CVE Database

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat …

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through …

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. …

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This …

An integer overflow in the mtar_next() function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU …

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the …

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses …

Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through …

Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send …