CVE Database

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to …

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and …

Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an …

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.

Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from …

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated …

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, …

The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the …

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in …

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. …

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, …

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management …

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the …

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string …

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can …

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged …

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the …