ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.

The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands.

An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts.

A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors.

A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student.

A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.

Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.

AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php.

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.

An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files.

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable.

iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.