CRITICAL Severity CVEs

Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.

Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.

Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.

Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.

Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.

Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter.

Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote

PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. N

Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due t

Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object

An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access contr

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deseria

Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execu

The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570

Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student.

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engag

Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convi

Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional sof

Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthentic

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determi

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor.

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon

Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrar

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (

Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for al

Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versi

Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po

A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and e

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may a

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier m

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’

An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command

A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote att

An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to au

pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.

Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon