Archive
2 March 2026
Vulnerabilities first published on this day (UTC), newest first.
70 results · Clear filters · Feed
-
Medium 5.3
Chamilo: Potential unauthenticated blind SSRF via openid function
Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.
-
Medium 4.6
Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external…
-
Medium 5.3
Lack of HTTP Response Headers
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
-
Medium 5.3
Lack of protection mechanisms against Clickjacking attacks
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously cra…
-
Medium 6.9
SQL injection in CheckUnitCodeAndKey.pl
In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.
-
Medium 4.4
In MDDP, there is a possible system crash due to a race condition. This could lead to local denial of service if a mali…
-
Medium 4.4
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information …
-
Medium 4.4
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information …
-
Medium 6.7
In display, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.7
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privile…
-
Medium 4.4
In display, there is a possible system crash due to use after free. This could lead to local denial of service if a mal…
-
Medium 6.7
In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In MAE, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 4.4
In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a mali…
-
Medium 6.4
In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privile…
-
Medium 4.4
In MAE, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium 6.7
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local…
-
Medium 4.6
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local info…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalat…
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.3
Dataease SQLBot API Endpoint assistant.py access control
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the a…
-
Medium 4.3
itsourcecode University Management System att_single_view.php cross site scripting
A vulnerability was detected in itsourcecode University Management System 1.0. This affects an unknown part of the file /att_single_view.php. The manipulation of the argument dt results in cross site scripting. The attack can be executed remotely. The exploit…
-
Medium 4.3
Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remot…
-
Medium 5.0
thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference
A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may …
-
Medium 6.1
Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execut…
-
Medium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earl…
-
Medium 4.9
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?t…
-
Medium 4.9
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.