18 matches found
CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to...
Improper Access Control
getgrav/grav is vulnerable to improper access control. The vulnerability is due to insufficient restriction on the "Frontmatter" form, which allows a low-privileged user to read sensitive server files and exploit them to compromise user accounts...
CVE-2025-53484
User-controlled inputs are improperly escaped in: VotePage.php poll option input ResultPage::getPagesTab and getErrorsTab user-controllable page names This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll...
CVE-2022-4137
A reflected cross-site scripting XSS vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be...
Weak Password Requirements
publifycore is vulnerable to Weak Password Requirements. A remote attacker can easily compromise user accounts due to missing password strength constraints...
Vicidial 2.14-783a Cross Site Scripting
Document Title: =============== Vicidial v2.14-783a - Multiple XSS Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2311 Release Date: ============= 2022-10-11 Vulnerability Laboratory ID VL-ID: ==================================== 23...
CVE-2022-3255
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...
Minetest security vulnerabilities
Minetest is a free open source voxel game engine by The Minetest Team team. It is used for module and game creation. A security vulnerability exists in Minetest 5.5.1 and earlier versions, which originates in single player, where a module can set a global setting to control a Lua script that is...
Cross site request forgery (csrf)
Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request...
PT-2022-17073
Name of the Vulnerable Software and Affected Versions Home Owners Collection Management System version 1.0 Description The issue allows unauthenticated attackers to compromise user accounts via a crafted POST request. Recommendations For Home Owners Collection Management System version 1.0,...
Huawei HarmonyOS buffer overflow vulnerability (CNVD-2022-08453)
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in the Huawei HarmonyOS lock screen component. An attacker could exploit the vulnerability to cause user availability to be...
Huawei HarmonyOS privilege configuration vulnerability
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. Huawei HarmonyOS is vulnerable to a privilege configuration vulnerability. An attacker could exploit this vulnerability to compromise user privacy...
PT-2021-5471
Name of the Vulnerable Software and Affected Versions WISE-4060, Adam-6050 D, Adam.NET Utilit affected versions not specified Description The issue is related to weak password requirements in the software of Ethernet modules. This can be exploited by a remote attacker using a brute force attack t...
PT-2020-3696
Name of the Vulnerable Software and Affected Versions NPort IAW5000A-I/O Series affected versions not specified Description The issue is related to weak password requirements in the NPort IAW5000A-I/O Series web server software. Exploitation of this issue may allow a remote attacker to compromise...
PT-2019-5403
Name of the Vulnerable Software and Affected Versions Easergy Builder versions 1.4.7.2 and older Description A weakness in password requirements exists, which could allow an attacker to compromise a user account. The issue is related to weak password requirements, potentially enabling a remote...
File Uploader 1.1 index.php config[root_ordner] Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/25253/info File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to compromise the application...
OneWorldStore - OWListProduct.asp Multiple SQL Injections
OneWorldStore - OWListProduct.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/13182/info OneWorldStore is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...