Baza CVE

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram…

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows…

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows…

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from…

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the…

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register.…

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service.…

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette…

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set…

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1…

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local…

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.