MEDIUM Severity CVEs

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Ch

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form v

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration inte

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the ri

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when sett

EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access fi

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers t

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject m

RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts t

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scrip

A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloa

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scrip

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts

An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submissi

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form r

A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improp

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via adm

A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-T

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error

An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vuln

A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectl

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem

Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploit

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows

Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid a

Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorre

Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Re

Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured

Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrect

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fa

In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure

Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulne

Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue aff

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, poten

SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2

A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of netwo

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper val

The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data du

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all version

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Re

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance manageme