FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.