MEDIUM Severity CVEs

The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabilit

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(

The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to

The Clicface Trombi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nom’ parameter in all ver

The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the us

The SKU Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of

The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'or

The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss

The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wis

The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to

An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Prote

An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to Uni

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mi

A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to e

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a m

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an a

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerab

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside t

Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implem

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_dat

Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on

Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confide

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromi

The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details,

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attack

The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive info

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that cou

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper c

GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to cred

Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category

Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate at

wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to exe

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to mod

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data

The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this str

The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl

The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee'

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, an

The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit