All CVEs — page 661 of 678
The complete archive, 25 per page, newest first. 16938 records. Search instead.
The flaw allows unauthenticated clients to read any file accessible by the backend process due to improper URI handling and lack of proper token validation in non-Electron deployments.
The flaw allows remote URLs to be included in Facelet processing, potentially exposing sensitive files. This matters because it can lead to unauthorized access to critical server files.
The flaw allows admin users to upload arbitrary files without validation, posing a significant security risk.
The flaw allows unauthorized users to perform database operations such as adding, editing, and deleting records without proper authentication, posing a significant security risk.
The flaw allows an attacker to bypass authentication by directly manipulating the SQL query through unescaped POST parameters, leading to unauthorized access.
The flaw allows SQL injection by improperly sanitizing user input and directly concatenating it into a SQL query.
The flaw lies in the backmeup npm package, which directly concatenates user-provided values into shell commands, leading to potential command injection. This is significant because it allows an attacker to execute arbitrary commands, compromising the system.
The flaw allows any authenticated user to manipulate notes from another company due to missing company-ownership verification, posing a significant security risk.
The flaw allows unauthorized access to sensitive API endpoints by enumerating card_id values, compromising user data security.
The flaw allows untrusted user input to be directly rendered in email templates, leading to potential template injection attacks.
The flaw lies in DjangoCRM hardcoding the Django SECRET_KEY in the settings.py file, allowing anyone to read the public repository to forge session cookies, CSRF tokens, and password reset tokens, leading to full account takeover.
The flaw allows an unauthenticated attacker to bypass authentication and potentially extract database data via SQL injection, posing a critical security risk.
The flaw lies in the manual reversal of HTML entity encoding after purification with HTMLPurifier, potentially allowing for injection of malicious scripts.
The flaw allows authenticated users to execute arbitrary Lua scripts, leading to remote code execution (RCE) and potential data exfiltration or system compromise.
The flaw allows unauthorized access to document downloads by merely providing a non-empty query parameter, leading to potential data exposure.
The flaw allows an attacker to inject malicious HTML into the client portal by exploiting the raw output directive in the 'terms' field, leading to Cross-Site Scripting (XSS).
The flaw allows execution of dangerous PHP functions in template content due to incomplete blacklist filtering, enabling remote code execution.
The flaw allows an attacker to execute arbitrary SQL commands by injecting malicious input into the decoded cookie value, leading to potential unauthorized access to user data.