2024

The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScrip

The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all

The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap

The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in al

The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'f

The Intro Tour Tutorial DeepPresentation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form &

The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modif

The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'comp

The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of t

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality

Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11

readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.

This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authent

The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in a

The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's

The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The Pulsating Chat Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The NPS computy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data1' and 'data2' paramet

The Responsive Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'somryv' shortc

The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due

The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJ

The Posti Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the account_number and secre

The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the a

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests t

An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Networ

A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak N

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by le

A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a me

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit i

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected

A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and

A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. Th

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is pos

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code exe

An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user

An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via

Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.

Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.

An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.

The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run