CWE-74

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted s

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the c

A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability af

A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files,

A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Prope

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate ope

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulner

SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an

A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of

A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can b

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allo

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerabilit

A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SU

pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the

A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this is

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that

A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this

A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue

A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an u

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary da

A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affe

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable th

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In Fort

A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getG

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0,

Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web ba

All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set requ

HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was po

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untr

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version

Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emai

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repo

Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create g

A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function

A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the

A vulnerability classified as problematic has been found in rofl0r MacGeiger. Affected is the function dump_wlan_at of t

Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their d

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to re

Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Busines

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when

A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to