CRITICAL Severity CVEs

A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 all

A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allo

Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow.

Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the l

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone

CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02

Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or av

Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application w

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to

Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is be

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before us

The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL

The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL st

The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement v

The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters

The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it i

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementati

marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.

In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to a

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and

In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticate

SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller v

ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` doe

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, he

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action,

TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING par

SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.

It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu

It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2

It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4c

It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.

It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4c

It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4c

It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2

It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4c

It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7

Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).

SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can

Sourcecodester Medical Hub Directory Site 1.0 is vulnerable to SQL Injection via /mhds/clinic/view_details.php.

Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory.

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0

We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13