CVE Database

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: …

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker …

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in …

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities …

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated …

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any …

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, …

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by …

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the …

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to …

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain …

Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user …

Memory corruption while processing service requests.

Memory Corruption when executing system service routines due to improper handling of user input buffers.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.

Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi …

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation …

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This …

Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to …

Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.

Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a …

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.