TML

Latest CVEs · RSS

• CVE-2026-15928 2026-07-27 · CVSS 8.2
  XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
• CVE-2026-57871 2026-07-07 · CVSS 7.1
  Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects M
• CVE-2026-57870 2026-07-07 · CVSS 5.3
  Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without au
• CVE-2026-57869 2026-07-07 · CVSS 7.1
  Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents u
• CVE-2026-57868 2026-07-07 · CVSS 7.1
  MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.
• CVE-2026-57867 2026-07-07 · CVSS 8.8
  MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate dep
• CVE-2025-5591 2026-01-05 · CVSS 7.7
  Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perf
• CVE-2024-12223 2025-08-20 · CVSS 9.3
  Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victi
• CVE-2025-2394 2025-05-23 · CVSS 4.7
  Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadin
• CVE-2024-28097 2024-03-07 · CVSS 7.3
  Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform
• CVE-2024-28096 2024-03-07 · CVSS 7.3
  Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform sec
• CVE-2024-28095 2024-03-07 · CVSS 7.3
  News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform secu
• CVE-2024-28094 2024-03-07 · CVSS 8.8
  Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, a
• CVE-2023-6451 2024-02-16 · CVSS 8.6
  Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the
• CVE-2023-4393 2023-10-29 · CVSS 5.4
  HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against
• CVE-2023-1356 2023-10-25 · CVSS 7.5
  Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session
• CVE-2023-27262 2023-10-25 · CVSS 9.8
  Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al
• CVE-2023-27260 2023-10-25 · CVSS 9.8
  Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al
• CVE-2023-27261 2023-10-25 · CVSS 5.3
  Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated at
• CVE-2023-27377 2023-10-25 · CVSS 7.5
  Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of
• CVE-2023-27376 2023-10-25 · CVSS 7.5
  Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive
• CVE-2023-27375 2023-10-25 · CVSS 7.5
  Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive
• CVE-2023-27259 2023-10-25 · CVSS 7.5
  Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teach
• CVE-2023-27258 2023-10-25 · CVSS 7.5
  Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher dat
• CVE-2023-27257 2023-10-25 · CVSS 7.5
  Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by una