Complete database of CVE vulnerabilities. Track critical security threats, exploits and patches. Updated daily from NVD NIST.
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for …
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] …
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline …
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before …