https://vulnogram.org/ Most recent CVEs assigned by mend (mend). https://vulnogram.org/seaview/icons/mend.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2022-32176 https://vulnogram.org/CVE-2022-32176 In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a… Critical Mon, 17 Oct 2022 18:25:09 GMT https://vulnogram.org/CVE-2022-32177 https://vulnogram.org/CVE-2022-32177 In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file,… Critical Fri, 14 Oct 2022 07:00:14 GMT https://vulnogram.org/CVE-2022-32174 https://vulnogram.org/CVE-2022-32174 In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover. Critical Tue, 11 Oct 2022 14:20:16 GMT https://vulnogram.org/CVE-2022-32175 https://vulnogram.org/CVE-2022-32175 In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modif… Medium Network Exploitable Tue, 11 Oct 2022 14:20:11 GMT https://vulnogram.org/CVE-2022-32171 https://vulnogram.org/CVE-2022-32171 In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be execut… Thu, 06 Oct 2022 17:14:15 GMT https://vulnogram.org/CVE-2022-32172 https://vulnogram.org/CVE-2022-32172 In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be exe… Thu, 06 Oct 2022 17:13:36 GMT https://vulnogram.org/CVE-2022-32173 https://vulnogram.org/CVE-2022-32173 In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. Mon, 03 Oct 2022 12:25:08 GMT https://vulnogram.org/CVE-2022-32169 https://vulnogram.org/CVE-2022-32169 The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”. Medium Wed, 28 Sep 2022 09:30:23 GMT https://vulnogram.org/CVE-2022-32170 https://vulnogram.org/CVE-2022-32170 The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”. Medium Wed, 28 Sep 2022 09:30:18 GMT https://vulnogram.org/CVE-2022-32166 https://vulnogram.org/CVE-2022-32166 In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory m… Medium Wed, 28 Sep 2022 09:30:12 GMT https://vulnogram.org/CVE-2022-32168 https://vulnogram.org/CVE-2022-32168 Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++. High Wed, 28 Sep 2022 09:00:15 GMT https://vulnogram.org/CVE-2022-32167 https://vulnogram.org/CVE-2022-32167 Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation. Medium Tue, 20 Sep 2022 14:45:19 GMT https://vulnogram.org/CVE-2022-32159 https://vulnogram.org/CVE-2022-32159 In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS. Wed, 22 Jun 2022 17:55:10 GMT https://vulnogram.org/CVE-2022-23081 https://vulnogram.org/CVE-2022-23081 In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS. Wed, 22 Jun 2022 17:20:12 GMT https://vulnogram.org/CVE-2022-23080 https://vulnogram.org/CVE-2022-23080 In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans. Wed, 22 Jun 2022 15:40:10 GMT https://vulnogram.org/CVE-2022-23079 https://vulnogram.org/CVE-2022-23079 In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim. Wed, 22 Jun 2022 13:05:10 GMT https://vulnogram.org/CVE-2022-23078 https://vulnogram.org/CVE-2022-23078 In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. Wed, 22 Jun 2022 12:00:17 GMT https://vulnogram.org/CVE-2022-23077 https://vulnogram.org/CVE-2022-23077 In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. Wed, 22 Jun 2022 11:30:16 GMT https://vulnogram.org/CVE-2022-23055 https://vulnogram.org/CVE-2022-23055 In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the… Wed, 22 Jun 2022 08:25:10 GMT https://vulnogram.org/CVE-2022-23058 https://vulnogram.org/CVE-2022-23058 ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover. Wed, 22 Jun 2022 07:30:21 GMT https://vulnogram.org/CVE-2022-23056 https://vulnogram.org/CVE-2022-23056 In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. Wed, 22 Jun 2022 07:25:16 GMT https://vulnogram.org/CVE-2022-23057 https://vulnogram.org/CVE-2022-23057 In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile. Wed, 22 Jun 2022 07:25:11 GMT https://vulnogram.org/CVE-2022-23074 https://vulnogram.org/CVE-2022-23074 In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privi… Tue, 21 Jun 2022 09:20:10 GMT https://vulnogram.org/CVE-2022-23073 https://vulnogram.org/CVE-2022-23073 In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parame… Tue, 21 Jun 2022 08:50:09 GMT https://vulnogram.org/CVE-2022-23072 https://vulnogram.org/CVE-2022-23072 In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter… Tue, 21 Jun 2022 08:10:11 GMT https://vulnogram.org/CVE-2022-23071 https://vulnogram.org/CVE-2022-23071 In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to acce… Sun, 19 Jun 2022 10:15:14 GMT https://vulnogram.org/CVE-2022-23082 https://vulnogram.org/CVE-2022-23082 In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal. High Network Exploitable Tue, 31 May 2022 14:40:10 GMT https://vulnogram.org/CVE-2022-23068 https://vulnogram.org/CVE-2022-23068 ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail. Medium Wed, 18 May 2022 11:45:15 GMT https://vulnogram.org/CVE-2022-23067 https://vulnogram.org/CVE-2022-23067 ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token… High Network Exploitable Wed, 18 May 2022 11:45:13 GMT https://vulnogram.org/CVE-2022-23066 https://vulnogram.org/CVE-2022-23066 In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the resu… Critical Network Exploitable Mon, 09 May 2022 06:25:09 GMT https://vulnogram.org/CVE-2022-23063 https://vulnogram.org/CVE-2022-23063 In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the pa… High Tue, 03 May 2022 08:55:09 GMT https://vulnogram.org/CVE-2022-23065 https://vulnogram.org/CVE-2022-23065 In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrat… Medium Mon, 02 May 2022 12:30:16 GMT https://vulnogram.org/CVE-2022-23064 https://vulnogram.org/CVE-2022-23064 In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker… High Network Exploitable Mon, 02 May 2022 12:30:14 GMT https://vulnogram.org/CVE-2022-23061 https://vulnogram.org/CVE-2022-23061 In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability. Medium Sun, 01 May 2022 12:40:12 GMT https://vulnogram.org/CVE-2022-23060 https://vulnogram.org/CVE-2022-23060 A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab Medium Sun, 01 May 2022 12:40:10 GMT https://vulnogram.org/CVE-2022-23059 https://vulnogram.org/CVE-2022-23059 A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code. Medium Tue, 29 Mar 2022 10:25:09 GMT https://vulnogram.org/CVE-2022-23054 https://vulnogram.org/CVE-2022-23054 Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 versi… Medium Network Exploitable Sun, 20 Feb 2022 19:00:17 GMT https://vulnogram.org/CVE-2022-23053 https://vulnogram.org/CVE-2022-23053 Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 ver… Medium Network Exploitable Sun, 20 Feb 2022 19:00:15 GMT https://vulnogram.org/CVE-2022-22126 https://vulnogram.org/CVE-2022-22126 Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and… Medium Network Exploitable Sun, 20 Feb 2022 19:00:14 GMT https://vulnogram.org/CVE-2021-25992 https://vulnogram.org/CVE-2021-25992 In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. Critical Network Exploitable Thu, 10 Feb 2022 09:55:09 GMT https://vulnogram.org/CVE-2021-25939 https://vulnogram.org/CVE-2021-25939 In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly… Low Wed, 09 Feb 2022 12:15:14 GMT https://vulnogram.org/CVE-2022-22125 https://vulnogram.org/CVE-2022-22125 In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. Medium Thu, 13 Jan 2022 16:45:17 GMT https://vulnogram.org/CVE-2022-22124 https://vulnogram.org/CVE-2022-22124 In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s brows… Medium Thu, 13 Jan 2022 16:45:16 GMT https://vulnogram.org/CVE-2022-22123 https://vulnogram.org/CVE-2022-22123 In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server. Medium Thu, 13 Jan 2022 16:45:14 GMT https://vulnogram.org/CVE-2022-22113 https://vulnogram.org/CVE-2022-22113 In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the applicatio… High Network Exploitable Thu, 13 Jan 2022 08:35:13 GMT https://vulnogram.org/CVE-2022-22112 https://vulnogram.org/CVE-2022-22112 In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript… Medium Thu, 13 Jan 2022 08:35:12 GMT https://vulnogram.org/CVE-2022-22115 https://vulnogram.org/CVE-2022-22115 In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in t… Critical Mon, 10 Jan 2022 15:26:56 GMT https://vulnogram.org/CVE-2022-22114 https://vulnogram.org/CVE-2022-22114 In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary s… Critical Network Exploitable Mon, 10 Jan 2022 15:26:54 GMT https://vulnogram.org/CVE-2022-22117 https://vulnogram.org/CVE-2022-22117 In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profil… Medium Mon, 10 Jan 2022 15:26:45 GMT https://vulnogram.org/CVE-2022-22116 https://vulnogram.org/CVE-2022-22116 In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be execut… Medium Mon, 10 Jan 2022 15:26:44 GMT