Universal Security Vulnerabilities & CVE Catalog

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions....

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions....

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions....

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions....

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions....

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions....

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions....

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions....

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions....

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions....

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions....

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5....

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes ...

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions....

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions....

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions....

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions....

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions....

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. ...

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize...

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can co...

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create c...

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted w...

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scri...