IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function

themeatelier IDonate – Blood Donation, Request And Donor Management System themeatelier idonate

IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function

themeatelier IDonate – Blood Donation, Request And Donor Management System themeatelier idonate

Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

Gravity Forms Gravity Forms

containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd containerd containerd containerd +4个

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

FreePBX security-reporting sangoma freepbx

LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation

niaj Connector Wizard (formerly LC Wizard)

kgateway is missing xDS authorization

kgateway-dev kgateway kgateway-dev kgateway

OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

OctoPrint OctoPrint octoprint octoprint

Dosage vulnerable to Directory Traversal through crafted HTTP responses

webcomics dosage

Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)

Manager-io Manager

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2,...

NEC Corporation CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) NEC Corporation CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux)

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. ...

Vercel AI SDK vercel ai +1个

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed N...

Vercel Nuxt Devtools nuxt devtools

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Sin...

astrbot astrbot

AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_p...

astrbot astrbot

A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue ex...

webair tquadra_cms

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows at...

angular angular ckeditor ckeditor5

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Repo...

crushftp crushftp

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q ...

nooncarlett techstore

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.

nooncarlett techstore