2739 matches found
CVE-2024-26157
All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response t...
BIT-PYTHON-MIN-2023-6597
An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged...
CVE-2024-57034
WeGIA 3.2.0 is vulnerable to SQL Injection in querygeracaoauto.php via the query parameter...
Roundcube Webmail 1.5.x < 1.5.5 Cross-Site-Scripting
According to its self-reported version number, Roundcube Webmail is prior to 1.4.15 or 1.5.x prior to 1.5.5 or 1.6.x prior to 1.6.4. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via an HTML e-mail message with a crafted SVG document. Note that the scanner has not test...
SonarSource SonarQube Server < 9.9.4 / 10.x < 10.4 Information Disclosure (CVE-2024-38460)
The version of SonarSource SonarQube Server running on the remote host is prior to 9.9.4 or 10.x prior to 10.4. It is, therefore, affected by an information disclosure vulnerability: - In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are...
RedShift Python Connector < 2.1.5 (CVE-2024-12745)
The Amazon Redshift Python Connector, version 2.1.4, is affected by CVE-2024-12745, a SQL injection issue when utilizing the getschemas, gettables, or getcolumns Metadata APIs. This issue has been addressed in driver version 2.1.5. We recommend customers upgrade to the driver version 2.1.5 or...
CVE-2025-23201
CVE-2025-23201 affects LibreNMS. The issue is a Cross-site Scripting (XSS) in the /addhost endpoint via the community parameter, impacting Librenms versions up to 24.10.1. The root cause is improper handling/escaping of user-supplied input in this parameter, enabling attackers to inject scripts t...
Mattermost webapp crash via a crafted post
Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...
CVE-2025-23795 WordPress Easy FAQs plugin <= 3.2.1 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ghuger Easy FAQs easy-faqs allows Stored XSS.This issue affects Easy FAQs: from n/a through = 3.2.1...
CVE-2025-23511
CVE-2025-23511: Cross-Site Request Forgery in the WP-BlackCheck (Viktoria Rei Bauer) WordPress plugin enables Stored XSS for WP-BlackCheck versions up to 2.7.2. CVSS v3.1 base score 7.1 (HIGH); exploitability requires user interaction. Public references cite the vulnerability details; remediation...
PT-2025-2689
Name of the Vulnerable Software and Affected Versions Google Go versions prior to 1.22.10 and 1.23.4 Description The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will...
CVE-2025-20036
Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...
BIT-PHP-MIN-2024-11233 Single byte overread with convert.quoted-printable-decode filter
In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas...
CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-24
CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-24. A patched version of the package is available...
Fortinet FortiWeb sqli (FG-IR-24-465)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-465 advisory. - A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWeb versions 6.3.17...
CVE-2024-56323
OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2 are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses conditions, and 2...
CVE-2024-12211
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile...
CVE-2025-22314 WordPress Food Store plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through 1.5.1...
Atlassian Confluence 6.5.x < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.0 (CONFSERVER-98442)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-98442 advisory. - Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the...
