Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation.Check if you run itEPSS 0.24%Dec 17, 2025
- Medium5.1Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to inject malicious scripts.Check if you run itEPSS 2.75%Dec 17, 2025
- High7.1ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parametCheck if you run itEPSS 0.38%Dec 17, 2025
- Medium6.2phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names.Check if you run itEPSS 0.54%Dec 17, 2025
- Medium5.1PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded JavaScript.Check if you run itEPSS 0.26%Dec 17, 2025
- Medium5.1PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section name parameters.Check if you run itEPSS 0.28%Dec 17, 2025
- High8.7PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries.Check if you run itEPSS 0.61%Dec 17, 2025
- Medium5.1UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript.Check if you run itEPSS 0.37%Dec 17, 2025
- High8.7UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar uploCheck if you run itEPSS 0.94%Dec 17, 2025
- Critical9.3UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint.Check if you run itEPSS 0.55%Dec 17, 2025
- Critical9.3TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files.Check if you run itEPSS 1.11%Dec 17, 2025
- High8.7SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory.Check if you run itEPSS 0.96%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcast_details.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (theme_freebox.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episodes_upload.php).Check if you run itEPSS 0.34%Dec 17, 2025
- Medium5.1Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface.Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content into album descriptions.Check if you run itEPSS 0.31%Dec 17, 2025
- Critical9.3UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController.Check if you run itEPSS 0.69%Dec 17, 2025
- Medium6.2Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field.Check if you run itEPSS 0.73%Dec 17, 2025
- High8.5USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.14%Dec 17, 2025
- Medium5.1Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scripts.Check if you run itEPSS 0.31%Dec 17, 2025
- Medium5.1WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content thCheck if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the meCheck if you run itEPSS 0.33%Dec 17, 2025
- High8.7HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration.Check if you run itEPSS 0.34%Dec 17, 2025
- Medium5.1projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuratiCheck if you run itEPSS 0.31%Dec 17, 2025
Sort