Jonah Burgess (CryptoCat)

wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

Apache OFBiz: Unauthenticated RCE via login-page widget injection

Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login

Apache OFBiz: Unauthenticated path-suffix view authorization bypass

Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact

Apache OFBiz: Content renderer runs a service name stored on the row

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter