Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8.Check if you run itEPSS 0.11%Dec 31, 2025
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual ComCheck if you run itEPSS 0.25%Dec 31, 2025
- Medium6.5Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WoCheck if you run itEPSS 0.35%Dec 31, 2025
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL InjectioCheck if you run itEPSS 0.24%Dec 31, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse en-masse-wp allows Reflected XSS.This issue affects En Masse:Check if you run itEPSS 0.18%Dec 31, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-project-gallery allowCheck if you run itEPSS 0.18%Dec 31, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill custom-post-edit front-end-post-edit allows Reflected XSCheck if you run itEPSS 0.18%Dec 31, 2025
- Medium5.4Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoCheck if you run itEPSS 0.20%Dec 31, 2025
- Medium5.4Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WorkCheck if you run itEPSS 0.20%Dec 31, 2025
- Medium5.4Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LoCheck if you run itEPSS 0.20%Dec 31, 2025
- Medium5.4Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affeCheck if you run itEPSS 0.20%Dec 31, 2025
- Medium5.1A vulnerability was detected in iCMS up to 8.0.0.Check if you run itEPSS 0.48%Dec 31, 2025
- Medium5.1COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and 'CMX_COMPLEX_NM'.Check if you run itEPSS 0.28%Dec 31, 2025
- Medium6.9KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration.Check if you run itEPSS 0.42%Dec 31, 2025
- Medium4.8STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code.Check if you run itEPSS 0.22%Dec 31, 2025
- Medium5.3ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resourceCheck if you run itEPSS 0.22%Dec 31, 2025
- High8.6meterN 1.2.3 contains an authenticated remote code execution vulnerability in admin_meter2.php and admin_indicator2.php scripts.Check if you run itEPSS 0.71%Dec 31, 2025
- High8.6Cypress Solutions CTM-200 2.7.1 contains an authenticated command injection vulnerability in the firmware upgrade script that allows remote attackers to execute shell commands.Check if you run itEPSS 1.33%Dec 31, 2025
- Critical9.3Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access.Check if you run itEPSS 0.33%Dec 31, 2025
- High8.5Epic Games Psyonix Rocket League <=1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full access permissions.Check if you run itEPSS 0.24%Dec 31, 2025
- High8.7ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative users to elevate access by sending requests to configurationCheck if you run itEPSS 0.29%Dec 31, 2025
- High8.7NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to access administrative credentials through the configuration backCheck if you run itEPSS 0.30%Dec 31, 2025
- Critical9.3Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH confCheck if you run itEPSS 0.48%Dec 31, 2025
- High8.5Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevatedCheck if you run itEPSS 0.15%Dec 31, 2025
- High8.2libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied inCheck if you run itEPSS 0.75%Dec 31, 2025
Sort