CVE-2021-38753

An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app...

CVE-2021-33894

In Progress MOVEit Transfer before 2019.0.6 11.0.6, 2019.1.x before 2019.1.5 11.1.5, 2019.2.x before 2019.2.2 11.2.2, 2020.x before 2020.0.5 12.0.5, 2020.1.x before 2020.1.4 12.1.4, and 2021.x before 2021.0.1 13.0.1, a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in th...

CVE-2019-1266

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'...

GHSA-7RXF-GVFG-47G4 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, superset, kubeflow-volumes-web-app...

wire-webapp 安全漏洞

wire-webapp is an open source application from Wire Swiss. A security vulnerability exists in wire-webapp versions prior to 2025-05-20-production.0, which stems from a session not being expired correctly, which could lead to automatic re-logins...

CVE-2025-44886

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the webaclmgmtRulesEditpostcontains function...

CVE-2025-48127

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through = 2.0.3...

CVE-2025-48127

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through = 2.0.3...

CVE-2025-48127 WordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through = 2.0.3...

CVE-2025-48127

CVE-2025-48127 is a Missing Authorization vulnerability in the WordPress plugin Push notification for Mobile and Web app , caused by misconfigured access control. Affected versions are listed as “from n/a through 2.0.3” (no public product/version details provided). The CVSS vector (AV:N/AC:L/PR:N...

CVE-2025-48127: Missing Authorization

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through = 2.0.3...

MAL-2025-3258 Malicious code in ink-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7d7d7be1f1ae1e0b29b9c5187d8041c62c44f247b62c7a071b67a0e821fbac8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3122 Malicious code in tiktok_4d_webapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee7b2f7d0a2a643de495f8b050981233231b51ed49c2dabb3e2de7b908b9fa7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6841

A Cross-Site Request Forgery CSRF vulnerability exists in the latest commit 56b782bcefd2e59b19cd7ba7878b95f54884f502 of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF...

CVE-2024-6841: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability exists in the latest commit 56b782bcefd2e59b19cd7ba7878b95f54884f502 of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF...

SUSE CVE-2025-1006

Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...

DEBIAN-CVE-2025-1006

Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...

CVE-2025-1006

Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...

CVE-2025-1006

Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...

PT-2025-6564 · WordPress · Wooodt Lite

Name of the Vulnerable Software and Affected Versions: WooODT Lite – Delivery & pickup date time location WooCommerce plugin for WordPress versions up to, and including, 2.5.1 Description: The issue concerns the /inc/bycwooodt get all orders.php file being publicly accessible and generating a...