MEDIUM Severity CVEs

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import an

Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control S

Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Conf

Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.Th

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting In

Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce produ

Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through

Missing Authorization vulnerability in picu picu picu allows Exploiting Incorrectly Configured Access Control Security L

Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by S

Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allo

Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site R

Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Cont

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smar

Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects

Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Co

Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting

Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Sit

Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is

A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash o

An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an

A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknow

Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) us

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary fil

A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes

Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log

A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-O

The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and

The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL st

The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers t

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attacker

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which coul

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attr

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attr

IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerabil

A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code

A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image

A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affe

IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acc

IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to

IBM Automation Decision Services 23.0.2 allows web pages to be stored locally which can be read by another user on the s

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8

The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Sc

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versio

The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via

IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is wr

IBM Maximo Application Suite 8.10.10, 8.11.7, and 9.0 - Monitor Component is vulnerable to SQL injection. A remote attac

IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting. This vulnerability allows