آخرین آسیب‌پذیری‌ها

InvoicePlane: Guest user IDOR in quote approval and rejection

Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

AVideo-Encoder: pre-authentication streamer-login SQL injection

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

AVideo-Encoder: missing authentication on control and status endpoints

The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo-Encoder: reflected cross-site scripting in the login interface

a2ui Image Player/Video Player/Audio Player Image.js input validation

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo-Encoder: unauthenticated installer PHP code injection

Blombooru: administrator image-proxy server-side request forgery

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

Bricks Broken Access Control via query_result Endpoint

Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing