MEDIUM Severity CVEs

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the corr

In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically,

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force att

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.

The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capabili

The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in a

The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar'

The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery

User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker

A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function get

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user in

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddres

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application retu

An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fir

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint,

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to

The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions bef

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of

A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Co

Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users

A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tas

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authentic

A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings,

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.

A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec22

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to u

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac