2025

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Appli

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8

A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects som

A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability

A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This af

A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this

The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation

A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. Affected by

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that cou

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated a

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under uni

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin p

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) o

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authen

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing an

FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker regis

Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in t

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query par

A vulnerability, which was classified as critical, has been found in D-Link DAP-1562 1.10. Affected by this issue is the

A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled pa

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not

Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by t

Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is cau

Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is c

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML el

A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTM

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not prope

A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to

IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file

IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download tempo

IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download tempo

A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concu

When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesyste

When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to alloc

Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Conf

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader fl

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuG

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andrew_fisher WOO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Docto

Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communiti

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaf

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaf

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Al