High · CVSS 8.6
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.
Published Feb 3, 2026 · Updated Jul 10, 2026
Unknown · CVSS Not scored
Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
Published Jan 27, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.
Published Jan 26, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackers to cause a denial of service (DoS) via crafted .pdf file.
Published Aug 11, 2023 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
Published Jan 25, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
Published Jul 15, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.
Published Dec 21, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.
Published Dec 21, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
Published Dec 21, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
Published Dec 21, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
Published Jan 6, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
Published Dec 30, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
Published Apr 4, 2023 · Updated Jul 9, 2026
Unknown · CVSS Not scored
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.
Published Dec 24, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.
Published Mar 10, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the XSS triggers.
Published Dec 30, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each time admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
Published Dec 30, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page.
Published Dec 30, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS
Published Dec 24, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
Published Jan 21, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.
Published Mar 17, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls.
Published Dec 14, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
Published Dec 7, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).
Published Aug 21, 2023 · Updated Jul 9, 2026
Unknown · CVSS Not scored
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.
Published Jan 19, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability.
Published Mar 8, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.
Published Mar 8, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user.
Published Mar 8, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component. A low privilege user could leverage several openvpn options to execute code as root/SYSTEM.
Published May 4, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post request when sending an email and injecting a specially crafted XSS payload in the 'subject' field. The payload executes when the recipient logs into their mailbox.
Published Jun 26, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function.
Published Aug 22, 2023 · Updated Jul 9, 2026
Unknown · CVSS Not scored
An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application.
Published Dec 7, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
Published Nov 2, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
Published Oct 23, 2020 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.
Published Apr 7, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
Published Apr 7, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.
Published Apr 7, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.
Published Apr 7, 2022 · Updated Jul 9, 2026
Unknown · CVSS Not scored
A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request.
Published Jun 25, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
Published May 26, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their own, an HTTP POST request can be made update their profile description or supply a new profile image. This can lead to potential cross-site scripting attacks on any user, or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room.
Published May 26, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP file on the server and gain code execution.
Published May 26, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
Published May 26, 2021 · Updated Jul 9, 2026
Unknown · CVSS Not scored
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Published Jan 8, 2021 · Updated Jul 9, 2026
Low · CVSS 3.8
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
Published Jan 2, 2024 · Updated Jul 9, 2026
