Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Unscored —
In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial o…
-
Unscored —
An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to ex…
-
Unscored —
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the m…
-
Unscored —
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session token…
-
Unscored —
An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to …
-
Unscored —
ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component …
-
Unscored —
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary…
-
Unscored —
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to u…
-
Unscored —
ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.p…
-
Unscored —
A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbi…
-
Unscored —
A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetc…
-
Unscored —CVE-2023-39121 Scanner template
emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
-
Unscored —
WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
-
Unscored —
WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and …
-
Unscored —
Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) …
-
Unscored —CVE-2023-39144 Public exploit
Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.
-
Unscored —
An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntim…
-
Unscored —
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arb…
-
Unscored —
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
-
High 7.5
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbi…
KEV May 19, 2025 -
Unscored —
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component ssp…
-
Unscored —
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files …
-
Unscored —
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open t…
-
Unscored —
An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrat…
-
Unscored —
Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/…
-
Unscored —
An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers …
-
Critical 9.8
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite ar…
-
High 7.5CVE-2023-38952 Scanner template
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due…
-
Unscored —
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices,…
-
High 7.2
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to e…
-
Unscored —
Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
-
Unscored —
A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and op…
-
Unscored —
User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, …
-
Unscored —
PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.
-
Unscored —
An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP a…
-
Unscored —CVE-2023-36159 Public exploit
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attacker…
-
Unscored —CVE-2023-36212 EPSS 26%
File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP fil…
-
Unscored —
PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.
-
Unscored —
DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
-
Unscored —CVE-2023-36158 Public exploit
Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to ru…