MEDIUM Severity CVEs

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by res

A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a cra

Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to t

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The libra

JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scr

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB dri

An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or

The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploi

A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are inte

A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1

Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal. The vulnerability resides in the Z

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 12

Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critic

A Potential Command Injection vulnerability in HCL AION.  An This can allow unintended command execution, potentially

Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due

GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usern

GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system

60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicio

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML

Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the

Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious

Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject ma

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with ade

Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a maliciou

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Acce

Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-ele

Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles

Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectl

Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Co