Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions up to, a…Check if you run itEPSS 0.24%Mar 4, 2026
- Medium5.1A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satelli…Check if you run itEPSS 0.32%Mar 4, 2026
- Medium5.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Re…Check if you run itEPSS 0.32%Mar 4, 2026
- Medium4.8In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block.Check if you run itEPSS 0.28%Mar 4, 2026
- Medium4.8In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block.Check if you run itEPSS 0.28%Mar 4, 2026
- Medium4.8In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via…Check if you run itEPSS 0.28%Mar 4, 2026
- Medium4.8In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without pro…Check if you run itEPSS 0.28%Mar 4, 2026
- Medium4.4The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insuffic…Check if you run itEPSS 0.25%Mar 4, 2026
- Medium4.4The Taskbuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.0.3 due to insufficient in…Check if you run itEPSS 0.26%Mar 4, 2026
- High7.2The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and inclu…Check if you run itEPSS 0.33%Mar 4, 2026
- Medium5.4HomeBox is a home inventory and organization system.Check if you run itEPSS 0.25%Mar 3, 2026
- Medium6.1AliasVault is a privacy-first password manager with built-in email aliasing.Check if you run itEPSS 0.38%Mar 3, 2026
- Medium6.1The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents.Check if you run itEPSS 0.28%Mar 3, 2026
- Medium5.1OpenSTAManager is an open source management software for technical assistance and invoicing.Check if you run itEPSS 0.26%Mar 3, 2026
- Medium5.1Dify is an open-source LLM app development platform.Check if you run itEPSS 0.23%Mar 3, 2026
- Medium5.3DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute…Check if you run itEPSS 0.35%Mar 3, 2026
- Medium5.1DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting…Check if you run itEPSS 0.25%Mar 3, 2026
- Medium4.1The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui…Check if you run itEPSS 0.23%Mar 3, 2026
- Medium5.1A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management…Check if you run itEPSS 0.34%Mar 3, 2026
- High7.2The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission…Check if you run itEPSS 0.33%Mar 3, 2026
- Low2.0Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in…Check if you run itEPSS 0.43%Mar 3, 2026
- Medium6.4The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the metadata fields in all versions up to, and including, 2.1.30 due to insufficient i…Check if you run itEPSS 0.27%Mar 2, 2026
- Medium5.3NocoDB is software for building databases as spreadsheets.Check if you run itEPSS 0.25%Mar 2, 2026
- Medium5.3NocoDB is software for building databases as spreadsheets.Check if you run itEPSS 0.25%Mar 2, 2026
- Medium5.3NocoDB is software for building databases as spreadsheets.Check if you run itEPSS 0.25%Mar 2, 2026