16953 matches found
BIT-JOOMLA-2021-26036 [20210702] - Core - DoS through usergroup table manipulation
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table...
BIT-JOOMLA-2021-26029 [20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field
An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field...
BIT-JOOMLA-2021-23132 [20210306] - Core - com_media allowed paths that are not intended for image uploads
An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...
BIT-JOOMLA-2021-23131 [20210305] - Core - Input validation within the template manager
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager...
BIT-JOOMLA-2020-35613 [20201104] - Core - SQL injection in com_users list view
An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list...
BIT-JOOMLA-2020-15696
An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in modrandomimage...
BIT-DOLIBARR-2022-30875
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting XSS via Sql Error Page...
BIT-DOLIBARR-2022-0731 Improper Access Control (IDOR) in dolibarr/dolibarr
Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...
BIT-DOLIBARR-2022-0414 Improper Validation of Specified Quantity in Input in dolibarr/dolibarr
Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0...
CVE-2025-30858
CVE-2025-30858: Snow Storm (Tribulant Software) WordPress plugin is affected by a reflected XSS due to improper input neutralization during web page generation. Impact is low to high depending on context, with exploitation requiring user interaction. The Wordfence Vulnerability Database lists Sno...
CVE-2025-22003 can: ucan: fix out of bound read in strscpy() source
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy source Commit 7fdaf8966aae "can: ucan: use strscpy to instead of strncpy" unintentionally introduced a one byte out of bound read on strscpy's source argument which is kind of ironic...
BELL-CVE-2025-21992
Bulletin has no description...
BELL-CVE-2025-21928
Bulletin has no description...
BELL-CVE-2025-21910
Bulletin has no description...
GHSA-CMM4-P9V2-Q453 Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)
Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified. Attackers are limited to individuals whom a site administrator has...
MAL-2025-3094 Malicious code in com.henryhoffman.unlockprotocol (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0b9fe935663d6cf238511872ce9dec97a8af571599942b2005de6e3579aa08b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OSV-2025-253 Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken...
PT-2025-14723 · Peprodev · Peprodev Cf7 Database
Name of the Vulnerable Software and Affected Versions: PeproDev CF7 Database versions through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can...
PT-2025-14753 · Unknown · Labib Ahmed Team Builder
Name of the Vulnerable Software and Affected Versions: Labib Ahmed Team Builder versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker...