474 matches found
CVE-2024-40113
Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials...
CVE-2025-0620
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...
CVE-2025-48940
MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion LFI via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be...
WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin WidgetKit versions = 2.5.4...
CVE-2025-39498 WordPress Spotlight - Social Media Feeds (Premium) plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds Premium allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds Premium: from n/a through 1.7.1...
PT-2025-22913 · Llisoft · Llisoft Mta Maita Training System
Name of the Vulnerable Software and Affected Versions: llisoft MTA Maita Training System version 4.5 Description: A critical issue has been found in the this.fileService.download function of the file comllisoftcontrollerOpenController.java. The manipulation of the url argument leads to unrestrict...
CVE-2024-45299
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...
CVE-2024-43947
Cross-Site Request Forgery CSRF vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26...
CVE-2024-42628
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/snippet/edit/3...
CVE-2024-33682
Cross-Site Request Forgery CSRF vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23...
CVE-2024-31287
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8...
CVE-2024-4022
A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /version.js of the component Version Data Handler. The manipulation leads to information...
CVE-2024-51834
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in luzuk Themes Luzuk Slider luzuk-slider allows Stored XSS.This issue affects Luzuk Slider: from n/a through = 0.1.5...
CVE-2024-48352
Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID...
CVE-2024-49381
Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerabili...
CVE-2023-41667
Cross-Site Request Forgery CSRF vulnerability in Ulf Benjaminsson WP-dTree plugin = 4.4.5 versions...
CVE-2023-41856
Unauth. Reflected Cross-Site Scripting XSS vulnerability in ClickToTweet.Com Click To Tweet plugin = 2.0.14 versions...
CVE-2023-33332
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WooCommerce Product Vendors plugin = 2.1.76 versions...
CVE-2023-48756
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.This issue affects JetBlocks For Elementor: from n/a through 1.3.8...