MEDIUM Severity CVEs

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected

A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerabili

A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability

A vulnerability was found in 70mai M300 up to 20250611. It has been classified as problematic. This affects an unknown p

A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerabilit

A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1,

In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functional

A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the functio

A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add

A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vul

An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoi

Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyon

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned f

A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/ma

A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the

A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue

A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this

A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected i

A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This af

A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function s

A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/ma

Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command.

A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potent

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized acces

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive req

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type websi

A vulnerability has been found in PHPGurukul Art Gallery Management System 1.1 and classified as critical. Affected by t

A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected i

A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.1. This

A vulnerability classified as critical was found in PHPGurukul Art Gallery Management System 1.1. This vulnerability aff

A vulnerability classified as critical has been found in PHPGurukul Art Gallery Management System 1.1. This affects an u

A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by th

A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been declared as critical. Affected by

A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's

IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redire

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t