MEDIUM Severity CVEs

SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive in

A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bf

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is t

A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_m

The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it bac

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privile

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it ba

Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsi

A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affe

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl

A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affe

NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote att

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. Th

A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected

A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vuln

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This incl

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protect

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific

SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenti

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deplo

SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respon

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows t

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker cou

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker c

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scriptin

A vulnerability, which was classified as problematic, has been found in code-projects Police FIR Record Management Syste

A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerabil

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on a

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including

A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unk

A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknow

MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of

A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue i

An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020. By sending a specially crafted 'stock-symbol' pa

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, mac

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unau

Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web manageme

Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application

The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including,

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpo

A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers

PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and

In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission che