All CVEs — page 896 of 912
The complete archive, 25 per page, newest first. 22791 records. Search instead.
The flaw allows an attacker to inject malicious HTML into the client portal by exploiting the raw output directive in the 'terms' field, leading to Cross-Site Scripting (XSS).
The flaw allows execution of dangerous PHP functions in template content due to incomplete blacklist filtering, enabling remote code execution.
The flaw allows an attacker to execute arbitrary SQL commands by injecting malicious input into the decoded cookie value, leading to potential unauthorized access to user data.
The Zbtlink router firmware contains an embedded implant called ENDLESSDOORS that provides unauthenticated remote code execution as root, posing a critical security risk.
The flaw allows an attacker to perform unauthenticated arbitrary file writes outside the workspace, potentially leading to remote code execution.
The flaw allows unauthenticated attackers to read arbitrary files by manipulating path parameters in the `/hostedPlugin` endpoint, due to improper path resolution.
A privilege escalation vulnerability allows authenticated users to gain full administrative access, bypassing role-based access controls.
The flaw allows unauthorized access to sensitive information via the /network/graph API due to missing authentication, posing a significant security risk.
The flaw allows a user with namespace-scoped 'edit' privileges to create a Subscription resource that includes cluster-scoped resources, leading to full cluster-admin privilege escalation.
The flaw allows a tenant administrator with namespace-scoped privileges to escalate their permissions by creating a namespaced ClusterCurator, leading to full cluster control.
The flaw allows authenticated attackers with Administrator-level access to execute arbitrary OS commands as the web-server user through insufficient sanitization of the `file` POST parameter in the Backup Migration plugin for WordPress.
The flaw allows authenticated attackers with Subscriber-level access to relink the MailMunch integration, leading to unauthorized access to subscriber data.
The flaw allows unauthenticated attackers to delete arbitrary search-term records via a forged request, potentially leading to loss of valuable search history data.
The flaw allows path traversal by not validating the resolved file path after using path.resolve, potentially leading to unauthorized access or execution of files.
The flaw allows an attacker to bypass authentication by manipulating the session_variables object in the request body, overriding the Authorization header's JWT claims without verification.
The flaw allows an attacker to perform unlimited password-guessing attempts against any account, including administrators, due to the absence of rate-limiting or account lockout mechanisms when the captcha is disabled, which is the default configuration.