Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join

itthinx Groups

Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload

burhandodhy Smart Auto Upload Images – Import External Images

Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting

kitae-park Mang Board WP

Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection

stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI

Ovatheme Events Manager <= 1.8.6 - Missing Authorization

ovatheme Ovatheme Events Manager

WPFunnels <= 3.6.2 - Unauthorized User Registration

getwpfunnels Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels

Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export

werbeagenturcommotion Course Booking System

WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage

f1logic WP2Social Auto Publish

Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key

codename065 Download Manager

Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset

rnzo Contact Form 7 AWeber Extension

Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

neofix Simple Downloads List

Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

asgaros Asgaros Forum

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

open-webui open-webui openwebui open_webui

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

open-webui open-webui openwebui open_webui

Soft Serve does not sanitize ANSI escape sequences in user input

charmbracelet soft-serve

SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM SuiteCRM-Core salesagility suitecrm

SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection

SuiteCRM SuiteCRM-Core salesagility suitecrm

SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

SuiteCRM SuiteCRM salesagility suitecrm

SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

SuiteCRM SuiteCRM SuiteCRM SuiteCRM +1个

SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

SuiteCRM SuiteCRM SuiteCRM SuiteCRM +1个