Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.Check if you run itEPSS 0.48%Nov 18, 2025
- High8.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code executioCheck if you run itEPSS 0.77%Nov 18, 2025
- Critical9.3Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning thatCheck if you run itEPSS 0.34%Nov 18, 2025
- Medium6.4The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufCheck if you run itEPSS 0.24%Nov 18, 2025
- Medium5.3The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout() function in aCheck if you run itEPSS 0.29%Nov 18, 2025
- Medium6.4The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versioCheck if you run itEPSS 0.20%Nov 18, 2025
- Medium4.3The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2.Check if you run itEPSS 0.27%Nov 18, 2025
- Medium5.3The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_optin_opCheck if you run itEPSS 0.29%Nov 18, 2025
- Medium4.3The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7.Check if you run itEPSS 0.25%Nov 18, 2025
- Medium6.4The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficientCheck if you run itEPSS 0.20%Nov 18, 2025
- Medium6.6The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function.Check if you run itEPSS 0.29%Nov 18, 2025
- High8.8The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3.Check if you run itEPSS 0.69%Nov 18, 2025
- Medium6.1The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient inpCheck if you run itEPSS 0.27%Nov 18, 2025
- Medium5.4The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions upCheck if you run itEPSS 0.18%Nov 18, 2025
- High7.5The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39.Check if you run itEPSS 0.34%Nov 18, 2025
- High7.2The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insuCheck if you run itEPSS 0.24%Nov 18, 2025
- Medium5.4The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to missing authorizationCheck if you run itEPSS 0.24%Nov 18, 2025
- Critical9.1A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.Check if you run itEPSS 1.13%Nov 18, 2025
- Critical9.1A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code.Check if you run itEPSS 0.76%Nov 18, 2025
- Critical9.1A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code.Check if you run itEPSS 0.97%Nov 18, 2025
- Medium6.4The everviz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attributes in versions up to, and including, 1.1.Check if you run itEPSS 0.20%Nov 18, 2025
- Medium4.3The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versCheck if you run itEPSS 0.24%Nov 18, 2025
- Medium6.1The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.16%Nov 18, 2025
- Medium6.1The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufCheck if you run itEPSS 0.22%Nov 18, 2025
- High8.8The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.Check if you run itEPSS 0.36%Nov 18, 2025
Sort