HIGH Severity CVEs

A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnera

A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affe

A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi

Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect

Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may aff

In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administr

In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from st

Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect s

The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and in

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sens

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sens

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sens

The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to

Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in re

Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This i

Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-sit

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible f

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possib

Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (X

A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issu

Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the numb

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sens

A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user in

SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrar

An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensit

The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app b

An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocom

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parame

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parame

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper Better

Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion

AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comman

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comman

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comman

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comman

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Bui

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the la

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. A

Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.