MEDIUM Severity CVEs

The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in

The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode

The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode paramete

The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' para

The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter

The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter

The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all

The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' par

The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode f

The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to C

The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1

The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2

The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including,

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable

The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versi

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via

The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in a

The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi

The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter

The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' s

The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability

Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hi

The System Console Utility for Windows is vulnerable to a DLL planting vulnerability

When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL c

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via un

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the ic

KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the

A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows att

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject mal

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory al

HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0

A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.

Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus t

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 1

In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead t

In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. T

In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to loc

In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds ch

In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. This

In cellular modem, there is a possible denial of service due to a logic error in the code. This could lead to remote den

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email

HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.