MEDIUM Severity CVEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mra13 Simple Downl

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elem

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elemento

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Pa

Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Con

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configur

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete th

Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a m

A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1,

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) co

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) co

A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attack

A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controll

A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote

A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrativ

Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an auth

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command inj

A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nexus 9000 Se

A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and C

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete al

diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticse

In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are hand

diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its adm

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web in

A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/vi

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/a

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of th

Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to v

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensi

Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects P

Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin

The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_repla

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticat

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fil

In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This cou

In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. Th

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficien

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission c

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This c

In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across us

In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of ser

An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part o

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side reques