2025

A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the c

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vuln

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnera

WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due t

eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is ex

Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execu

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial o

<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerabi

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0,

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. Th

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/

A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes pla

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the i

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPi

A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password

A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is

A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of t

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParental

Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files

Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulner

Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows Upload a Web Shell to a

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malf

SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers

vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Ser

A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the

A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::Repla

Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attacke

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers t

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attacke

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily

MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute ar

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spher

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_pal

A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPasseng

A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Exec

A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /go

An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1