4744 matches found
CVE-2025-4687 Account pre-hijacking through invite misuse
In Teltonika Networks Remote Management System RMS, it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account a...
Absolute Secure Access 安全漏洞
Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A security vulnerability exists in versions prior to Absolute Secure Access 13.54, which stems from an elevation of privilege in the management console,...
CVE-2025-48743
SIGB PMB before 8.0.1.2 allows SQL injection...
NagVis 安全漏洞
NagVis is a program from NagVis open source. Used to visualize your chosen monitoring core data in a user-friendly way. A security vulnerability exists in Nagvis versions prior to 1.9.47 that stems from improper input neutralization and could lead to a cross-site scripting attack...
CVE-2024-3373
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2...
CVE-2024-23178
An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message...
CVE-2024-1153
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68...
CVE-2024-3264
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation. This issue affects Mia-Med Health Aplication: before 1.0.14...
CVE-2024-22026
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance...
CVE-2024-1721
Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue affects HYPR Passwordless: before 9.1...
CVE-2024-21777
Uncontrolled search path in some IntelR QuartusR Prime Pro Edition Design software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2024-5284
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-23462
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4...
CVE-2024-6366
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP...
CVE-2024-9100
Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal...
CVE-2024-8608
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Oceanic Software ValeApp allows Stored XSS. This issue affects ValeApp: before v2.0.0...
CVE-2024-9478
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2...
CVE-2024-48573
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature...