CRITICAL Severity CVEs

The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation

An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network

In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does no

PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.

Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain

There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker ga

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.

PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.

PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.

PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.

MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.

Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue af

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, Identity

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_li

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewal

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentContro

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c funct

Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.

SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to v

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by

It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technolo

Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt t

ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL c

Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can e

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technolog

An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulatin

An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS pa

Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to o

The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to mo

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerabilit

Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection.

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permiss

Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over t

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmwa

Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vul

An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by defau

D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping

Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2

Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, I

Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability

Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the met

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.

KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagn