3329 matches found
The vulnerability of the Grafana data presentation web tool, related to bypassing authentication using a user-controlled key, allows attackers to influence the integrity of the protected information.
The vulnerability of the Grafana data processing web tool relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of the protected information...
CVE-2025-27108
dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...
CVE-2025-27108
CVE-2025-27108 affects dom-expressions. The vulnerability arises from using JavaScript String.replace with special replacement patterns (notably $' and $�60) when injecting assets into HTML headers via solid-meta, where user-controlled attributes (Meta tags) can be manipulated to achieve XSS. Thi...
CVE-2025-27108 Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressions
dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...
CVE-2024-13719
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...
CVE-2024-13719
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...
CVE-2024-12651
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...
CVE-2024-12651
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...
CVE-2024-12651
CVE-2024-12651 affects the PTT HGS Mobile App prior to version 6.5.0. The issue is an Exposed Dangerous Method or Function vulnerability that allows manipulating user-controlled variables. The NVD/NIST record lists a CVSS v3.1 base score of 8.5 (HIGH) with Network attack vector, Low privileges re...
CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0...
CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...
PT-2025-6533
Name of the Vulnerable Software and Affected Versions BSS Software Mobuy Online Machinery Monitoring Panel versions prior to 2.0 Description The issue affects BSS Software Mobuy Online Machinery Monitoring Panel, allowing SQL Injection due to an Authorization Bypass Through User-Controlled SQL...
Path Traversal
github.com/clidey/whodb/core is vulnerable to Path Traversal. The vulnerability is due to improper path validation due to the lack of checks when joining user-controlled database file names with the default directory, allowing an attacker to use path traversal ../../ to access any Sqlite3 databas...
CVE-2025-23363
Summary (CVE-2025-23363): Siemens Teamcenter V14.x products disclose an open-redirect issue in the SSO login service. The SSO accepts user-controlled input that can specify an external URL, enabling an attacker to lure a legitimate user into clicking a crafted link that redirects to a malicious s...
CVE-2025-22695
Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through = 3.0.3...
WhoDB has a path traversal opening Sqlite3 database
Summary While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Details WhoDB allows use...
CVE-2022-4799
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4686
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0...