12,440 results · Clear filters · Feed
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-category.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue is some unknown functionality of the file add-category.php. The manipulation of the argument txtcat…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-product.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unknown functionality of the file add-product.php. The manipulation of the argument txtprice/txtproduc…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-stock.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file add-stock.php. The manipulation of the argument txttotalcost/txtproductID/txtprice/txtexpi…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file changepassword.php. The manipulation of the argument txtconfirm_password/txt…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file add-admin.php. The manipulation of the argument txtpassword/txtfullname/txte…
-
Low 2.9
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimu…
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processin…
-
Low 2.9
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a gr…
-
Low 2.2
TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow exp…
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col a…
-
Low 2.9
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
-
Low 2.9
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.
-
Low 2.4
dazhouda lecms Edit Profile admin cross site scripting
A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the file /admin of the component Edit Profile Handler. The manipulation leads to cross site scripting. …
-
Low 2.4
songquanpeng one-api System Setting cross site scripting
A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross s…
-
Low 2.9
mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891…
-
Low 2.9
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,99999999999999…
-
Low 2.5
7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later …
-
Low 2.5
7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later…
-
Low 2.4
DaiCuo SEO Optimization Settings Section cross site scripting
A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimization Settings Section. The manipulation leads to cross site scripting. The attack may be launched r…
-
Low 3.5
baseweb JSite save cross site scripting
A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/save. The manipulation of the argument Name leads to cross site scripting. The attack may be launche…
-
Low 3.5
baseweb JSite save cross site scripting
A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/sys/user/save. The manipulation of the argument Name leads to cross site scripting. The attack can b…
-
Low 2.7
PbootCMS Image server-side request forgery
A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploi…
-
Low 3.4
An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.6…
-
Low 2.6
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proxi…
-
Low 2.5
HCL MyXalytics is affected by a failure to restrict URL access vulnerability
HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution.
-
Low 2.6
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system.
-
Low 3.3
can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg(), if can->do_set_mode() fails, the function directly returns without calling netif_rx(skb). This means …
-
Low 3.1
Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacke…
-
Low 3.7
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does no…
-
Low 3.5
Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed …
-
Low 3.5
Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed …
-
Low 3.5
Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed …
-
Low 3.5
Email Subscribers < 5.7.52 - Admin+ Stored XSS
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilte…
-
Low 2.9
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer u…
-
Low 3.3
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon …
-
Low 3.3
DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafte…
-
Low 3.3
VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashM…
-
Low 3.1
EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the…
-
Low 3.1
SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA
SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does n…
-
Low 3.3
PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached l…