| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. |
| A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key
. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release. |
| Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. |
| Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. |
| In Gitea before 1.21.2, an anonymous user can visit a private user's project. |
| In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. |
| Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7.
|
| Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
|
| Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account. |
| CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons. |
| CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token. |
