CVEs added in
March 2026

SQL Injection in Payroll Management System Parameter Handler

SQL Injection in itsourcecode Payroll Management System

Cross-Site Scripting (Stored XSS) in SiYuan Knowledge

Authorization Logic Error in SiYuan Publish Bookmark API

XSS in SiYuan Attribute View Cover Images

SQL Injection in Alerta Query String Search API

Missing Authentication in AVideo Live Stream Termination

CSRF in WWBN AVideo Admin Plugin Configuration

Improper Access Control in Admidio Docker Deployments

SSRF in InvoiceShelf PDF Generation

SSRF in InvoiceShelf Payment Receipt PDF Generation

Missing Authentication / Inadequate Access Control

Code Injection in Lodash _.template

Authorization Bypass in Parse Server Streaming Adapters

SSRF in InvoiceShelf Estimate PDF Generation

Improper Authentication / Authorization in MinIO PutObject

Arbitrary File Overwrite in InTouch Contacts & Caller ID

Path Traversal / Arbitrary File Overwrite in Zora: Post

Authorization Bypass in SciTokens C++

Path Traversal / Authorization Bypass in SciTokens C++

Path Traversal / Arbitrary File Overwrite in Zefiro Cloud

Path Traversal / Arbitrary File Overwrite in Animal Sounds

Arbitrary File Overwrite in Cast to TV Screen Mirroring

Path Traversal / Arbitrary File Overwrite in My Location

Path Traversal / Arbitrary File Overwrite in TA/UTAX Mobile

Command Injection in GitHub Actions Workflow for wenxian

Missing Authentication / Session Hijacking in Sliver C2 Web

SQL Injection in MikroORM Object-Based Query Construction

Arbitrary File Overwrite / External File Name or Path

Arbitrary File Overwrite in MaruNuri LLC File Import

Arbitrary File Overwrite / External File Name or Path

Authorization Bypass in Parse Server Cloud Functions

SSRF in OpenClaw fal Image Generation Provider

Denial of Service via Logic Error in Zebra Zcash Node

Missing Authentication / Insecure Cross-Origin Protection

SSRF in FastGPT MCP Tools Endpoints

SSRF in FastGPT HTTP Tools Testing Endpoint

Missing Authorization in OpenClaw Device Pair Approval Path

Insufficient Authorization / Access Control in OpenClaw

OS Command Injection in Ridvay Code Command Auto-Approval

OS Command Injection in DSAI-Cline Auto-Approval Module

OS Command Injection in Ridvay Code Auto-Approval Module

OS Command Injection / Improper Input Neutralization

Directory Traversal / Path Traversal in agentic-context-engi

OS Command Injection via Prompt Injection in Sixth

SQL Injection in Student Membership System Admin Login

OS Command Injection in OpenClaw iMessage Attachment

SQL Injection in Student Membership System User

SQL Injection in Teacher Record System Parameter Handler

SQL Injection in ajax.php?action=login2 of Simple Doctors

SQL Injection in login.php of Simple Doctors Appointment

Path Traversal in LangChain Prompt Loading Functions

Code Injection in Ruby LSP Gemfile Generation

Missing Authorization in act GitHub Actions Runner

Environment Injection in act GitHub Actions Runner

Path Traversal in SciTokens Enforcer Scope Handling

Authorization Bypass in SciTokens Enforcer

SQL Injection in SciTokens KeyCache SQLite Queries

OS Command Injection in Totolink A3300R setSyslogCfg

Cross-Site Scripting (XSS) in baserCMS Tag Creation

Path Traversal File Write in baserCMS Theme File Management

OS Command Injection in baserCMS Installer

OS Command Injection in baserCMS Update Functionality

SQL Injection in baserCMS Blog Post Functionality

OS Command Injection in baserCMS Core Update Functionality

Unrestricted File Upload in baserCMS Restore Function

Server-Side Request Forgery (SSRF) in Kyverno

Cross-Site Scripting (XSS) in CI4MS Methods Management

XSS in CI4MS Role and Group Management

Authentication and Token Validation Flaws in OpenOlat

OS Command Injection in DSAI-Cline Command Auto-Approval

Code Injection via Prompt Injection in HAI Build Code

Code Injection via Model-Guided Command Execution

SSRF in Gotenberg Document Conversion API

SQL Injection in Accounting System 1.0 /viewin_costumer.php

Cross-Site Scripting (XSS) in Tautulli API

Path Traversal in Tautulli images Endpoint

OS Command Injection in Roo Code Command Auto-Approval

OS Command Injection in Syntx Auto-Approval Module

Improper Code Execution Control in Tautulli Notification

SQL Injection in YunaiV yudao-cloud get-by-website

Command Injection in Vim Tabpanel Handling

SSRF in Invoice Ninja CheckDatabaseRequest

XML External Entity (XXE) in Grav CMS SVG Upload Handling

Missing Authentication in Nginx UI

Broken Access Control / Insecure Direct Object Reference

Information Disclosure in Streamlit-based GitHub MCP Agent

Command Injection and Server-Side Request Forgery (SSRF)

Authentication Bypass and Information Disclosure

SQL Injection in SchemaHero MySQL Column Handling

XSS in SourceCodester Sales and Inventory System

SQL Injection in SchemaHero Postgres Column Handling

Sensitive Information Exposure in steam-trader /users API

Command Injection in MLflow Model Serving Local Environment

Path Traversal (CWE-22) in MLflow Artifact Extraction

Command Injection in Ghidra Auto-Analysis Comments

Broken Access Control / Missing Authorization

SSRF in Lollms File Export Endpoint

Broken Authentication / Missing Access Control

OS Command Injection in Xiongmai Sofia DVR/NVR NetCommon

Inadequate Credential Protection in OpenClaw Pairing Setup

Broken / Missing Authorization in OpenClaw system.run

Authorization Bypass in OpenClaw Browser Profile Management

Authorization Bypass in OpenClaw Feishu Reaction Events

Improper Authorization in OpenClaw Session Sandbox

Broken / Missing Authorization in OpenClaw Subagent Sandbox

Broken Access Control in OpenClaw /config and /debug

SQL Injection in Accounting System /view_work.php

SQL Injection in Accounting System 1.0 Parameter Handler

SQL Injection in Code-Projects Accounting System

SQL Injection in Simple Food Order System all-orders.php

SQL Injection in Simple Food Order System Parameter Handler

SQL Injection in Simple Food Order System all-tickets.php

SSRF in elecV2P URL Handler eAxios

OS Command Injection in elecV2P /rpc pm2run Endpoint

Prompt Injection / Injection in localGPT LLM Prompt Handler

Unrestricted File Upload in localGPT backend do_POST Handler

Missing Authentication in localGPT API Endpoint

Code Injection in PandasAI Chat Message Handler

SQL Injection in PandasAI LanceDB Extension Query Handlers

Improper Authorization / Access Control in Ultimate Member

SQL Injection in WeGIA Tag Deletion Endpoint

Path Traversal in Mobile Next MCP Screenshot and Screen

XSS in Express XSS Sanitizer Middleware

XSS in Notesnook Web Clipper Rendering

Cross-Site Scripting (XSS) in Notesnook Note History Viewer

Server-Side Request Forgery (SSRF) in LinkAce

Code Injection in Happy DOM ECMAScriptModuleCompiler

Code Injection in Handlebars Precompiler

Code Injection in Handlebars Dynamic Partials

Broken Access Control in Langflow Flow Access Helper

Code Injection in Handlebars Server-Side Templates

Code Injection in Handlebars.compile()

Improper Privilege Management in Ella Core NetworkManager

Improper Certificate Validation in node-forge

Improper Cryptographic Signature Verification

Code Injection in Windmill NativeTS Executor

Improper Brute Force Protection in FLIP Authentication

OS Command Injection in Gematik Authenticator for macOS via

Code Injection in Langflow Agentic Assistant

HTTP Request Smuggling in Netty HTTP/1.1

OS Command Injection in Pi-hole Admin Interface

Prompt Injection / AI Instruction Manipulation

Command Injection in Flannel Extension Backend Node

SSRF in LibreChat Agent Actions and MCP

Server-Side Request Forgery (SSRF) in LibreChat API

Command Injection in Fleet Software Installer Pipeline

SQL Injection in Fleet MDM Bootstrap Package Configuration

SQL Injection in Fleet Apple MDM Profile Delivery Pipeline

XSS in WWBN AVideo YPTWallet Stripe Confirmation

SQL Injection in WWBN AVideo RTMP Stream Key Authentication

Broken Access Control in Fleet Host Transfer API

Code Injection / Dynamic Evaluation Vulnerability

SQL Injection in WWBN AVideo Category Title Handling

SQL Injection in WWBN AVideo like.php getLike() Videos Query

Business Logic / Input Validation in Pharmacy Product

Business Logic Vulnerability in Pharmacy Product Management

Missing Authentication in OpenBMB XAgent ShareServer

SQL Injection in Online Food Ordering System

SQL Injection in SourceCodester Online Food Ordering System

SQL Injection in SourceCodester Online Food Ordering System

SQL Injection in SourceCodester Online Food Ordering System

SQL Injection in Online Food Ordering System save_customer

SQL Injection in SourceCodester Online Food Ordering System

OS Command Injection in CodeRider-Kilo Auto-Approval Module

SSRF in mingSoft MCMS Editor Endpoint catchImage Function

Session Management and Authentication Logic Flaw

SQL Injection in Group-Office JMAP Contact Query Endpoint

Path Traversal in BuildKit Git Source Handling

Improper Access Control in blog.admin getinfobytoken API

SSRF in OTCMS read.php AnnounContent

Improper Input Validation / AI Prompt Injection Leading to

OS Command Injection in Axon Code Command Auto-Approval

Path Traversal in Beifong AI News and Podcast Agent

Stack-Based Buffer Overflow in LSC Indoor Camera ONVIF

Injection in Traefik Knative Provider

Session Fixation in Bludit Session Management

Unrestricted File Upload in Bludit API Plugin

SQL Injection in Simple Laundry System Parameter Handler

Improper Brute-Force Protection in MyTube

Improper Access Control in MyTube Passkey Registration

Path Traversal in BuildKit Custom Frontends Allowing File

Information Exposure / Credential Leakage in cpp-httplib

Code Injection in BentoML bentofile.yaml

Authorization Bypass / Access Control in MyTube Database

Authorization Logic and Caching Flaws in OpenFGA

Unsafe RMI Deserialization (CWE-502) in dd-trace-java RMI Instrumentation

Unsafe Deserialization in Metabase Enterprise H2 Sync

Command Injection in OpenHands Git Diff Handler

Unsafe Deserialization in OpenTelemetry Java Instrumentation

Path Traversal / Directory Traversal in Incus Containers

Improper Authentication in Incus Web UI Local Web Server

Improper Authorization / Insecure Direct Object Reference

Unrestricted File Upload in Sharp Laravel CMS

Path Traversal in Sharp Laravel CMS FileUtil

XSS in PrestaShop Back Office Templates

Directory Traversal in SiYuan Notebook File Enumeration API

Cross-Site Scripting (XSS) in Kestra Flow Metadata Rendering

Path Traversal File Write in Fireshare Chunked Upload

Improper Authentication Rate Limiting in Outline Email OTP

Code Injection / Policy Bypass in PinchTab Wait Endpoints

Missing Authorization Checks in ClearanceKit on macOS

Missing Authorization in ClearanceKit Endpoint Security

Cross-Site Scripting (XSS) in Ory Polis Login Flow

SQL Injection in Ory Keto GetRelationships API

Missing Authentication Rate Limiting / Brute-Force

Code Injection in FuelCMS dwoo Component

OS Command Injection (CWE-78) in Thingino Firmware WiFi Captive Portal CGI

SQL Injection in Ory Hydra Admin APIs

SQL Injection in Ory Kratos Admin Courier Messages API

Path Traversal / Authorization Bypass in ORY Oathkeeper

SSRF in Firecrawl Playwright Scraping Service

SQL Injection in Kysely MySQL Query Compilation

SQL Injection in Kysely Query Compiler

Path Traversal in OpenClaw Media Parsing

Missing Authorization / Access Control in etcd Clusters

Remote Code Execution via Sandbox Escape in OneUptime

Unrestricted File Upload in Laravel Mediable

Unsafe Deserialization in GenericFastJsonRedisSerializer

SQL Injection in Simple Laundry System 1.0

SQL Injection in Admin Login Module of Online Food Ordering

SQL Injection in Parameter Handler of Online Enrollment

SQL Injection in Online Food Ordering System Shopping Cart

Command Injection in Netcore Power 15AX Diagnostic Tool

SQL Injection in SourceCodester Food Ordering System

SQL Injection in /display.php of Malawi Online Market 1.0

Unsafe Deserialization in Saloon AccessTokenAuthenticator

Resource Exhaustion / Denial of Service in LiquidJS

Uncontrolled Resource Consumption in LiquidJS Template

Path Traversal in Saloon PHP API Integration Library

SSRF in Saloon PHP API Connector URL Handling

Broken Access Control in OpenEMR

Insecure Direct Object Reference (IDOR) in OpenEMR Legacy

Missing Authorization / Access Control in OpenEMR Procedure

Stored XSS in OpenEMR CCDA Document Preview

Missing Authorization in OpenEMR Claim Endpoint

SQL Injection in OpenEMR CAMOS ajax_save Form

SQL Injection in OpenEMR PostCalendar categoriesUpdate

XML External Entity (XXE) / XInclude Injection

SQL Injection in OpenEMR Patient Selection Feature

Stored XSS in OpenEMR Eye Exam Encounter Forms

SQL Injection in OpenEMR Patient Search Parameters

Improper Privilege Management in Iperius Backup Job

Path Traversal in Sonarr File Serving API on Windows

Input Validation Error in NATS Server Leafnode Handling

Improper Authorization in NATS Server MQTT Subject ACLs

Improper Privilege Management in osslsigncode.c of

Cross-Site Scripting (XSS) in n8n Workflows

Improper Authentication / Host Verification Failure

OS Command Injection in Modoboa exec_cmd()

Path Traversal / Zip Slip in pf4j Unzip.extract()

Improper Privilege Management in Signify signed_data.py and

SQL Injection in n8n Data Table Get Workflow Node

Improper Authentication in n8n LDAP Account Association

Code Injection via Inadequate SQL Sandbox in n8n Merge Node

Stored XSS in Seafile Server Seadoc WebSocket Document

Directory Traversal in Plexus Utils Expand.extractFile

OS Command Injection in thumbler thumbnail() Function

OS Command Injection in node-tesseract-ocr recognize()

OS Command Injection in textract Extractors

Stored XSS in Kiteworks Secure Data Forms

SQL Injection in OpenCart Core Product Search Parameter

OS Command Injection in pdf-image npm Package via

Insufficient Entropy / Weak Randomness in Cryptography

SQL Injection in Simple Laundry System

Authorization Bypass in pyLoad ClickNLoad

Improper Privilege Management in pyLoad Configuration API

Authentication and Account Enumeration Weakness

Path Traversal in Dagu Workflow Engine DAG Operations API

Uncontrolled Resource Consumption / Denial of Service

XSS in oRPC OpenAPI Documentation Generation

Broken Access Control in FileRise ONLYOFFICE Integration

Path Traversal in FileRise Resumable Upload Handler

Authentication Bypass via JWT Algorithm Confusion

OS Command Injection in sbt VCS Command Invocation on

SQL Injection in Parse Server PostgreSQL Backends

Authentication Bypass in Parse Server

Improper Output Neutralization / Injection in Froxlor

SSRF in Wallos logos/search Endpoint

SSRF in Wallos Notification Webhooks

SSRF in LoLLMs WEBUI Proxy Endpoint

Authorization Bypass / Improper Access Control

Insecure Direct Object Reference (IDOR) in Vikunja Task

Improper Authorization / Access Control in Vikunja

Remote Code Execution via Insecure Electron Configuration

Remote Code Execution via Insecure Desktop Wrapper

CSRF in DedeCMS Task Management Endpoint

Improper Authorization in Vikunja Account Status Handling

Path Traversal in Langflow Profile Picture Download Endpoint

Broken Access Control in Langflow Multi-Tenant Deployments

Command Injection in Intake Catalog Parsing

Shell Command Injection in CI/CD Pipelines in Langflow CI

Path Traversal / External Control of File Name

Improper Input Validation in MolotovCherry

SQL Injection in Online Enrollment System Parameter Handler

SQL Injection in SourceCodester Online Admission System

SQL Injection in Search Parameter Handling of Online

SSRF in Jeson CRM API Module System.php)

Improper Authorization in Patient Check-In Token Validation

SQL Injection in SourceCodester Online Catering Reservation

SQL Injection in Search Parameter of SourceCodester

CSRF in Go MCP SDK Streamable HTTP Transport

Memory Corruption / Buffer Overflow in Freeciv21 Network

Path Traversal in Salvo Proxy Routing

Path Traversal in Tekton Pipelines Git Resolver pathInRepo

Injection in Rails Active Storage DiskService

Path Traversal in Rails Active Storage DiskService#path_for

Server-Side Code Injection via LaTeX Rendering in Indico

SQL Injection in Free Hotel Reservation System Parameter

Improper Protection of Credentials in OpenClaw

Improper Authorization in Connect-CMS My Page Profile Update

Improper Authorization in Connect-CMS Page Content Retrieval

Stored Cross-Site Scripting (XSS) in Connect-CMS Form Plugin

XSS in Connect-CMS Cabinet Plugin List View

Code Injection in Connect-CMS Code Study Plugin

Information Exposure in Census CSWeb app/config Endpoint

Unrestricted File Upload in Census CSWeb 8.0.1

Path Traversal in Census CSWeb File Handling

Command Injection in Blinko MCP Server Creation

Path Traversal in Blinko File Server Endpoint Exposing

SQL Injection in WWBN AVideo Subscribe::save()

Missing Authentication in WWBN AVideo CDN Plugin

Unrestricted File Upload in WWBN AVideo Encoder Endpoint

Authentication Bypass in WWBN AVideo Live Stream Control

Path Traversal / File System Access Control in WWBN AVideo

SQL Injection in WWBN AVideo remindMe.json.php

Authorization Bypass / Incorrect Authorization

Cross-Site Request Forgery (CSRF) in WWBN AVideo

OS Command Injection in WWBN AVideo Restreamer Endpoint

Unrestricted File Upload in WWBN AVideo Image Gallery

Path Traversal / File Inclusion in WWBN AVideo locale API

Authentication Bypass / Broken Access Control

CSRF in WWBN AVideo Plugin Import Endpoint

SSRF in WWBN AVideo Live Test Endpoint

Command Injection in DigitalOcean Droplet Agent

Path Traversal in WWBN AVideo import.json.php File Import

Session Management / Session Fixation in WWBN AVideo

Insufficient Cryptographic Strength in WWBN AVideo PGP 2FA

Hard-Coded Credentials in GoHarbor Harbor Web UI

SQL Injection in WWBN AVideo RTMP on_publish Callback

OS Command Injection in WWBN AVideo FFmpeg Sanitization

SSRF in WWBN AVideo LiveLinks Proxy URL Validation

Code Injection in WWBN AVideo Gallery Plugin saveSort

Authentication Bypass and OS Command Injection

Improper File Path Handling in WWBN AVideo Encoder Upload

SQL Injection in WWBN AVideo Category Retrieval

SSRF in WWBN AVideo Live Standalone DVR Endpoint

Authorization Bypass / Insecure Direct Object Reference

SQL Injection in Simple Laundry System checklogin.php

SQL Injection in Simple Laundry System Parameters Handler

SQL Injection in Simple Laundry System Parameters Handler

Authentication Bypass in MacCMS Timming API Endpoint

OS Command Injection in Linksys MR9600 SmartConnect.lua

Path Traversal / Arbitrary File Deletion in WWBN AVideo

Path Traversal in WWBN AVideo HLS Streaming Endpoint

SQL Injection in Online Notes Sharing System /login.php

Unrestricted File Upload in Acrel Environmental Monitoring

SQL Injection in Green CMS 2.x Admin Posts Module

SSRF in WordPress Performance Monitor REST Endpoint

Missing Authentication in OpenClaw Sandbox Browser

OS Command Injection in OpenClaw system.run

Path Traversal in OpenClaw Workspace Validation

Improper Authorization in OpenClaw Agent Tool Surfaces

Missing Authorization in OpenClaw Operator Scope Assignment

Missing Authorization in Discourse Authorization Flow

Cleartext Transmission of Sensitive Information

SQL Injection in PbootCMS Member Login Username Check

Directory Traversal / Path Traversal in SiYuan

Path Traversal in NLTK Downloader XML Index Handling

Missing Authentication / Authorization in NLTK WordNet

SSRF in Budibase REST Datasource Query Preview

Authentication Bypass and Unsafe Runtime Error Handling

Authorization Bypass in gRPC-Go Servers

Information Exposure in HAPI FHIR Client

Authentication Rate Limiting / Brute-Force Protection

Improper Restriction of Authentication Attempts

Missing Authentication in EV Charging Backend

Missing Authentication in EV Charging Backend

Cross-Site Scripting (XSS) in Statamic CMS

Path Traversal / Arbitrary File Read in Allure 2 Report

Server-Side Template Injection (SSTI) in Dynaconf @Jinja

Denial of Service / Resource Exhaustion in Socket.IO Binary

SQL Injection in OneUptime Analytics StatementGenerator

OS Command Injection in AWStats 8.0 open Function

Directory Traversal in DreamFactory Core RestController

OS Command Injection in D-Link DIR-820LW SSDP Handler

OS Command Injection in Totolink WA300 Firmware Upgrade

Cleartext Transmission of Sensitive Information

Privilege Escalation in Checkmate User Profile Update

Unrestricted File Upload in Terrapack Web Components

Authorization Bypass in OpenClaw WebSocket Scope Handling

OS Command Injection in SysAK Command Handling

XSS in WeGIA Memorando Module listar_memorandos_ativos.php

Cross-Site Scripting (Reflected XSS) in WeGIA

SQL Injection in WeGIA restaurar_produto.php Endpoint

SQL Injection in WeGIA loadBackupDB()

Improper Authorization in Frigate User Management Allows

Improper Authentication in Frigate NVR User Management

XSS in Filament Table Summarizers (Range, Values)

Hardcoded Cryptographic Key / Insecure Key Management

XSS in SiYuan Bazaar Package Metadata Leading to RCE

XSS in SiYuan Package README Rendering Leading to RCE

Path Traversal File Write in Stirling-PDF Markdown-to-PDF

Code Injection in Mesop AI Testing Debug Server /exec-py

Path Traversal in Mesop FileStateSessionBackend

Insecure Direct Object Reference in Langflow API Key

SSRF in WWBN AVideo LiveLinks Proxy

Missing Authentication in WWBN AVideo

XML Entity Expansion Denial of Service in fast-xml-parser

Improper Access Control / Network Segmentation Bypass

SQL Injection in AVideo getSqlFromPost()

SSRF in AVideo Public Thumbnail Endpoints

Dynamic Code Execution in Langflow Public Flow Builder API

SQL Injection in ERP Application Endpoints

SQL Injection leading to OS Command Execution

Server-Side Request Forgery (SSRF) and Improper File Access

Cross-Site Scripting (XSS) in SiYuan Dynamic Icon API

Path Traversal and Information Disclosure in SiYuan Desktop

Improper Input Validation in free5GC NRF Discovery Service

Stored XSS in Anchorr Jellyseerr User Selector

XSS in Anchorr Web Dashboard User Mapping

SQL Injection in Open Source Point of Sale Item Search

Missing Authorization / Broken Access Control

SQL Injection in Admidio MyList Configuration

Access Control Bypass via Improper Input Handling

Path Traversal in pyLoad 7z Password Verification Enables

Path Traversal in pydicom DICOMDIR FileSet Operations

Path Traversal in CTFer.io Monitoring Archive Extractor

Improper Network Policy (CWE-284) in Fullchain CTF Platform

SQL Injection in SiYuan Full-Text Search Endpoint

LDAP Injection in SuiteCRM Authentication Flow

SQL Injection in SuiteCRM Directory-Backed Authentication

SQL Injection in Kysely MySQL/SQLite Dialects

Improper Authorization in File Browser Self-Registration

Unrestricted File Upload in Admidio Documents & Files Module

Broken Access Control / Insecure Direct Object Reference

Unsafe Deserialization in SuiteCRM SavedSearch Filter

XSS in LuCI Wireless Scan Modal on OpenWrt

Privilege Escalation via Environment Manipulation

Code Injection RCE in SuiteCRM Module Loader

Code Injection in SuiteCRM Modules

Cross-Site Scripting (XSS) / HTML Injection in SuiteCRM

SQL Injection in SuiteCRM OutboundEmail retrieve() Function

SSRF in SuiteCRM RSS Feed Dashlet

SQL Injection in SuiteCRM AOR_Reports Module

Improper Input Validation / Configuration Injection

Authentication Bypass in SiYuan Knowledge Management

Stored XSS in FreeScout Email Notification Templates

XSS in SiYuan Mobile File Tree Enables Remote Code Execution

Improper Access Control in OpenClaw Sandbox

Authentication Bypass over Insecure Transport in OpenClaw

Path Traversal in OpenClaw stageSandboxMedia Remote

Authentication Throttling and Brute-Force Protection

Authorization Logic Bypass in OpenClaw system.run Allowlist

Server-Side Request Forgery (SSRF) in OpenClaw

Missing Authorization in Discourse Policy Plugin

Stored XSS in OpenEMR Patient Portal Payment Flow

SSRF in OpenEMR Eye Exam PDF Generation

Incorrect Authorization in OpenEMR ACL Deny Handling

Improper Output Encoding in OpenEMR Eye Exam PDF Generation

Path Traversal / Arbitrary File Write in SiYuan Import APIs

Prompt Injection / LLM-Assisted Code Generation Abuse

Improper Authentication in Step CA SCEP UpdateReq

Input Validation Bypass in ormar FastAPI Models

OS Command Injection in OpenEMR Backup Functionality

Path Traversal / Arbitrary File Read in Wgcloud Database

Path Traversal (CWE-22) in PyMuPDF embedded get

Authentication and Session Management in OPEXUS eComplaint

SSRF in wgcloud Backend Database Connection Test

Code Injection in wgcloud Test Connection Function

XML External Entity (XXE) Injection in Autogram XML

Cross-Site Scripting (XSS) in HCL Unica Marketing Operations

Command Injection in OpenClaw Lobster Extension Tool

Authorization Bypass in OpenClaw Synology Chat Channel

Command Injection in OpenClaw Windows Scheduled Task Script

SSRF in OpenClaw Web Search Citation Redirects

OS Command Injection / Shell Command Injection

Command Injection / OS Command Allowlist Bypass

SSRF in Kan Attachment Download API

Path Traversal in Romeo Coverage Webserver

Access Control Misconfiguration in Romeo Hardened Namespace

Path Traversal / Zip Slip in ApostropheCMS Import-Export

Authentication Bypass in ApostropheCMS

Stored Cross-Site Scripting (XSS) in Parse Server

XSS in OpenProject Repositories Module

SQL Injection in OpenProject Cost Report Custom Fields

SQL Injection in ClipBucket v5 ajax actions endpoint

Unsafe Deserialization in OmniGen2-RL Reward Server

SQL Injection in Microsoft Dynamics 365 Customer Engagement

Improper Origin Validation and Insecure Credential Handling

Sensitive Information Exposure in Glances Central Browser

SQL Injection in Glances DuckDB Export Module

OS Command Injection in WiFi Extender WDR201A Web

Broken Access Control / Improper Authorization

Hardcoded Credentials / Credential Disclosure

Arbitrary Code Execution in aaPanel v7.57.0

Path Traversal / Zip Slip in CTFd Admin Import Functionality

Information Disclosure / Sensitive Data Exposure

Broken Access Control / Authorization Logic Error

Authorization Bypass in Juju Vault Secrets Back-end

Improper Access Control in LibreChat RAG API JWT Secret

Command Injection in Glances Monitoring

Insufficient Cryptographic Protection / Key Management

Information Exposure in Glances Monitoring Server

Improper Access Control in Kube-router Proxy

Cross-Site Scripting (XSS) in jsPDF PDF Generation

Improper Output Neutralization / Injection into Generated

SQL Injection in Cockpit CMS MongoLite Aggregation Optimizer

Insecure Direct Object Reference in Moodle Custom

SSRF in OpenClaw Strict URL Fetch Paths

Command Injection in OpenClaw macOS node-host system.run

Path Traversal in OpenClaw Feishu Media Download Flow

Unrestricted File Upload / Insecure Authentication

Command Injection / Arbitrary Code Execution via Untrusted

OS Command Injection in Roxy-WI Configuration Compare

SQL Injection in GLPI Inventory Plugin Reporting

Path Traversal in Ray Dashboard Static File Handler

Broken Access Control in SpeedExam ReviewAnswerDetails API

SQL Injection in Simple Food Order System add-item.php

OS Command Injection in Angeet ES3 KVM cfg.lua

Missing Authentication for Critical Function in Angeet ES3

Missing Authentication in Sipeed NanoKVM

Improper Authentication Rate Limiting in JetKVM Login

Authentication Rate Limiting / Brute-Force Protection

Privilege Escalation via Insecure Configuration and File

Unsafe Deserialization in Wazuh Cluster Master

SSRF in Spinnaker Clouddriver and Orca

Insecure Direct Object Reference (IDOR) in Outline Draft

Missing Authorization in Apache Airflow Execution API HITL

Command Injection in kubectl-mcp-server minimal_wrapper.py

Code Injection RCE in Use It Flow Admin Moniteur Endpoint

Improper Authorization in Craft CMS UsersController

SQL Injection in Chamilo LMS Statistics AJAX Endpoint

Arbitrary File Upload / Code Injection in Chamilo LMS H5P

SQL Injection in Chamilo LMS custom_dates Parameter

Incomplete Input and Output Validation (CWE-20, CWE-116) in Python http.cookies Morsel & BaseCookie

Improper Input Validation in GLPI Fields Plugin Dropdowns

SQL Injection in Chyrp Admin.php Component

Directory Traversal / Path Traversal in Doom Launcher Game

Authentication Bypass in Tenda AC8 IPv6 Handler

SQL Injection in Free Hotel Reservation System Reports

SQL Injection in itsourcecode Online Enrollment System 1.0

SQL Injection in Online Enrollment System login.php

SSRF in Vanna Flask Endpoint update_sql/run_sql

SQL Injection in vanna-ai BigQuery Vector

SQL Injection in itsourcecode Payroll Management System

Improper Access Control in D-Link NAS/Recorder

Improper Access Control in D-Link DIR-823G goahead

Improper Access Control in D-Link DIR-816 goahead

OS Command Injection in Wavlink WL-WN578W2 Wireless POST

OS Command Injection in Wavlink WL-WN579A3 Wireless POST

Authentication and Authorization in Runtipi verify-totp

Code Injection / Sandbox Escape in SimpleEval

Cross-Site Scripting (XSS) in Angular Runtime and Compiler

SQL Injection in AnythingLLM SQL Agent Database Connectors

Improper Certificate Validation in cpp-httplib

XSS in AnythingLLM Desktop Chat Rendering Pipeline Leading

Host Header Injection in Pigeon Email Verification URLs

Missing Authentication in Parse Server

Unsafe Deserialization in Apache Spark History Server Event

Path Traversal in Clasp Project File Handling Enables

Improper Validation of Token Headers in PyJWT

Cross-Site Scripting (XSS) in OneUptime

SQL Injection in OneUptime Telemetry Aggregation API

Code Injection in Locutus create_function

SSRF in Centrifugo Dynamic JWKS Endpoint Resolution

Missing Authentication / Session Binding in OAuth Flows

Path Traversal in Dagu Inline DAG Execution

Missing Authentication in Dagu Workflow Engine

Path Traversal in SFTPGo Virtual Filesystem Routing

Code Injection / Sandbox Escape in SandboxJS

HTTP Request Smuggling in Erlang OTP inets httpd

OS Command Injection in Thingino Firmware WiFi Captive

Path Traversal in Voltronic Power SNMP Web Pro upload.cgi

Missing Authentication in Voltronic Power SNMP Web Pro

Missing Authentication for Critical Functionality

Path Traversal in Black Python Formatter

Command Injection in Deno node:child_process Polyfill

Authentication Bypass in Tinyauth OIDC Authorization

SSRF in Backstage Auth Backend CIMD Metadata Fetch

Path Traversal and Insecure File Handling in ZeptoClaw

Missing Authentication / Improper Identity Validation

Improper Access Control / Hard-coded Secret Exposure

OS Command Injection in GL-iNet GL-AR300M16 set_config

Path Traversal / Insecure File Loading in DataEase Redshift

SQL Injection in DataEase previewData Endpoint

Path Traversal in Magic Wormhole File Receiving Flow

OS Command Injection in GL-iNet GL-AR300M16 System Log

SQL Injection in GL-iNet GL-AR300M16 add_group() Function

OS Command Injection in GL-iNet GL-AR300M16 Firmware

OS Command Injection in GL-iNet GL-AR300M16 Echo Server

Archive Parsing Inconsistency and Path Handling (CWE-20) in Python tarfile Module

Path Traversal in TinaCMS CLI Media Endpoints

Path Traversal with Insecure Cross-Origin Resource Sharing

Path Traversal in TinaCMS Development Server

XSS in Postal Admin Interface send/raw API

SSRF in OpenCTI Data Ingestion URLs

OS Command Injection (CWE-78) in Canonical LXD API

Unsafe Pickle Deserialization (CWE-502) in SGLang Script

Unsafe Deserialization in SGLang Encoder Parallel

Unsafe Deserialization in SGLang ZMQ Multimodal Generation

SQL Injection in itsourcecode Cafe Reservation System

SQL Injection in Online Doctor Appointment System

SQL Injection in Online Doctor Appointment System

SQL Injection in FeMiner WMS Basic Organizational Structure

Authentication Bypass in AdGuard Home

Server-Side Request Forgery (SSRF) in 2FAuth

Broken Access Control / Insecure Direct Object Reference

XSS in Grafana Cubism Panel Zoom Link Handler

Improper Access Control / Authorization in Winter CMS

SQL Injection in OpenEMR Ajax Graphs Library

Missing Authorization in OpenEMR

Authorization Bypass in OpenEMR

XSS in OpenEMR Patient Portal Rendering

Server-Side Request Forgery (SSRF) in SiYuan forwardProxy

Authorization Logic Error in StudioCMS S3 Storage Manager

Use of Hard-coded Credentials in ThermaKube Master Component

SQL Injection in benkeen generatedata 4.0.14

Insecure Access Control in Asseco SEE Live 2.0 Contact Plan

Information Exposure in Parse Server Protected Fields

Broken Access Control / Insecure Direct Object Reference

SSRF in Plunk SNS Webhook Handler

Improper Input Validation in Black GitHub Action

SQL Injection in WeGIA remover_produto_ocultar.php

SQL Injection in WeGIA Product Restore Endpoint

Broken / Missing Authorization in Shopware store-api.order

Missing Authentication in Runtipi Homeserver Orchestrator

SQL Injection in Frappe Web Application Framework Endpoint

Improper Access Control / Broken Authorization

Arbitrary File Upload in FileThingie 2.5.7

OS Command Injection in Cloud CLI WebSocket Shell Handler

Authorization Bypass / Access Control Misconfiguration

SQL Injection in Parse Server PostgreSQL Increment Handler

OS Command Injection in Cloud CLI Git API Endpoints

OS Command Injection in Cloud CLI git-config Endpoint

SQL Injection in Craft CMS ElementSearchController Search

Code Injection in Craft CMS Conditions System

SQL Injection in Parse Server PostgreSQL Increment

AI-Assisted Command Injection in Cursor AI Code Editor

Improper Authorization / Permission Misconfiguration in

SQL Injection in Parse Server PostgreSQL Backend

Authorization Bypass in Argo Workflows WorkflowTemplate

Code Injection / Prompt Injection in OpenClaw Agent Platform

Missing Authorization in Argo Workflows Template Endpoints

Path Traversal File Write in Vociferous export_file API

Unsafe Deserialization in GLPI Technician File Handling

SSRF in SunbirdEd-Portal v1.13.4

Improper Authentication and Access Control in ClassroomIO

Command Injection in OpenClaw systemd Generator

Path Traversal in OpenClaw Workspace Handling

Authorization Bypass in OpenClaw tools.exec.safeBins sort

SQL Injection in itsourcecode University Management System

Command Injection in H3C ACG1000-AK230 Web UI

Use of Hard-coded Credentials in netbox-docker

Authentication Bypass in MiCode FileExplorer SwiFTP Server

Information Exposure / Authentication Bypass on Error

Improper Authorization / Privilege Escalation

SSRF in Flowise HTTP Node for AgentFlow and Chatflow

LDAP Injection in Parse Server LDAP Authentication Adapter

Path Traversal in OliveTin saveLogs Feature

Path Traversal in gleam-wisp wisp.serve_static

Improper Authorization / Access Control in NervesHub Web

Incorrect Authorization in zot OCI Registry

Missing Authorization in Parse Server REST API

Improper Authentication in Parse Server OAuth2 Adapter

Authorization Bypass / Improper Access Control

Improper Authorization / Access Control in Parse Server

SSRF in LinkAce Link Creation Endpoint

Path Traversal / Arbitrary File Access in liquidjs Template

SQL Injection in Sequelize JSON/JSONB Where Clauses

Improper Authentication in Parse Server Keycloak Adapter

Authorization Bypass in Parse Server

Hardcoded Credentials in Tenda G1V3.1si Router Firmware

Hardcoded Credentials in Tenda i24V3.0si Firmware

Information Exposure in Git for Windows Clone Operation

Authentication Bypass in FeathersJS OAuth Service

SQL Injection in Craft Commerce Inventory Levels Sorting

SQL Injection in Craft Commerce Purchasables Endpoint

CSRF in GetSimple CMS massiveAdmin Plugin

Path Traversal and Arbitrary File Write in MCP Atlassian

Authorization Bypass in Envoy RBAC Filter

Command Injection in simple-git Node.js Library

SSRF in MCP Atlassian HTTP Middleware

Server-Side Request Forgery (SSRF) in pdfmake URLResolver

Protection Mechanism Failure / Missing Authorization on

Missing Authorization / Safety Gate on Critical Operation

Command Injection in GitHub Enterprise Server

Missing Authorization in Coral Server

Improper Authorization / Session Management in Coral Server

Missing Authorization in Coral Server Collaboration Sessions

Path Traversal in OneUptime Workflow Docs Endpoint

Improper Authorization in OneUptime Multi‑Tenant Access

Broken Access Control / Insecure Direct Object Reference

Improper Authorization / Insecure Direct Object Reference

XSS in FileBrowser Quantum Share Metadata

Information Exposure / Incomplete Authentication

SQL Injection in Glances TimescaleDB Export Module

Information Exposure in Glances config Endpoint

Improper Authentication (CWE-287) in Windows SMB

Improper Rate Limiting / Brute-Force Protection Failure

Unsafe Deserialization in LimeSurvey Server

SQL Injection in LimeSurvey Pre-6.15.4+250710

Improper Authorization / Access Control in OneUptime

Cross-Site Scripting (XSS) in facileManager fmDNS Module

XSS in facileManager fmDNS log_search_query Parameter

Remote Code Execution via Script Injection in OneUptime

Path Traversal in SiYuan /export Endpoint Exposing Secrets

Stored Cross-Site Scripting (XSS) in Appsmith TableWidgetV2

Improper Authorization in Pocket ID OIDC Token Endpoint

Open Redirect / Unvalidated Redirects in Pocket ID OIDC

CSRF in InstantCMS Privileged Actions

Improper Access Control in SiYuan Publish Service

Authorization / Access Control in Misskey Server

Improper Input Validation in Kubernetes ingress-nginx

Authentication and Authorization Bypass in Budibase Server

Path Traversal / Arbitrary File Read in Budibase PWA ZIP

SSRF in vLLM load_from_url_async

Client-Side Enforcement of Server-Side Security Controls

Broken Access Control / Missing Authorization

Path Traversal in SunbirdEd-portal v1.13.4

OS Command Injection in Budibase PostgreSQL Integration

CSRF in SunbirdEd-portal v1.13.4

Authorization Bypass / Broken Access Control in FreshRSS

Incorrect Access Control in Tenda W15E Configuration

Hard-Coded Credentials in Keygraph Shannon Router

OS Command Injection in linagora Twake v2023.Q1.1223

Cross-Site Scripting (XSS) in linagora Twake v2023.Q1.1223

Cleartext Transmission of Sensitive Information

Server-Side Request Forgery in ThermaKube Master

SQL Injection in University Management System

Improper Authorization in SourceCodester Client Database

Improper Authorization in Client Database Management System

SQL Injection in University Management System

SQL Injection in Online Art Gallery Shop Admin Panel

SQL Injection in Online Art Gallery Shop adminHome.php

SQL Injection in Online Art Gallery Shop 1.0

SQL Injection in add_result.php of University Management

SQL Injection in Login Component of Simple Responsive

SQL Injection in Student Web Portal signup.php

SQL Injection in University Management System

SQL Injection in SearchResultRoundtrip.php of Simple Flight

SQL Injection in SearchResultOneway.php of Simple Flight

Improper Authorization in Client Database Management System

SQL Injection in Free Hotel Reservation System Amenities

SQL Injection in Simple Flight Ticket Booking System

SQL Injection in Simple Flight Ticket Booking System

SQL Injection in Simple Flight Ticket Booking System

SQL Injection in Simple Flight Ticket Booking System

OS Command Injection in Totolink N300RH CGI Wi-Fi WPS

Improper Authentication in Parse Server OAuth JWT Adapters

Command Injection in WeKnora

SQL Injection in WeKnora Query Engine

Authorization Bypass / Broken Access Control in WeKnora

Improper Output Encoding / Injection into Templating Engine

Improper Authentication / Identity Injection in Caddy

SSRF in PinchTab /download Endpoint

Server-Side Request Forgery (SSRF) in Soft Serve Git Server

CSRF in Ghost Session Verification Endpoint

Information Exposure in UptimeFlare Client Bundle

Path Traversal in pyLoad edit_package Folder Handling

Improper Authorization in Netmaker Host JWT Middleware

Insufficiently Protected Credentials in DSA Study Hub Auth

Authentication Bypass in ZITADEL Login V2 UI

Open Redirect / Unsafe Redirect Handling in ZITADEL Login V2

XSS in ZITADEL Login V2 /saml-post Endpoint

Configuration Injection / Code Execution via Unsafe

Open Redirect / Untrusted Host Header Usage in ZITADEL

Path Traversal / Arbitrary File Deletion in Meta Box

SSRF in Wallos Notification Testers

Path Traversal / Server-Side Request Forgery (SSRF)

Missing Authentication in Flowise

Broken Access Control / Insecure Direct Object Reference

Unrestricted File Upload in Flowise Attachment API

Authorization Bypass in Flowise Admin APIs

Information Exposure in Plane Project Management API

SSRF in Plane Webhook URL Validation

Missing Authorization / Policy Enforcement in Mercurius

Improper Authorization in Flare Thumbnail Endpoint

Authorization Bypass in Parse Server /loginAs Endpoint

Improper Authentication / JWT Validation Flaw

Missing Authorization in Vito Workflow Site-Creation Across

Authorization Bypass / Incorrect Authorization

Sensitive Data Exposure in Wekan Global Webhooks Publication

Sensitive Data Exposure in Wekan Board Integrations

SSRF in Wekan Board Import Attachment Handling

Authentication Bypass in Rocket.Chat Enterprise DDP Streamer

Eval Injection / Code Injection in Locutus

Authorization Bypass in @hono/node-server Static File

Authentication Bypass in Rocket.Chat DDP Streamer Account

Command Injection in GitHub Copilot CLI Shell Tool

XSS in Kestra Execution-File Markdown Preview

Code Injection in Mesa Benchmarks Pipeline

Path Traversal in Zarf Package Handling

Broken Access Control in Ibexa & Ciril GROUP eZ/Ciril

Missing Authentication in EV Charging Backend

Improper Rate Limiting in WebSocket Authentication Interface

Improper Authentication Rate Limiting in WebSocket API for

Missing Authentication in OCPP WebSocket Charging Endpoints

XSS in SiYuan Knowledge Management System

XML Entity Expansion / Denial of Service in SVGO SVG

Improper Access Control / SQL Query Abuse in SiYuan sql

Path Traversal in Windmill get_log_file Endpoint

Path Traversal / Zip Slip in changedetection.io Backup

OS Command Injection in AVideo Platform

Code Injection / Expression Injection in changedetection.io

Path Traversal in OpenChatBI Report Saving Tool

SQL Injection in CocoIndex Doris Target Connector Table

Authentication Bypass in OneUptime 2FA Flow

SQL Injection in Ghostfolio getHistorical() Symbol Handling

Cross-Site Scripting (XSS) in Gokapi File Sharing Server

Host Header Injection / Insecure Account Recovery in IRRD v4

SSRF in Ghostfolio Manual Asset Import

Path Traversal in Home-Gallery File Download Handler

SSRF in OpenSift URL Ingestion Pipeline

Path Traversal in OpenSift Storage Helpers

Server-Side Request Forgery (SSRF) in Idno URL Unfurl API

OS Command Injection in Idno

Path Traversal in Talishar ParseGamestate.php gameName

Broken Authentication and Authorization in Chartbrew

SQL Injection in Chartbrew Database Connectors

Code Injection RCE in Chartbrew API Leading to Remote Code

Code Injection in Chartbrew MongoDB Dataset Query

Insecure Service Exposure / Misconfigured Session Storage

Improper Input Validation in TinyWeb CGI Environment Mapping

Unrestricted File Upload in Chamilo LMS

Unrestricted File Upload in WWBN AVideo Plugin Import

SQL Injection in WWBN AVideo catName Parameter

HTTP Request Smuggling via Integer Overflow in TinyWeb HTTP

Cross-Site Scripting (XSS) in Chamilo Course Description

XSS in Chamilo Course Learning Path Settings

CSRF in Chamilo Course Project Deletion

XSS in Chamilo LMS Social and Messaging Features

OS Command Injection in Wavlink WL-NU516U1 OTA Online

Improper Limiting of Authentication Attempts in WebSocket

Missing Authentication in EV Charging Backend

Missing Authentication in OpenClaw BlueBubbles Webhook

Local File Inclusion / Path Handling in OpenClaw

Missing Authentication for Critical Function in OpenClaw

Command Injection / Argument Injection in OpenClaw git

Path Traversal in OpenClaw Transcript File Handling

Use of Weak Cryptography in OpenClaw Sandbox Configuration

CSRF in OpenClaw Manual OAuth Chutes Login Flow

SSRF in OpenClaw Tlon Urbit Extension

Improper Authorization in OpenClaw Nextcloud Talk Plugin

Authorization Bypass in OpenClaw Exec Approvals

Authentication Bypass in OpenClaw Gateway WebSocket

Command Injection / Shell Metacharacter Injection

Improper Authorization / Context Confusion in OpenClaw

Missing Authentication in OpenClaw

Improper Authorization in OpenClaw Gateway

OS Command Injection in OpenClaw Exec-Approvals Allowlist

Path Traversal File Write in OpenClaw Browser Control File

Path Traversal / External Control of File Path

Missing Authentication in OpenClaw Browser Relay

Path Traversal in OpenClaw Archive Handling

SSRF in OpenClaw Feishu Extension

Access Control Bypass in OpenClaw Twitch Plugin Agent

Path Traversal in OpenClaw Plugin Installation

Insecure Module Loading / Untrusted Search Path

Authorization Bypass in OpenClaw Slack Slash-Command DM

OS Command Injection in OpenClaw Exec Allowlist

Broken Access Control in File Browser TUS DELETE Endpoint

Improper Access Control in Frappe Document Sharing

SQL Injection in OpenReplay cards search endpoint

Improper Input Validation / Path Handling in ZimaOS File

Cross-Site Scripting (XSS) in Frappe Avatar Image URLs

Improper Access Control / Logic Error in Smart Contract

XSS in MarkUs Assignment Submission Preview

Code Injection in Aranda Service Desk Web Edition ASDK API

Broken Access Control in OC Messaging / USSD Gateway

Stored Cross-Site Scripting (XSS) in Chamilo Social Networks

Broken Access Control in OliveTin KillAction RPC

Improper Privilege Management in D-Link DIR-1253 MESH

Command Injection in FreePBX Recordings Module

SQL Injection in FreePBX Logfiles Module

SQL Injection in FreePBX CDR (Call Data Record) Module

OS Command Injection in FreePBX ElevenLabs TTS Recordings

Improper Authentication and Sensitive Data Exposure

Missing Authorization / Broken Access Control

Broken Access Control in Cognix Recon Client Password Reset

Improper Authorization / Privilege Management

Cross-Site Scripting (XSS) in Gogs Milestone Handling

XSS in Gogs Issue and Comment Rendering

Path Traversal in D-Link DIR-513 getAuthCode Handler

Path Traversal / Arbitrary File Read in Exploding Gradients

Cleartext Transmission of Sensitive Information

Improper Certificate Validation in RustDesk Client HTTP API

CSRF in RustDesk Client URI Scheme Handling

Authentication and Password Brute Forcing in RustDesk

Server-Side Code Injection in Ghost CMS

HTTP Request Smuggling in Pingora HTTP/1.0 and

HTTP Request Smuggling in Pingora Proxy

Injection Vulnerability in Open OnDemand Files Application

Authorization / Access Control in Vaultwarden Collection

Privilege Escalation / Broken Access Control in Vaultwarden

Injection / URL Parameter Manipulation in LangSmith Studio

Stored Cross-Site Scripting (XSS) in XWiki Blog Post Title

Path Traversal in OpenDeck Plugin Static File Server

Code Injection in Craft CMS Twig Arrow Functions

Authorization Bypass / Insecure Direct Object Reference

Broken Authentication & Insecure Communication

SQL Injection in vran-dev databaseir Search API Endpoint

Arbitrary Memory Read/Write in Kernel Driver in Nil

OS Command Injection in Mobvoi Tichome Mini Smart Speaker

Insecure Permissions / Race Condition Leading to Arbitrary

Unsafe Deserialization / PHP Object Injection

Unrestricted File Upload in FreeScout

Improper Authentication and Rate Limiting in HomeBox

Unsafe Deserialization in Qwik server$ RPC Mechanism

OS Command Injection in Froxlor Admin Panel

XSS in AliasVault Web Client Email Renderer

Authentication and Authorization Bypass in OpenSTAManager

Sensitive Information Exposure in OpenEMR

Improper Authentication / Authorization in OpenEMR MedEx

Path Traversal File Write in OpenEMR EtherFax Document

SQL Injection in Logistic Hub Parcel's Management System

Plaintext Credential Storage in Weintek cMT-3072XH2 easyweb

Command Injection in Weintek cMT-3072XH2 HMI Name Parameter

Hardcoded Credentials in Weintek cMT-3072XH2 EasyWeb

Command Injection in Weintek cMT-3072XH2 DHCP Activation

Incorrect Access Control in Weintek cMT-3072XH2 easyweb

OS Command Injection in Cohesity TranZman Web API Scheduler

Use of Weak Cryptography in Cohesity TranZman Migration

OS Command Injection in Cohesity TranZman Migration

Improper Privilege Management in Cohesity TranZman

Path Traversal in OpenViking

SQL Injection in BaseServiceImpl of renren-security

Unsafe Deserialization in Step-Video-T2V API Endpoints

Command Injection in szc Script of Stabilizer Project

Improper Certificate Validation in AWS-LC PKCS7_verify()

SQL Injection in Simple Food Order System cancel-order.php

SQL Injection in Simple Food Order System Ticket View

Improper Privilege Management in 'theshit' Shell Command

SQL Injection in Simple Food Order System Ticket View

SQL Injection in Simple Food Order System edit-orders Router

SQL Injection in Simple Gym Management System Trainer Search

Code Injection in AFFiNE Desktop Handler

SQL Injection in Pharmacy Point of Sale System Supplier View

SQL Injection in Pharmacy Point of Sale System Receipt View

SQL Injection in Pharmacy Point of Sale System view_product

SQL Injection in Pharmacy Point of Sale System Category View

SQL Injection in NocoDB