2943 matches found
CVE-2022-22881
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData...
CVE-2022-41474
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...
CVE-2022-1530
Cross-site Scripting XSS in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application...
CVE-2022-38870
Free5gc v3.2.1 is vulnerable to Information disclosure...
CVE-2022-32411
An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...
CVE-2022-33093
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resumelist...
CVE-2022-32127
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/viewbebrowsed/total...
CVE-2022-29624
An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-28945
An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file...
CVE-2022-27360
SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment...
CVE-2022-24239
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp...
CVE-2021-21361
The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...
CVE-2021-20744
Cross-site scripting vulnerability in EC-CUBE Category contents plugin for EC-CUBE 3.0 series versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...
CVE-2021-23020
The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys...
CVE-2021-39383
DWSurvey v3.2.0 was discovered to contain a remote command execution RCE vulnerability via the component /sysuser/SysPropertyAction.java...
CVE-2021-32694
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1...
CVE-2021-46494
Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsiValueLookupBase in src/jsiValue.c. This vulnerability can lead to a Denial of Service DoS...
CVE-2020-5266
In the pslink module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0...