CVE Database

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. …

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A …

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation …

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment …

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is …

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user …

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can …

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the …

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based …

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use …

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper …

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use …

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation …

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct …

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL …

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing …

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP …

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.

Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. …

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This …

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted …

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, …

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.