Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/inserCheck if you run itEPSS 0.46%Nov 19, 2025
- High8.7eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryptionCheck if you run itEPSS 0.23%Nov 19, 2025
- Medium5.0An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to potentially gain unauthoriCheck if you run itEPSS 0.21%Nov 19, 2025
- High7.2i-Educar is free, fully online school management software.Check if you run itEPSS 0.34%Nov 19, 2025
- High7.2i-Educar is free, fully online school management software.Check if you run itEPSS 0.43%Nov 19, 2025
- High7.2i-Educar is free, fully online school management software.Check if you run itEPSS 0.43%Nov 19, 2025
- High8.6Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid DataCheck if you run itEPSS 0.32%Nov 19, 2025
- High8.6Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid DataCheck if you run itEPSS 0.32%Nov 19, 2025
- Medium4.8A security vulnerability has been detected in mrubyc up to 3.4.Check if you run itEPSS 0.16%Nov 19, 2025
- Medium5.3A weakness has been identified in code-projects Courier Management System 1.0.Check if you run itEPSS 0.35%Nov 19, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd.Check if you run itEPSS 0.18%Nov 19, 2025
- Medium4.7Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc.Check if you run itEPSS 0.22%Nov 19, 2025
- High8.6Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.Check if you run itEPSS 0.17%Nov 19, 2025
- Critical9.3Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.Check if you run itEPSS 0.36%Nov 19, 2025
- Critical9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc.Check if you run itEPSS 0.35%Nov 19, 2025
- Medium6.9A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8.Check if you run itEPSS 0.33%Nov 19, 2025
- Medium6.3Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters.Check this weekEPSS 11.55%Nov 19, 2025
- High7.1An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on theCheck if you run itEPSS 0.27%Nov 19, 2025
- Medium4.2A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FCheck if you run itEPSS 0.18%Nov 19, 2025
- High7.5Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.Check if you run itEPSS 0.74%Nov 19, 2025
- High7.3Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: frCheck if you run itEPSS 0.24%Nov 19, 2025
- High7.2givewp givewp Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.39%Nov 19, 2025
- High8.0The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1.Check if you run itEPSS 0.39%Nov 19, 2025
- High7.2The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting viaCheck if you run itEPSS 0.37%Nov 19, 2025
- High8.3Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network.Check if you run itEPSS 0.43%Nov 19, 2025
Sort