Cross site scripting

Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter...

Authentication flaw

Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC...

Code injection

Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This issue affects NetIQ Privileged Account Manager: before 3.7.0.2...

CVE-2024-2242

CVE-2024-2242 – WordPress Contact Form 7 : Affected: Contact Form 7 plugin for WordPress versions

CVE-2024-2079

CVE-2024-2079 affects WPBakery Page Builder Addons by Livemesh for WordPress. It is a Stored XSS via the per_line_mobile shortcode in all versions

CVE-2020-11862

CVE-2020-11862 is an allocation of resources without limits or throttling affecting OpenText NetIQ Privileged Account Manager prior to version 3.7.0.2. The vulnerability arises from unrestricted resource allocation in the PAM app, enabling a potential denial of service via resource exhaustion. Af...

CVE-2023-38536

OpenText Exceed Turbo X (version 12.5.1) contains an HTML injection vulnerability that can lead to Cross‑Site Scripting (XSS). The issue affects the OpenText Exceed Turbo X component and is described in multiple sources (e.g., CVE-2023-38536 entries across NVD, RH advisories, and CNNVD). The avai...

CVE-2023-38535

CVE-2023-38535 affects OpenText Exceed Turbo X versions 12.5.1 and 12.5.2. Root cause is hard-coded cryptographic keys, potentially allowing compromise of keys and impacting confidentiality, integrity, and availability. Publicly documented CVSSv3.1 metrics indicate a 9.8 (CRITICAL) score via netw...

CVE-2023-38534

OpenText Exceed Turbo X (versions 12.5.0 and 12.5.1) contains an improper authentication vulnerability that could disclose restricted information via unauthenticated RPC. The CVE-2023-38534 entry is supported by multiple feeds (NVD, Red Hat, PRION, etc.) with CVSS v3.1 base scores of 7.5 (AV:N/PR...

Cross site scripting

A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in createtag in admin/include/functions.php...

Cross site scripting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All...

Sql injection

yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.8.0 is vulnerable to NoSQL injection in the public access token processing logic. Attackers can fully bypass the public token authentication mechanism, regardless if a public token has been generated befo...

Sql injection

SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page...

Input validation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

Sql injection

SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function...

Sql injection

SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php...

CVE-2023-50726

CVE-2023-50726 affects Argo CD’s Local Sync feature, which lets developers override an application's manifests with locally-defined ones. An improper validation bug allows users with create, but not override, privileges to sync local manifests during app creation, bypassing git/Helm/OCI source re...

CVE-2024-28192

The CVE-2024-28192 entry concerns YourSpotify, an open source self-hosted Spotify tracking dashboard. A NoSQL injection flaw exists in the public access token processing logic for versions before 1.8.0, allowing an attacker to fully bypass the public token authentication mechanism without user in...

Race condition

Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access...

CVE-2024-24693

CVE-2024-24693 affects Zoom Rooms Client for Windows prior to 5.17.5. The issue is improper access control in the installer, which may allow an authenticated user to trigger a denial of service via local access. Affected component is the Windows installer, with the root cause described as install...