Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2025-30366

WeGIA vulnerable to Stored XSS in personalizacao.php

WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Wegia
Products
Wegia
CVE-2024-47181

Unaligned memory access in RPL option processing in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of the Contiki-NG operating system. The problem can occur when either one of these RPL implementations is enabled and connected to an RPL instance. If an IPv6 packet containing an odd number of padded bytes before the RPL option, it can cause the rpl_ext_header_hbh_update function to read a 16-bit integer from an odd address. The impact of this unaligned read is architecture-dependent, but can potentially cause the system to crash. The problem has not been patched as of release 4.9, but will be included in the next release. One can apply the changes in Contiki-NG pull request #2962 to patch the system or wait for the next release.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Contiki-ng
Products
Contiki-ng
CVE-2024-54148

Gogs has a Path Traversal in file editing UI

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Gogs
Products
Gogs
CVE-2024-55947

Gogs has a Path Traversal in file update API

Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

CVSS 4.0 · 8.7 High EPSS 77.7% KEV · Not listed
Vendors
Gogs
Products
Gogs
CVE-2024-8444

Download Manager < 3.3.00 - Contributor+ Stored XSS

The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
W3eden
Products
Download Manager
CVE-2023-40496

LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability

LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyStickerContent command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-19923.

CVSS 3.1 · 7.5 High EPSS 74.0% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40497

LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability

LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the saveXml command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19924.

CVSS 3.1 · 9.8 Critical EPSS 67.2% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40498

LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability

LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the cp command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19925.

CVSS 3.1 · 9.8 Critical EPSS 85.1% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40499

LG Simple Editor mkdir Directory Traversal Arbitrary File Deletion Vulnerability

LG Simple Editor mkdir Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mkdir command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19926.

CVSS 3.1 · 9.1 Critical EPSS 2.0% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40500

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19944.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40501

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19945.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40502

LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability

LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cropImage command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19951.

CVSS 3.1 · 9.1 Critical EPSS 82.0% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40503

LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability

LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the saveXmlFile method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-19952.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40504

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19953.

CVSS 3.1 · 9.8 Critical EPSS 88.7% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40505

LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability

LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createThumbnailByMovie method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19978.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40506

LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability

LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-20005.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40507

LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability

LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-20006.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2025-30367

WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.2.6 contains a fix for the issue.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wegia
Products
Wegia
CVE-2023-40508

LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability

LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the putCanvasDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-20010.

CVSS 3.1 · 9.1 Critical EPSS 2.0% KEV · Not listed
Vendors
Lg
Products
Simple Editor
CVE-2023-40509

LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability

LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deleteCanvas method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-20011.

CVSS 3.1 · 9.1 Critical EPSS 2.0% KEV · Not listed
Vendors
Lg
Products
Simple Editor