16955 matches found
CVE-2023-45908
Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...
CVE-2023-27113
pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php...
CVE-2025-22131 Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting XSS vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response...
CVE-2022-4975
A flaw was found in the Red Hat Advanced Cluster Security RHACS portal. When rendering a table view in the portal, for example, on any of the /main/configmanagement/ endpoints, the front-end generates a DOM table-element id="pdf-table". This information is then populated with unsanitized data usi...
MAL-2025-229 Malicious code in prem-media-downloader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ede831b4b52c9df6bee9007afd5ecbf303a958640eb1ceb9fa7f2144992d3098 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-232 Malicious code in prem_.status (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 211f307dad504f583168502f1e61e0edd3318a06791b8e481b0967452d78495e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-217 Malicious code in platform-browser-dynamic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0880f25b6b890b3d405a655f11013af216e513e196612ec7a644b96838875396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-0581 CampCodes School Management Software Chat History send cross site scripting
A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the...
OSV-2025-50 Heap-double-free in r_crbtree_free
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390503425 Crash type: Heap-double-free Crash state: rcrbtreefree rbinobjectfree rbinfilefree...
PT-2025-17672
Name of the Vulnerable Software and Affected Versions fig2dev version 3.2.9a Description The issue is related to a segmentation fault in the fig2dev software, specifically in version 3.2.9a. This fault allows an attacker to impact availability via local input manipulation through the read arcobje...
OSV-2025-42 Heap-use-after-free in r_list_free
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=390467754 Crash type: Heap-use-after-free READ 8 Crash state: rlistfree rbinbfltfree rbinfilefree...
CVE-2022-0303
Rejected reason: Further investigation determines issue is not a vulnerability...
CGA-9G23-PGWC-P32G
Bulletin has no description...
CVE-2024-57034
WeGIA 3.2.0 is vulnerable to SQL Injection in querygeracaoauto.php via the query parameter...
PT-2025-1332 · Unknown · Userdictionaryprovider
Name of the Vulnerable Software and Affected Versions: UserDictionaryProvider affected versions not specified Description: The issue is related to multiple functions in UserDictionaryProvider.java, where a confused subordinate could potentially allow adding and removing words from the user...
CVE-2024-57032
WeGIA 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senhaantiga field...
CVE-2024-56144 Stored XSS-LibreNMS-Display Name 2 in librenms
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display. Librenms versions up to 24.11.0 allow remote attackers to inject...
CVE-2025-23199 Stored XSS-LibreNMS-Ports in librenms
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: /ajaxform.php - param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...
GHSA-W6XH-C82W-H997 Mattermost webapp crash via a crafted post
Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...