CRITICAL Severity CVEs

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execut

RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the

MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.

D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli.

Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of thi

All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a ma

The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack featu

CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.

ALLMediaServer 1.6 is vulnerable to Buffer Overflow via MediaServer.exe.

Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. V

Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an

SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ

Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML doc

The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnera

DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php.

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed up

Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML

Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions usi

novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks a

Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker w

component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structur

Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.

IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle t

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC61

Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to de

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute

In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", a

An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.

ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php.

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM)

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te

Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF).

Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code vi

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticati

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorr

The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in requ

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which

The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in