Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.Check if you run itEPSS 0.29%Nov 7, 2025
- Medium6.5An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32.Check if you run itEPSS 0.45%Nov 7, 2025
- High7.6A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32.Check if you run itEPSS 0.31%Nov 7, 2025
- Medium6.5A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint.Check if you run itEPSS 0.26%Nov 7, 2025
- Medium6.5The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) aCheck if you run itEPSS 0.16%Nov 7, 2025
- Medium6.5The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations.Check if you run itEPSS 0.16%Nov 7, 2025
- Medium6.1Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browCheck if you run itEPSS 0.28%Nov 7, 2025
- Medium6.1Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creCheck if you run itEPSS 0.36%Nov 7, 2025
- Critical9.6In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an imCheck if you run itEPSS 0.38%Nov 7, 2025
- Critical9.1In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java cCheck if you run itEPSS 1.06%Nov 7, 2025
- Critical10.0Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrarCheck if you run itEPSS 0.92%Nov 7, 2025
- Medium6.5An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, alCheck if you run itEPSS 0.27%Nov 7, 2025
- Medium6.5There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document query function under tCheck if you run itEPSS 0.38%Nov 7, 2025
- Medium6.1Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Upcoming Reminder", allCheck if you run itEPSS 0.24%Nov 7, 2025
- Medium6.1The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input.Check if you run itEPSS 0.24%Nov 7, 2025
- Medium6.1Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing anCheck if you run itEPSS 0.24%Nov 7, 2025
- Medium6.1TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.Check if you run itEPSS 0.23%Nov 7, 2025
- Medium6.1TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter.Check if you run itEPSS 0.23%Nov 7, 2025
- Medium4.1CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessionCheck if you run itEPSS 0.29%Nov 7, 2025
- Medium5.4A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injectiCheck if you run itEPSS 0.29%Nov 7, 2025
- High7.5A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117.Check if you run itEPSS 0.49%Nov 7, 2025
- High7.5AstrBot Project v3.5.22 contains a directory traversal vulnerability.Check if you run itEPSS 0.83%Nov 7, 2025
- Medium6.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.Check if you run itEPSS 0.34%Nov 7, 2025
- UnknownImproper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 1.54%Nov 7, 2025
- Unknowndigitalzoomstudio zoomsounds Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 5.39%Nov 7, 2025
Sort