Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
PHP
XSS
Syndeocms
NVD
Exploit-DB
CVSS 2.0
3.5
EPSS
0.9%
RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\users\, which allows local users to obtain sensitive information by reading a database. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
Helix Server
Helix Mobile Server
NVD
CVSS 2.0
2.1
EPSS
0.2%