Lucene search
+L
VeracodeRecent

38505 matches found

Veracode
Veracode
•added 2025/12/13 6:9 a.m.•6 views

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the /admin/pages/page endpoint, which allows an attacker to inject malicious scripts via the dataheadercontentitems parameter...

6.2CVSS5.9AI score0.00201EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 6:9 a.m.•10 views

Improper Check For Unusual Or Exceptional Conditions

Drupal core is vulnerable to Improper Check for Unusual or Exceptional Conditions. The vulnerability is due to insufficient validation of access conditions, which allows an attacker to perform forceful browsing and access restricted resources without proper authorization...

5.3CVSS5.8AI score0.00316EPSS
Exploits0References7Affected Software1
Veracode
Veracode
•added 2025/12/13 6:9 a.m.•9 views

Cross-site Scripting (XSS)

getkirby/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-controlled fields such as page titles or usernames displayed in the "Changes" dialog, which allows an attacker to inject malicious code that executes when another authenticated user...

5.4CVSS5.9AI score0.00179EPSS
Exploits0References5Affected Software1
Veracode
Veracode
•added 2025/12/13 6:8 a.m.•70 views

Stored Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization in the dataheadertemplate parameter at the /admin/pages/page endpoint, which allows an attacker to inject and store malicious scripts that execute when the content is rendere...

6.2CVSS6AI score0.00186EPSS
Exploits1References2Affected Software1
Veracode
Veracode
•added 2025/12/13 6:8 a.m.•8 views

Arbitrary SQL Execution

Neuron is vulnerable to arbitrary SQL execution. The vulnerability is due to the MySQLWriteTool executing caller‑provided SQL using PDO::prepare and execute without semantic restrictions, where an attacker can inject destructive statements such as DROP TABLE, TRUNCATE, DELETE, or ALTER via...

9.4CVSS6.1AI score0.00354EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 6:7 a.m.•12 views

Persistent HTML Injection

privatebin/privatebin is vulnerable to persistent HTML injection. The vulnerability is due to an unsanitized attachment filename attachmentname when attachments are enabled, which allows an attacker to modify the filename before encryption so that, after decryption, arbitrary HTML is inserted...

5.8CVSS5.9AI score0.00277EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 6:5 a.m.•9 views

Denial Of Service (DoS)

processwire/processwire is vulnerable to Denial of Service. The vulnerability is due to automatic extraction of user-supplied ZIP files uploaded via Language Support without size or resource limits prior to validation, which allows an attacker with low privileges to upload a crafted ZIP and trigg...

6.5CVSS7AI score0.00404EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 6:5 a.m.•5 views

Improper Access Control

azuracast/azuracast is vulnerable to improper access control. The vulnerability is due to an unintended exposure of an internal SFTP API endpoint in the public HTTP API, which allows an attacker with knowledge of valid SFTP credentials and internal structure to manipulate a station’s database via...

3.7CVSS5.9AI score0.00213EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 6:1 a.m.•13 views

Insecure Direct Object Reference (IDOR)

getgrav/grav is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to improper access control in the Admin Panel, which allows a low-privilege attacker to access sensitive information of other users by manipulating direct object references...

6.5CVSS5.9AI score0.00263EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 6:0 a.m.•20 views

SQL Injection

nukeviet/nukeviet is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the topicsid parameter in modules/news/admin/addtotopics.php, which allows an attacker to execute malicious SQL queries through crafted input...

9.8CVSS7.4AI score0.01583EPSS
Exploits1References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:57 a.m.•11 views

Server-Side Template Injection (SSTI)

getgrav/grav is vulnerable to a Server-Side Template Injection SSTI. The vulnerability is due to improper input handling in form submissions, which allows an attacker to send a crafted POST payload to expose sensitive configuration details, including plugin configurations...

8.7CVSS5.9AI score0.00338EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:55 a.m.•10 views

Account Takeover

prestashop/pscheckout is vulnerable to Account takeover. The vulnerability is due to missing validation in the Express Checkout feature, which allows an attacker to silently authenticate using a victim’s email address and take over the account...

9.1CVSS6.9AI score0.00469EPSS
Exploits1References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:54 a.m.•10 views

SQL Injection

devcode-it/openstamanager is vulnerable to a SQL Injection. The vulnerability is due to improper validation of the display parameter in the API, which allows an attacker to inject and execute arbitrary SQL queries to access, modify, or delete database data...

8.8CVSS6AI score0.0035EPSS
Exploits0References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:52 a.m.•11 views

Privilege Escalation

alextselegidis/easyappointments is vulnerable to Privilege Escalation. The vulnerability is due to improper access control in the index.php file, which allows a remote attacker to escalate privileges by exploiting insufficient authorization checks...

9.8CVSS5.8AI score0.00801EPSS
Exploits1References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:52 a.m.•8 views

Privilege Escalation

getgrav/grav is vulnerable to Privilege Escalation PE. The vulnerability is due to improper handling of Twig processing in page frontmatter, which allows an attacker to inject malicious Twig expressions and escalate privileges or execute arbitrary system commands via the scheduler API...

8.8CVSS6.1AI score0.007EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:52 a.m.•7 views

Authentication Bypass

moodle/moodle is vulnerable to an authentication bypass. The vulnerability is due to improper enforcement of multi-factor authentication logic under certain conditions, which allows an attacker with valid credentials to bypass MFA and gain unauthorized access to user accounts...

5.4CVSS5.9AI score0.00231EPSS
Exploits0References7Affected Software1
Veracode
Veracode
•added 2025/12/13 5:52 a.m.•235 views

Server-Side Template Injection (SSTI)

getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to weak regex validation in the cleanDangerousTwig method, which allows an attacker to execute arbitrary commands on the server...

8.8CVSS6.1AI score0.02698EPSS
Exploits4References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:51 a.m.•7 views

Improper Input Validation

Symfony is vulnerable to improper input validation. The vulnerability is due to incorrect interpretation of PATHINFO in the Request class, which allows an attacker to bypass access control mechanisms by crafting URLs that do not start with a /...

7.3CVSS5.8AI score0.01344EPSS
Exploits0References6Affected Software2
Veracode
Veracode
•added 2025/12/13 5:47 a.m.•7 views

Authentication Bypass

mantisbt/mantisbt is vulnerable to Authentication Bypass. The vulnerability is due to the use of loose comparison == instead of strict comparison === in authentication logic, which allows an attacker to exploit MD5 hash collisions interpreted as numeric zero and gain unauthorized access without...

9.1CVSS5.8AI score0.00326EPSS
Exploits0References5Affected Software1
Veracode
Veracode
•added 2025/12/13 5:47 a.m.•20 views

Insecure Deserialization

quantconnect.common is vulnerable to insecure deserialization. The vulnerability is due to insecure configuration of the TypeNameHandling property in the Json.NET library, which allows an attacker to exploit unsafe deserialization of crafted JSON payloads and potentially execute arbitrary code...

9.8CVSS7.5AI score0.01518EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:45 a.m.•8 views

Cross-site Scripting (XSS)

Bagisto is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation of uploaded files in the TinyMCE image upload functionality, which allows an attacker with sufficient privileges to upload a crafted HTML file containing JavaScript that executes in a user’s...

6.9CVSS5.5AI score0.00261EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:44 a.m.•6 views

Arbitrary File Upload

mautic/grapes-js-builder-bundle is vulnerable to Arbitrary File Upload. The vulnerability is due to lack of file type restrictions during uploads, which allows an attacker to upload and execute malicious files on the server...

8.8CVSS6AI score0.00376EPSS
Exploits0References2Affected Software1
Veracode
Veracode
•added 2025/12/13 5:41 a.m.•9 views

Authenticated SQL Injection

torrentpier/torrentpier is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the topicid parameter in modcp.php, which allows an authenticated moderator to inject malicious SQL queries and exploit the database...

8.8CVSS5.9AI score0.00412EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:40 a.m.•11 views

Cross-Site Scripting (XSS)

magento is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of user input in form fields, which allows an attacker to inject malicious scripts that execute in a victim’s browser when the affected page is viewed...

8.1CVSS5.8AI score0.00564EPSS
Exploits0References3Affected Software2
Veracode
Veracode
•added 2025/12/13 5:40 a.m.•8 views

Weak Password Policy

librenms/librenms is vulnerable to a weak password policy. The vulnerability is due to insufficient enforcement of strong password rules in the user management functionality, which allows an attacker to exploit weak and predictable credentials through brute-force or credential stuffing attacks...

3.7CVSS5.7AI score0.00248EPSS
Exploits1References2Affected Software1
Veracode
Veracode
•added 2025/12/13 5:38 a.m.•9 views

Cross-site Scripting (XSS)

aimeos/ai-cms-grapesjs is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to lack of proper sanitization when Content Security Policy is disabled, which allows an attacker to inject malicious JavaScript through editor content...

7.6CVSS5.9AI score0.00244EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:34 a.m.•7 views

Remote Code Execution (RCE)

CSLA .NET is vulnerable to remote code execution RCE. The vulnerability is due to the use of the obsolete NetDataContractSerializer NDCS in WcfProxy, which allows an attacker to execute arbitrary code during the deserialization process...

9.8CVSS6.7AI score0.00575EPSS
Exploits0References5Affected Software1
Veracode
Veracode
•added 2025/12/13 5:31 a.m.•7 views

SQL Injection

Admidio is vulnerable to SQL Injection. The vulnerability is due to improper handling of user input in member assignment data retrieval functionality, which allows an attacker to execute arbitrary SQL commands and manipulate database data...

7.2CVSS6.1AI score0.00404EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:26 a.m.•7 views

Insecure Storage Of Sensitive Information

Liferay Portal and Liferay DXP are vulnerable to insecure storage of sensitive information. The vulnerability is due to storing password reset tokens in plain text in the database, which allows an attacker with database access to retrieve the token, reset a user’s password, and take over the user...

6.9CVSS5.8AI score0.00228EPSS
Exploits0References4Affected Software2
Veracode
Veracode
•added 2025/12/13 5:25 a.m.•9 views

Stored Cross-Site Scripting (XSS)

Jenkins AnchorChain Plugin is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper validation of URL schemes when generating links from workspace content, allowing attackers to inject javascript: URLs that execute malicious scripts in the Jenkins user interface...

6.5CVSS5.9AI score0.00274EPSS
Exploits0References2Affected Software1
Veracode
Veracode
•added 2025/12/13 5:25 a.m.•10 views

Improper Access Control

dnn.platform is vulnerable to improper access control. The vulnerability is due to the default HTML editing configuration allowing unauthenticated file uploads, which allows an attacker to upload arbitrary files and potentially leverage them for further compromise...

4.3CVSS5.9AI score0.00214EPSS
Exploits0References3Affected Software2
Veracode
Veracode
•added 2025/12/13 5:24 a.m.•9 views

Integer Overflow

ImageMagick is vulnerable to an integer overflow. The vulnerability is due to improper validation of width and height values in the TIM image parser’s ReadTIMImage function when calculating the image size without overflow checks, which allows an attacker to supply a crafted TIM image that trigger...

7.5CVSS5.9AI score0.00456EPSS
Exploits0References3Affected Software7
Veracode
Veracode
•added 2025/12/13 5:22 a.m.•21 views

Cross-site Scripting (XSS)

org.jenkins-ci.plugins:cloudbees-jenkins-advisor is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper escaping of server responses, which allows an attacker to inject malicious scripts that execute in the context of users viewing the affected content...

8.8CVSS5.8AI score0.00495EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:21 a.m.•9 views

Improper Access Control

com.liferay, com.liferay.blogs.item.selector.web is vulnerable to improper access control. The vulnerability is due to missing permission checks on blog entry images, which allows an attacker to access and view images via a crafted URL...

6.9CVSS5.2AI score0.00267EPSS
Exploits0References6Affected Software1
Veracode
Veracode
•added 2025/12/13 5:21 a.m.•60 views

Session Fixation

Jenkins Bitbucket OAuth Plugin is vulnerable to session fixation. The vulnerability is due to the plugin not invalidating the previous session on login, where an attacker can reuse an existing session and gain unauthorized access...

9.8CVSS7.3AI score0.01062EPSS
Exploits0References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:21 a.m.•9 views

Cross-site Request Forgery

Jenkins Nexus Task Runner Plugin is vulnerable to a Cross-Site Request Forgery CSRF. The vulnerability is due to missing CSRF protection on sensitive plugin endpoints, where crafted requests can trigger actions without user interaction, allowing attackers to force an authenticated Jenkins user to...

4.3CVSS6.7AI score0.0019EPSS
Exploits0References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:21 a.m.•6 views

XML External Entity (XXE) Injection

Mustang is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper restriction of external entity references during XML processing, which allows an attacker to exploit XXE attacks to exfiltrate arbitrary files from the affected system...

2.8CVSS7.2AI score0.0011EPSS
Exploits0References7Affected Software2
Veracode
Veracode
•added 2025/12/13 5:20 a.m.•4 views

Stored Cross-site-scripting (XSS)

dotnetnuke.core is vulnerable to cross-site scripting XSS. The vulnerability is due to incomplete sanitization of uploaded SVG file content, which allows an attacker to inject malicious scripts and execute them in a user’s browser...

6.4CVSS5.7AI score0.00179EPSS
Exploits0References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:16 a.m.•17 views

Information Disclosure

Aircompressor is vulnerable to Information Disclosure. The vulnerability is due to improper handling of malformed compressed data in decompression routines, which allows an attacker to craft input that leaks previous buffer contents and expose sensitive data...

7.5CVSS5.9AI score0.00369EPSS
Exploits0References4Affected Software2
Veracode
Veracode
•added 2025/12/13 5:15 a.m.•9 views

Missing Authorization Checks

org.jenkins-ci.plugins, publish-to-bitbucket is vulnerable to missing authorization checks. The vulnerability is due to a missing permission check when accessing credential-related functionality, which allows an attacker with Overall/Read permission to enumerate credential IDs stored in Jenkins...

4.3CVSS6.7AI score0.00245EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:15 a.m.•6 views

Reflected Cross-site Scripting (XSS)

com.liferay.portal, com.liferay.portal.impl are vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper input validation in the googlegadget component, which allows a remote unauthenticated attacker to inject and execute malicious JavaScript in a victim’s browser...

6.9CVSS6.6AI score0.00229EPSS
Exploits0References6Affected Software1
Veracode
Veracode
•added 2025/12/13 5:12 a.m.•20 views

SQL Injection

Mingsoft MCMS is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of user-supplied input in the /mdiy/model/delete URI, which allows an attacker to inject and execute arbitrary SQL commands...

9.8CVSS7.6AI score0.0089EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:12 a.m.•5 views

Unrestricted File Upload

dnn.platform is vulnerable to Unrestricted File Upload. The vulnerability is due to the default HTML editor provider allowing unauthenticated file uploads and overwriting of existing files, which allows an attacker to upload malicious files, deface the website, and potentially inject XSS payloads...

10CVSS5.8AI score0.44656EPSS
Exploits3References3Affected Software1
Veracode
Veracode
•added 2025/12/13 5:12 a.m.•14 views

SQL Injection

jeecg-boot is vulnerable to SQL Injection. The vulnerability is due to insufficient sanitization of the title parameter in the /sys/dict/loadTreeData endpoint, allowing attackers to inject malicious SQL statements and manipulate backend database queries...

9.8CVSS7.3AI score0.72043EPSS
Exploits1References2Affected Software1
Veracode
Veracode
•added 2025/12/13 5:11 a.m.•8 views

Improper Session Management

Keycloak is vulnerable to improper session management. The vulnerability is due to reuse of session identifiers and improper cleanup during logout when browser cookies are missing, which allows an attacker to gain unauthorized access to another user’s active session and receive their authenticati...

6CVSS5.9AI score0.00128EPSS
Exploits0References14Affected Software1
Veracode
Veracode
•added 2025/12/13 5:11 a.m.•7 views

Directory Traversal

Mammoth is vulnerable to Directory Traversal. The vulnerability is due to the lack of path or file type validation when processing DOCX files with externally linked images, which allows an attacker to read arbitrary files on the system or trigger excessive resource consumption by referencing...

9.3CVSS6AI score0.00942EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2025/12/13 5:11 a.m.•12 views

Improper Authentication

org.jenkins-ci.plugins, active-directory is vulnerable to improper authentication. The vulnerability is due to the use of a magic constant during password validation, which allows an attacker to log in as any user by using the crafted magic constant as the password...

9.8CVSS7.3AI score0.01325EPSS
Exploits0References5Affected Software1
Veracode
Veracode
•added 2025/12/13 5:9 a.m.•7 views

Denial Of Service (DoS)

org.apache.struts, struts2-core is vulnerable to Denial of Service DoS. The vulnerability is due to a file leak during multipart request processing, which allows an attacker to repeatedly trigger file creation on disk, leading to disk exhaustion and service disruption...

8.2CVSS7.8AI score0.01456EPSS
Exploits0References5Affected Software1
Veracode
Veracode
•added 2025/12/13 5:9 a.m.•13 views

Remote Code Execution (RCE)

org.apache.dubbo:dubbo is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization handling in hessian-lite during exception logging, which allows an attacker to execute malicious code through crafted serialized data...

9.8CVSS7.5AI score0.15313EPSS
Exploits1References2Affected Software1
Veracode
Veracode
•added 2025/12/13 5:8 a.m.•11 views

Sensitive Information Exposure

Jenkins ByteGuard Build Actions Plugin is vulnerable to sensitive information exposure. The vulnerability is due to improper masking of API tokens on the job configuration form, which allows an attacker to observe and capture these tokens...

4.3CVSS5.8AI score0.00158EPSS
Exploits0References3Affected Software1
Total number of security vulnerabilities38505