576 matches found
GHSA-H2FW-RFH5-95R3 Apache Tomcat - CGI security constraint bypass
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...
CVE-2025-48336
Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through 3.6.6...
CVE-2025-5264
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbir...
CVE-2025-46455
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through = 1.1...
CVE-2025-31053
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through 8.0.5...
CVE-2025-31423
Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through = 1.2.8...
CVE-2025-47575
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 92.0.0...
CVE-2025-46446
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones allows Stored XSS.This issue affects Libro de Reclamaciones: from n/a through = 1.0.1...
CVE-2025-39500
CVE-2025-39500 — Goodlayers Hostel (
CVE-2025-47478
CVE-2025-47478 affects WordPress ProfileGrid (Metagauss ProfileGrid) with an SQL Injection due to improper neutralization of input. Affected versions are ProfileGrid 5.9.5.0 and earlier. The base metrics indicate high risk (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L; Base score 8.5). The CVE h...
CVE-2025-24578
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through = 1.3.0...
CVE-2025-24720
Cross-Site Request Forgery CSRF vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through = 4.1.1...
CVE-2024-52385
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpmart Team Member team-showcase-supreme.This issue affects Team Member: from n/a through = 7.4...
CVE-2024-43952
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in CryoutCreations Esotera allows Stored XSS.This issue affects Esotera: from n/a through 1.2.5.1...
CVE-2024-43239
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through = 1.11.4...
CVE-2024-33689
Cross-Site Request Forgery CSRF vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through = 2.5.7...
CVE-2024-32506
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73...
CVE-2024-31389
Cross-Site Request Forgery CSRF vulnerability in Ertano MihanPanel.This issue affects MihanPanel: from n/a before 12.7...