HIGH Severity CVEs

There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through th

The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via th

A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shad

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val

The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to

The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution i

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i

The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerab

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint.

NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace.

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.

NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File.

An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a craft

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. Accordi

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default

A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to pr

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about s

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—i

The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and includ

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 v

The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privileg

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification

The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to

OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remot

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-re

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an app

Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing s

ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient se

The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up

Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user p

Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.

Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment al

Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue

Cross-Site Request Forgery (CSRF) vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stor

Cross-Site Request Forgery (CSRF) vulnerability in Billy Bryant Tabs gt-tabs allows Stored XSS.This issue affects Tabs:

Cross-Site Request Forgery (CSRF) vulnerability in alphasis Related Posts via Taxonomies related-posts-via-taxonomies al

Cross-Site Request Forgery (CSRF) vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored

Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allow

Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored X

Cross-Site Request Forgery (CSRF) vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.Th

Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao Advanced lazy load advanced-lazy-load allows Stored XSS.Thi

Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue

Cross-Site Request Forgery (CSRF) vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.Thi

Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issu

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Cu