2978 matches found
CVE-2018-21034
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git...
CVE-2017-1000492
Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration...
CVE-2017-18503
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...
CVE-2019-2648
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
CVE-2025-48264
Cross-Site Request Forgery CSRF vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through = 1.5.0...
WordPress Crafts & Arts theme <= 2.5 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Crafts & Arts versions = 2.5...
CVE-2025-39458
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through 2.5.2...
WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability
Privilege Escalation Vulnerability discovered by Bonds in WordPress Theme CouponXL versions = 4.5.0...
CVE-2025-47755
V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4SaveEnvFile function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...
CVE-2024-4004
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
SUSE CVE-2025-47287
Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...
CVE-2025-32307
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through = 3.5.6...
CVE-2025-31637 WordPress SHOUT plugin <= 3.5.3 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup SHOUT lbg-audio8-html5-radioads allows SQL Injection.This issue affects SHOUT: from n/a through = 3.5.3...
UBUNTU-CVE-2025-47287
Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...
CVE-2025-47287 Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...
CVE-2025-47786 Emlog vulnerable to Stored Cross-site Scripting
Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly...
CVE-2025-47786
CVE-2025-47786 affects Emlog 2.5.13. The vulnerability is a stored cross-site scripting issue in /admin/comment.php where the unvalidated parameter perpage_num is stored in the database (admin_commend_perpage_num) and the output is not filtered, allowing a registered user to inject JavaScript tha...
CVE-2024-10864 SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication.
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5...
OpenText Advance Authentication 跨站脚本漏洞
OpenText Advance Authentication is an enterprise-grade multi-factor authentication MFA and identity management platform from OpenText Canada that supports a zero-trust architecture. A cross-site scripting vulnerability exists in OpenText Advance Authentication versions prior to 6.5, which stems...