Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint.Check if you run itEPSS 0.55%Dec 17, 2025
- Critical9.3TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files.Check if you run itEPSS 1.11%Dec 17, 2025
- High8.7SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory.Check if you run itEPSS 0.96%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcast_details.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (theme_freebox.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episodes_upload.php).Check if you run itEPSS 0.34%Dec 17, 2025
- Medium5.1Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface.Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content into album descriptions.Check if you run itEPSS 0.31%Dec 17, 2025
- Critical9.3UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController.Check if you run itEPSS 0.69%Dec 17, 2025
- Medium6.2Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field.Check if you run itEPSS 0.73%Dec 17, 2025
- High8.5USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.14%Dec 17, 2025
- Medium5.1Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scripts.Check if you run itEPSS 0.31%Dec 17, 2025
- Medium5.1WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content thCheck if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the meCheck if you run itEPSS 0.33%Dec 17, 2025
- High8.7HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration.Check if you run itEPSS 0.34%Dec 17, 2025
- Medium5.1projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuratiCheck if you run itEPSS 0.31%Dec 17, 2025
- Medium6.2ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names.Check if you run itEPSS 0.50%Dec 17, 2025
- Medium5.1Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameterCheck if you run itEPSS 0.27%Dec 17, 2025
- High7.6Open OnDemand provides remote web access to supercomputers.Check if you run itEPSS 0.20%Dec 17, 2025
- Medium6.9A security flaw has been discovered in code-projects Online Appointment Booking System 1.0.Check if you run itEPSS 0.36%Dec 17, 2025
- High7.3Storybook is a frontend workshop for building user interface components and pages in isolation.Check if you run itEPSS 0.26%Dec 17, 2025
- High8.8Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.Check if you run itEPSS 0.28%Dec 17, 2025
- High8.1Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.Check if you run itEPSS 0.38%Dec 17, 2025
- High7.2RoundCube Webmail Cross-site Scripting VulnerabilityPatch nowKEVEPSS 27.41%Dec 17, 2025
- Medium6.4In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate thatCheck if you run itEPSS 7.03%Dec 17, 2025
Sort