Search Vulnerabilities

AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

Craft CMS has unauthenticated activation email trigger with potential user enumeration

Kimai's API invoice endpoint missing customer-level access control (IDOR)

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

Craft CMS has Twig Function Blocklist Bypass

Craft CMS: Entries Authorship Spoofing via Mass Assignment

Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Craft CMS has IDOR via GraphQL @parseRefs

Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection