Use After Free in GitHub repository vim/vim prior to 9.0.0322.

Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img.

The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the “auth_user” parameter in index.php script.

Cross-site Scripting (XSS) – Stored in GitHub repository snipe/snipe-it prior to v6.0.11.

siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).