The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other’s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack.

Cross-site Scripting (XSS) – Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.

Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.