CRITICAL Severity CVEs

An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to th

File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitra

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthentica

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker ca

An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insuf

An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.

Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and mod

In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions

In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a gu

In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManuf

SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::pr

An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in

ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users t

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to ob

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Qu

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical butt

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be mad

Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.

Unrestricted upload of dangerous file types in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerabi

Inadequate access control in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remo

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 v

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enabl

In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub_40E700 function within the cgibin is susceptible to stack

An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary c

An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET re

An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118

A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows atta

The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter be

The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking co

Buffer overflow vulnerability in the FLP module. Successful exploitation of this vulnerability may cause out-of-bounds r

Component exposure vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service a

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vu

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta

The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local var

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which coul

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users ar

pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on file

Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can ex

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generati

Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vu

Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth()

NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack

NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthen

NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack m

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,

The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided the