Medium-severity CVEs (page 100)
Page 100 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8273 | Medium | 4.7 | 2026-05-11 | A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bi… |
CVE-2026-8272 | Medium | 4.7 | 2026-05-11 | A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.c… |
CVE-2026-8271 | Medium | 4.7 | 2026-05-11 | A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_d… |
CVE-2026-8270 | Medium | 4.3 | 2026-05-11 | A vulnerability was determined in Open5GS up to 2.7.7. The affected element is the function ogs_nas_parse_qos_rules of the component SMF. Executing a manipulat… |
CVE-2026-8269 | Medium | 4.3 | 2026-05-11 | A vulnerability was found in Open5GS up to 2.7.7. Impacted is the function smf_nsmf_handle_create_sm_context of the component SMF. Performing a manipulation re… |
CVE-2026-8268 | Medium | 4.3 | 2026-05-11 | A vulnerability has been found in Open5GS up to 2.7.7. This issue affects the function OpenAPI_list_create of the component SMF. Such manipulation leads to den… |
CVE-2026-8267 | Medium | 4.3 | 2026-05-11 | A flaw has been found in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_created_data_in_vsmf of the component SMF. This manipulat… |
CVE-2026-8266 | Medium | 4.3 | 2026-05-11 | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function gsm_build_pdu_session_establishment_accept of the file /src/smf/gsm-build.c of t… |
CVE-2026-8265 | Medium | 4.7 | 2026-05-11 | A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function get_log_file of the file /goform/getLogFile of the… |
CVE-2026-8264 | Medium | 6.3 | 2026-05-11 | A weakness has been identified in Tenda AC6 15.03.06.23. Affected by this vulnerability is the function formWifiApScan of the file /goform/WifiApScan of the co… |
CVE-2026-8263 | Medium | 4.7 | 2026-05-11 | A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of th… |
CVE-2026-8261 | Medium | 5.9 | 2026-05-11 | A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation caus… |
CVE-2026-8259 | Medium | 4.7 | 2026-05-11 | A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The… |
CVE-2026-8258 | Medium | 5.3 | 2026-05-11 | A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lea… |
CVE-2026-8252 | Medium | 4.3 | 2026-05-11 | A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function smf_nsmf_handle_create_data_in_hsmf of the component SMF. Executing a manipulat… |
CVE-2026-8251 | Medium | 4.3 | 2026-05-10 | A vulnerability was found in Open5GS up to 2.7.7. This impacts the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of the compo… |
CVE-2026-8250 | Medium | 4.3 | 2026-05-10 | A vulnerability has been found in Open5GS up to 2.7.7. This affects the function smf_n4_build_qos_flow_to_modify_list of the file /src/smf/n4-build.c of the co… |
CVE-2026-8249 | Medium | 4.3 | 2026-05-10 | A flaw has been found in Open5GS up to 2.7.7. The impacted element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of th… |
CVE-2026-8248 | Medium | 4.3 | 2026-05-10 | A vulnerability was detected in Open5GS up to 2.7.7. The affected element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler… |
CVE-2026-45191 | Medium | 6.5 | 2026-05-10 | Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask f… |
CVE-2026-45190 | Medium | 6.5 | 2026-05-10 | Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a t… |
CVE-2026-45179 | Medium | 5.3 | 2026-05-10 | Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for exa… |
CVE-2022-50970 | Medium | 5.4 | 2026-05-10 | WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulat… |
CVE-2022-50969 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and cr… |
CVE-2022-50968 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50967 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. The date_created, date_from, date_to, and created_at pa… |
CVE-2022-50966 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at param… |
CVE-2022-50965 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the posts/manage module. The date_created, date_from, date_to, and created_at para… |
CVE-2022-50964 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. The date_created, date_from, date_to… |
CVE-2022-50963 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. The date_created, date_from, date_to… |
CVE-2022-50962 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the orders/myOrders module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50961 | Medium | 6.4 | 2026-05-10 | WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary Ja… |
CVE-2022-50960 | Medium | 6.1 | 2026-05-10 | WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the adm… |
CVE-2022-50959 | Medium | 6.1 | 2026-05-10 | WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50958 | Medium | 6.1 | 2026-05-10 | WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manip… |
CVE-2022-50957 | Medium | 6.1 | 2026-05-10 | Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50956 | Medium | 6.2 | 2026-05-10 | WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploit… |
CVE-2022-50955 | Medium | 4.3 | 2026-05-10 | WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by cra… |
CVE-2022-50954 | Medium | 6.2 | 2026-05-10 | WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manip… |
CVE-2022-50949 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by… |
CVE-2022-50948 | Medium | 6.4 | 2026-05-10 | Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by subm… |
CVE-2022-50947 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicio… |
CVE-2022-50946 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious script… |
CVE-2022-50945 | Medium | 6.4 | 2026-05-10 | WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious Jav… |
CVE-2022-50943 | Medium | 6.1 | 2026-05-10 | Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through t… |
CVE-2021-47953 | Medium | 4.3 | 2026-05-10 | OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/… |
CVE-2021-47951 | Medium | 6.4 | 2026-05-10 | WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through th… |
CVE-2021-47950 | Medium | 6.4 | 2026-05-10 | Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers t… |
CVE-2021-47948 | Medium | 5.4 | 2026-05-10 | WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Hel… |
CVE-2021-47947 | Medium | 6.4 | 2026-05-10 | Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted in… |
CVE-2021-47946 | Medium | 5.3 | 2026-05-10 | OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim accou… |
CVE-2021-47931 | Medium | 6.4 | 2026-05-10 | Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Tex… |
CVE-2021-47929 | Medium | 6.4 | 2026-05-10 | Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by ent… |
CVE-2021-47927 | Medium | 6.4 | 2026-05-10 | WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts… |
CVE-2021-47926 | Medium | 6.4 | 2026-05-10 | Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating f… |
CVE-2021-47925 | Medium | 6.4 | 2026-05-10 | CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via craf… |
CVE-2021-47924 | Medium | 6.4 | 2026-05-10 | Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through t… |
CVE-2021-47922 | Medium | 6.4 | 2026-05-10 | Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the titl… |
CVE-2021-47910 | Medium | 6.4 | 2026-05-10 | AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering… |
CVE-2021-47907 | Medium | 6.4 | 2026-05-10 | Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script… |
CVE-2026-8244 | Medium | 5.3 | 2026-05-10 | A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This impacts an unknown function of the component Login RMI Interface. T… |
CVE-2026-8243 | Medium | 5.3 | 2026-05-10 | A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNLP Deployment Endpoi… |
CVE-2026-8241 | Medium | 5.3 | 2026-05-10 | A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the compon… |
CVE-2026-8235 | Medium | 5.5 | 2026-05-10 | A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component… |
CVE-2026-8233 | Medium | 4.6 | 2026-05-10 | A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improp… |
CVE-2026-8231 | Medium | 6.3 | 2026-05-10 | A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulatio… |
CVE-2026-8230 | Medium | 6.3 | 2026-05-10 | A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of th… |
CVE-2026-8229 | Medium | 6.3 | 2026-05-10 | A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipula… |
CVE-2026-8228 | Medium | 6.3 | 2026-05-10 | A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of… |
CVE-2026-8227 | Medium | 6.3 | 2026-05-10 | A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os c… |
CVE-2026-8226 | Medium | 5.3 | 2026-05-10 | A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pcc_rule_install_flow_from_media in the library /lib/pr… |
CVE-2026-8225 | Medium | 5.3 | 2026-05-10 | A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the comp… |
CVE-2026-7259 | Medium | 6.5 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl… |
CVE-2026-6735 | Medium | 6.1 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attack… |
CVE-2026-8224 | Medium | 5.3 | 2026-05-10 | A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/context.c of the com… |
CVE-2026-8223 | Medium | 5.3 | 2026-05-10 | A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies En… |
CVE-2026-8222 | Medium | 5.3 | 2026-05-10 | A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the c… |
CVE-2026-8217 | Medium | 6.3 | 2026-05-10 | A security flaw has been discovered in Industrial Application Software IAS Canias ERP 8.03. Impacted is the function Runtime.getRuntime.exec of the component R… |
CVE-2026-8215 | Medium | 5.3 | 2026-05-10 | A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This vulnerability affects the function iasRequestFileEvent of the compo… |
CVE-2026-8214 | Medium | 5.3 | 2026-05-10 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. This affects the function doAction of the component RMI Interface. The manipu… |
CVE-2026-8213 | Medium | 5.3 | 2026-05-09 | A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of th… |
CVE-2026-8212 | Medium | 5.3 | 2026-05-09 | A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Execu… |
CVE-2026-8211 | Medium | 4.7 | 2026-05-09 | A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/Ad… |
CVE-2026-45184 | Medium | 6.5 | 2026-05-09 | Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used. |
CVE-2026-45181 | Medium | 6.5 | 2026-05-09 | Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code… |
CVE-2026-8210 | Medium | 5.3 | 2026-05-09 | A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the… |
CVE-2026-8195 | Medium | 4.3 | 2026-05-09 | A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/ja… |
CVE-2026-8194 | Medium | 4.3 | 2026-05-09 | A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component… |
CVE-2026-42576 | Medium | 6.5 | 2026-05-09 | apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unco… |
CVE-2026-42258 | Medium | 5.3 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to com… |
CVE-2026-42256 | Medium | 6.5 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0… |
CVE-2026-8193 | Medium | 6.3 | 2026-05-09 | A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rende… |
CVE-2026-8192 | Medium | 6.3 | 2026-05-09 | A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a… |
CVE-2026-8191 | Medium | 6.3 | 2026-05-09 | A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the a… |
CVE-2026-8190 | Medium | 6.3 | 2026-05-09 | A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of… |
CVE-2026-8189 | Medium | 6.3 | 2026-05-09 | A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipu… |
CVE-2026-8188 | Medium | 6.3 | 2026-05-09 | A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation o… |
CVE-2026-8198 | Medium | 5.3 | 2026-05-09 | The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Dis… |
CVE-2026-8186 | Medium | 5.3 | 2026-05-09 | A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c of the compo… |
CVE-2026-8187 | Medium | 5.3 | 2026-05-09 | A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c of the component UPF. Executing a manip… |