MEDIUM Severity CVEs

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file co

REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.

A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing

A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability af

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the

The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the

The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting

The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthentica

A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the

The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User

A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/conn

A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the fil

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service

A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m

A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decom

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::Inse

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access req

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include f

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape th

Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX

A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipul

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forger

The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin f

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Fre

A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results

A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an un

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provid

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username e

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a rem

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a rem

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some co

A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerabi

Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrect

Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Con

Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Confi

Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Con

Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path T

Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrect

Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incor

Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incor

Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Con