CVE Database

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: …

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a …

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under …

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to …

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a …

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests …

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it …

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations …

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd …

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused …

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long …

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written …

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations …

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users …