Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,358
- Last 24h
- 718
- Critical, 7 days
- 376
- Known exploited
- 1,779
12,817 results · Clear filters · Feed
-
Low 3.5
GZ Scripts Property Listing Script preview.php cross site scripting
A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The…
-
Low 3.5
GZ Scripts Car Listing Script PHP preview.php cross site scripting
A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack …
-
Low 3.5
GZ Scripts PHP Vacation Rental Script preview.php cross site scripting
A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scriptin…
-
Low 3.5
GZ Scripts GZ Forum Script preview.php cross site scripting
A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cro…
-
Low 2.0CVE-2023-37269 Public exploit
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could …
-
Low 3.5
GZ Scripts Time Slot Booking Calendar PHP load.php cross site scripting
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country lea…
-
Low 3.5
GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scripting
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name…
-
Low 3.7
Pipelines do not validate child UIDs
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelin…
-
Low 3.5
ThinuTech ThinuCMS contact.php cross site scripting
A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launc…
-
Low 3.5
ThinuTech ThinuCMS author_posts.php cross site scripting
A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</scr…
-
Low 3.5
SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scripting
A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It …
-
Low 3.5
SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scr…
-
Low 3.5
SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scripting
A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack …
-
Low 3.5
SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scripting
A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible …
-
Low 3.5
SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site …
-
Low 3.5
SimplePHPscripts FAQ Script PHP URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross …
-
Low 3.3
Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a deni…
-
Low 3.0
Open Redirect in go-gitea/gitea
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
-
Low 3.5
Active It Zone Active eCommerce CMS Create Ticket Page support_ticket cross site scripting
A vulnerability was found in Active It Zone Active eCommerce CMS 6.5.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ecommerce/support_ticket of the component Create Ticket Page. The manipulation of the argument de…
-
Low 3.5
Onest CRM Project List 2 cross site scripting
A vulnerability was found in Onest CRM 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/project/update/2 of the component Project List Handler. The manipulation of the argument name with the input <script>alert(1)</s…
-
Low 3.3
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the nvdisasm binary file, where an attacker may c…
-
Low 3.7
CometBFT PeerState JSON serialization deadlock
CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made in versions 0.34.28 and 0.37.1 to the way struct `PeerState` is serialized to JSON introduced a dea…
-
Low —
github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee
# x/crisis does not charge ConstantFee ### Impact If a transaction is sent to the `x/crisis` module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the `x/crisis` module are affected on all versions of the Cosmos …
-
Low —
atty potential unaligned read
On windows, `atty` dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough a…
-
Low 3.0
Insecure Default Authorization in Temporal Server
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the norm…
-
Low 3.5
RocketSoft Rocket LMS Contact Form store cross site scripting
A vulnerability was found in RocketSoft Rocket LMS 1.7. It has been declared as problematic. This vulnerability affects unknown code of the file /contact/store of the component Contact Form. The manipulation of the argument name/subject/message leads to cross…
-
Low 3.5
SimplePHPscripts GuestBook Script URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts GuestBook Script 2.2. It has been classified as problematic. This affects an unknown part of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possi…
-
Low 3.5
SimplePHPscripts Event Script URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts Event Script 2.1 and classified as problematic. Affected by this issue is some unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. …
-
Low 3.5
SimplePHPscripts Simple Blog URL Parameter preview.php cross site scripting
A vulnerability has been found in SimplePHPscripts Simple Blog 3.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file preview.php of the component URL Parameter Handler. The manipulation leads to cross site s…
-
Low 3.5
SimplePHPscripts Classified Ads Script HTTP POST Request user.php cross site scripting
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the a…
-
Low 3.5
SimplePHPscripts Classified Ads Script URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been classified as problematic. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation of the argument p leads to cross …
-
Low 3.5
Issues notification metadata lacks authorization
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the R…
-
Low —
SafeURL-Python's hostname blocklist does not block FQDNs
### Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host (e.g. adding `.` to the end). ### Impact The main purpose of this library is to block requests to internal/private IPs and these cannot b…
-
Low 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Low 3.5
Cross-site Scripting (XSS) - Stored in spinacms/spina
Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
-
Low 2.4
Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to r…
-
Low 3.3
Deadlock in Xpdf 4.04 due to PDF object stream references
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
-
Low 2.7
The contour service was not checking that users had permission to create an analysis for a given dataset
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
-
Low 3.7
LookupResources may return partial results in spicedb
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affe…
-
Low 3.1
Shescape potential environment variable exposure on Windows with CMD
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.