025-32033
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters e.g. for a query's height. If a counter...
CVE-2025-32218
Missing Authorization vulnerability in RealMag777 TableOn posts-table-filterable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TableOn: from n/a through = 1.0.5.1...
Shenzhen Libituo Technology LBT-T300-T400 安全漏洞
Shenzhen Libituo Technology LBT-T300-T400 is an industrial router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-T400 version 3.2, which stems from a flaw in the tftpimagecheck function in the rc binary, which could lead to...
PT-2025-14717 · Unknown · Moshensky Cf7 Spreadsheets
Name of the Vulnerable Software and Affected Versions: moshensky CF7 Spreadsheets versions 2.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacke...
CVE-2025-31116
Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in validhost uses socket.gethostbyname, which is vulnerable to SSRF abuse using DNS rebinding technique. This...
CVE-2025-30367
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...
PT-2025-04: Partial Denial of Service (DoS) in Mobile Security Framework (MobSF)
The vulnerability was identified in Mobile Security Framework MobSF , versions 4.3.0. The discovered vulnerability allows an attacker to modify the Info.plist file and add special characters to the bundle identifier, resulting in a denial of service 500 error of the application. Vulnerability...
