Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface.Check this weekEPSS 13.64%Aug 6, 2025
- Medium6.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.Check if you run itEPSS 0.25%Aug 6, 2025
- Medium6.5A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend templCheck if you run itEPSS 0.47%Aug 6, 2025
- Medium6.0FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF.Check if you run itEPSS 0.31%Aug 5, 2025
- Critical10.0The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php.Check if you run itEPSS 1.72%Aug 5, 2025
- Critical10.0The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php.Check if you run itEPSS 1.84%Aug 5, 2025
- Critical10.0PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization.Check if you run itEPSS 2.10%Aug 5, 2025
- Critical9.3Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow.Check if you run itEPSS 1.71%Aug 5, 2025
- Critical10.0An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3.Check if you run itEPSS 1.67%Aug 5, 2025
- Critical9.4Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability.Check if you run itEPSS 1.49%Aug 5, 2025
- Critical10.0The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in commanCheck this weekEPSS 16.72%Aug 5, 2025
- Critical9.3An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.Check if you run itEPSS 1.46%Aug 5, 2025
- Medium4.8A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10.Check if you run itEPSS 0.32%Aug 5, 2025
- Medium4.8A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10.Check if you run itEPSS 0.30%Aug 5, 2025
- Medium4.8A vulnerability was found in Portabilis i-Educar 2.10.Check if you run itEPSS 0.30%Aug 5, 2025
- Medium4.8A vulnerability was found in Portabilis i-Educar 2.10.Check if you run itEPSS 0.30%Aug 5, 2025
- Medium4.8A vulnerability was found in Portabilis i-Educar 2.10.Check if you run itEPSS 0.30%Aug 5, 2025
- Medium4.8A weakness has been identified in Portabilis i-Educar 2.10.Check if you run itEPSS 0.31%Aug 5, 2025
- Medium4.5EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.Check if you run itEPSS 0.25%Aug 5, 2025
- High7.7The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI.Check if you run itEPSS 0.28%Aug 5, 2025
- Critical9.8An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php componentCheck if you run itEPSS 1.03%Aug 5, 2025
- Critical9.8An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck functionCheck if you run itEPSS 1.03%Aug 5, 2025
- Low2.3A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4.Check if you run itEPSS 0.35%Aug 4, 2025
- Medium4.8A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5.Check if you run itEPSS 0.30%Aug 4, 2025
- Critical9.3An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability inCheck if you run itEPSS 1.85%Aug 4, 2025