CRITICAL Severity CVEs

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application

Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to

Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web

Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system

A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete t

A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete

A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete

A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a hig

A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or del

A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a

A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or

A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete

The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'os

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Softwar

The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validatio

The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowe

Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-p

An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.

An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privilege

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with ano

The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includin

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which

A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_1

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplat

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privile

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privile

SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the sear

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.

Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file.

goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v

Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.

The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configur

An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.

The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote auth

Gogs through 0.13.0 allows argument injection during the previewing of changes.

Gogs through 0.13.0 allows deletion of internal files.

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code

QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary cod

In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the

When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be po

mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitiz

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6,

Under certain circumstances the web interface will accept characters unrelated to the expected input.