Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,020
- Last 24h
- 796
- Critical, 7 days
- 348
- Known exploited
- 1,779
107,906 results · Clear filters · Feed
-
Medium 5.4
Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can…
-
Medium 6.1
PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.…
-
Medium 4.3
MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private templa…
-
Medium 6.5
Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signat…
-
Medium 5.3
Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5
Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5
-
Medium 5.1
Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1
Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attribu…
-
Medium 6.5
Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document…
-
Medium 6.1
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Dire…
-
Medium 5.5
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource …
-
Medium 6.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulne…
-
Medium 5.5
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource …
-
Medium 6.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Gener…
-
Medium 4.3
Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legi…
-
Medium 5.7
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulne…
-
Medium 4.6
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Co…
-
Medium 5.7
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Dire…
-
Medium 6.1
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Dire…
-
Medium 4.9
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing…
-
Medium 5.9
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout…
-
Medium 5.4
Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging thi…
-
Medium 5.9
@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing b…
-
Medium 4.2
@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature chec…
-
Medium 4.8
Stored Cross-Site Scripting in Multiple WSO2 Products
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the applica…
-
Medium 5.9
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a p…
-
Medium 4.4
Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depend…
-
Medium 6.5
SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product
SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.
-
Medium 5.8
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can le…
-
Medium 4.6
Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the mana…
-
Medium 5.5
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 6.6
Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability …
-
Medium 5.3
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…
-
Medium 5.7
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 6.5
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 5.9
OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect servi…
-
Medium 5.9
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect avai…
-
Medium 5.9
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may …
-
Medium 5.5
Permission control vulnerability in the WLAN module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 4.3
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availabi…
-
Medium 4.7
Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 4.3
Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may …