Design/Logic Flaw

Totolink N200REV5 V9.3.5u.6255B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page...

CVE-2020-26627

CVE-2020-26627 : Concrete details show a Time-Based SQL Injection in Hospital Management System V4.0 and earlier, exploitable via the adminremark field under “Contact Us Queries -> Unread Query.” The root cause is lack of input validation for externally entered SQL statements, enabling an atta...

CVE-2024-20657

creationtimestamp| type| source ---|---|--- 2024-01-09 19:26:40+00:00| seen| https://t.me/ctinow/165262 2024-01-09 19:47:25+00:00| seen| https://t.me/ctinow/165289...

deaf-server.adw.uni-heidelberg.de Cross Site Scripting vulnerability OBB-3830291

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-22125

Under certain conditions the Microsoft Edge browser extension SAP GUI connector for Microsoft Edge - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality...

CVE-2024-22124

CVE-2024-22124 affects SAP NetWeaver Internet Communication Manager and SAP Web Dispatcher—specifically listed kernel and related components (KERNEL 7.22/7.53/7.54; KRNL64UC 7.22/7.53; KRNL64NUC 7.22/7.22_EXT; WEBDISP 7.22_EXT/7.53/7.54). The vulnerability enables an attacker to access informatio...

CVE-2023-49235

The CVE-2023-49235 entry affects TRENDnet TV-IP1314PI devices (firmware 5.5.3 200714) via libremote_dbg.so. The root cause is mishandled filtering of debug information during use of popen, which can allow an attacker to bypass validation and execute a shell command. Red Hat/NVD entries corroborat...

CVE-2022-45354

The WPChill Download Monitor WordPress plugin is vulnerable to Sensitive Information Exposure in versions up to and including 4.7.60 . This flaw exists within the REST API and allows unauthenticated attackers to extract sensitive data, including user reports , download reports , and specific user...

CVE-2023-51408

CVE-2023-51408 affects the WordPress plugin WP Optin Wheel – Gamified Optin Email Marketing Tool . The vulnerability applies to versions n/a through 1.4.3 and is described as Exposure of Sensitive Information to an Unauthorized Actor . Public sources provide concrete details: the affected product...

CVE-2023-52190

CVE-2023-52190 concerns the WordPress plugin Coupon Referral Program (WP Swings) with an unauthenticated exposure of sensitive data. Public sources (Wordfence, Patchstack, and CVE listings) indicate: affected versions are up to and including 1.7.2; the issue is described as sensitive data exposur...

CVE-2023-41710

Open-Xchange App Suite CVE-2023-41710 concerns a cross-site scripting (XSS) vulnerability where user-defined script code was not properly sanitized when added to the DOM, potentially allowing attackers to entice users to execute code within a trusted domain. Affected product references include Op...

CVE-2024-0303

CVE-2024-0303 affects Youke365 up to 1.5.3, with a vulnerability in /app/api/controller/caiji.php (Parameter Handler) where manipulating the url parameter enables server-side request forgery (SSRF). Reports indicate remote exploitation and public disclosure. Connected sources corroborate SSRF in ...

IBM CICS Transaction Gateway 安全漏洞

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

CVE-2023-7211

CVE-2023-7211 affects Uniway Router 2.0, specifically the Administrative Web Interface. The vulnerability arises from unknown code in that component, causing authentication to rely on the client’s IP address. The issue enables remote exploitation with high impact across confidentiality, integrity...

CVE-2017-9844

creationtimestamp| type| source ---|---|--- 2024-01-06 18:40:59+00:00| seen| https://t.me/arpsyndicate/2569 2025-04-25 08:41:00+00:00| seen| https://thehackernews.com/2025/04/sap-confirms-critical-netweaver-flaw.html 2025-04-25 13:37:42+00:00| seen|...

CVE-2017-5878

creationtimestamp| type| source ---|---|--- 2024-01-06 13:23:40+00:00| seen| https://t.me/arpsyndicate/2540 2024-01-09 01:13:05+00:00| seen| https://t.me/arpsyndicate/2699...

CVE-2023-52146

CVE-2023-52146 : Affects WordPress plugin 404 Solution (up to version 2.33.0). Public details in connected docs indicate a vulnerability titled “Sensitive Information Exposure via Log File” within the 404 Solution plugin, leading to exposure of sensitive data via logs. The vulnerability has been ...

CVE-2023-52151

CVE-2023-52151 affects Uncanny Automator (WordPress) up to version 5.1.0.2. The vulnerability is an information disclosure via log files (Sensitive Information Exposure via Log File) that could be accessed by an unauthorized actor. Root cause is exposure of sensitive data logged by the plugin, po...

guero.net Cross Site Scripting vulnerability OBB-3828526

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-52184

CVE-2023-52184 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Job Portal – A Complete Job Board plugin, affecting versions up to 2.0.6. The NVD metrics show CVSS 3.1 base score 8.8 (HIGH) with attack vector NETWORK, attack complexity LOW, privileges required NONE, user interaction...