SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.

SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.

SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-musictemplatesfront-end.php (war_soundy_preview parameter).

The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlisttemplatesfront-end.php (war_sdy_pl_preview parameter).