106,935 results · Clear filters · Feed
-
Medium 5.3
WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
-
Medium 6.5
WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
-
Medium 6.5
WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.
-
Medium 6.6
Chamilo LMS: Conditional PHP execution through vendored QuickForm eval
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attac…
-
Medium 6.5
Chamilo LMS: CSRF in destructive skill-management AJAX actions
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token…
-
Medium 6.1
Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request p…
-
Medium 4.3
Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
-
Medium 6.3
WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to m…
-
Medium 4.3
Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can…
-
Medium 4.3
Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connecti…
-
Medium 4.2
ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other u…
-
Medium 5.4
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder…
-
Medium 5.0
FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another lib…
-
Medium 4.3
PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any o…
-
Medium 4.3
Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can su…
-
Medium 4.3
HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend…
-
Medium 5.4
HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with …
-
Medium 5.4
HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del w…
-
Medium 4.3
BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting oth…
-
Medium 4.3
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can re…
-
Medium 4.3
Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site …
-
Medium 6.5
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body …
-
Medium 5.4
Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star …
-
Medium 6.5
Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpo…
-
Medium 4.3
Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who ca…
-
Medium 4.7
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged …
-
Medium 5.5
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource …
-
Medium 5.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerabil…
-
Medium 6.8
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler…
-
Medium 6.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output …
-
Medium 4.8
tcpflow < 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length
tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pc…
-
Medium 6.1
AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a mu…
-
Medium 4.3
AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels …
-
Medium 4.3
Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_i…
-
Medium 4.3
UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} e…
-
Medium 6.8
ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and…
-
Medium 4.3
ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql …
-
Medium 6.5
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blocke…
-
Medium 5.9
Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket,…
-
Medium 4.4
Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingres…