Vulnerabilidades

Una lectura fuera de límites en Microsoft Office Excel permite a un atacante no autorizado divulgar información localmente.

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact…

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this…

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this…

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this…

Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.

SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact…

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that…

Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity…

ALEAPP (Analizador de Eventos y Registros de Android y Protobuf) hasta la versión 3.4.0 contiene una vulnerabilidad de salto de ruta en el analizador de artefactos NQ_Vault.py que utiliza valores file_name_from controlados por el atacante de una base de datos directamente como nombre de archivo de salida, permitiendo…

Frappe Learning Management System (LMS) es un sistema de aprendizaje que ayuda a los usuarios a estructurar su contenido. Antes de la versión 2.46.0, se ha identificado una vulnerabilidad en Frappe Learning donde las puntuaciones de los cuestionarios pueden ser modificadas por los estudiantes antes de la entrega. La…

Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) existe en la funcionalidad de Formato de Impresión de ERPNext v16.0.1 y Frappe Framework v16.1.1, donde el HTML proporcionado por el usuario no se sanea suficientemente antes de ser renderizado a PDF. Al generar PDFs a partir de contenido…

Vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') en Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat permite XSS basado en DOM. Este problema afecta a Elfsight WhatsApp Chat CC: desde n/a hasta <= 1.2.0.

Vulnerabilidad por falta de autorización en NSquared Simply Schedule Appointments simply-schedule-appointments permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Simply Schedule Appointments: desde n/a hasta <= 1.6.10.2.

Vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en Brecht Visual Link Preview visual-link-preview permite la falsificación de petición del lado del servidor. Este problema afecta a Visual Link Preview: desde n/a hasta <= 2.3.0.

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en priyanshumittal Appointment appointment permite subir un shell web a un servidor web. Este problema afecta a Appointment: desde n/a hasta <= 3.5.5.