Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.4File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server.Check if you run itEPSS 0.58%Dec 18, 2025
- Critical9.3EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads thrCheck if you run itEPSS 6.39%Dec 18, 2025
- Medium5.1TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter.Check if you run itEPSS 0.24%Dec 18, 2025
- Medium5.1RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters.Check if you run itEPSS 0.25%Dec 18, 2025
- Medium5.1Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles.Check if you run itEPSS 0.25%Dec 18, 2025
- Medium5.3WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php.Check if you run itEPSS 0.21%Dec 18, 2025
- High8.7A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler.Check if you run itEPSS 0.43%Dec 18, 2025
- Medium5.1A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs.Check if you run itEPSS 0.20%Dec 18, 2025
- Medium6.9An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages.Check if you run itEPSS 0.31%Dec 18, 2025
- Medium5.1An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields.Check if you run itEPSS 0.20%Dec 18, 2025
- Medium6.9A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine.Check if you run itEPSS 0.21%Dec 18, 2025
- Medium6.9A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms.Check if you run itEPSS 0.24%Dec 18, 2025
- High8.7A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters.Check if you run itEPSS 0.30%Dec 18, 2025
- High8.6An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests.Check if you run itEPSS 0.34%Dec 18, 2025
- High8.7An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader comCheck if you run itEPSS 0.34%Dec 18, 2025
- Medium4.1Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login.Check if you run itEPSS 0.21%Dec 18, 2025
- High7.1MyHoard is a daemon for creating, managing and restoring MySQL backups.Check if you run itEPSS 0.16%Dec 18, 2025
- Medium5.3A flaw has been found in SourceCodester Client Database Management System 1.0.Check if you run itEPSS 0.35%Dec 18, 2025
- Medium5.3FreshRSS is a free, self-hostable RSS aggregator.Check if you run itEPSS 0.45%Dec 18, 2025
- Critical9.3WatchGuard Firebox Out of Bounds Write VulnerabilityPatch nowKEVEPSS 29.42%Dec 18, 2025
- Medium6.8Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and potentially arbitrary codeCheck if you run itEPSS 0.21%Dec 18, 2025
- Medium5.7Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527Check if you run itEPSS 0.41%Dec 18, 2025
- High7.1Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WACheck if you run itEPSS 0.94%Dec 18, 2025
- High8.6A vulnerability was detected in D-Link DIR-605 202WWB03.Check this weekEPSS 10.77%Dec 18, 2025
- Critical9.3A weakness has been identified in Tenda WH450 1.0.0.18.Check if you run itEPSS 6.66%Dec 18, 2025
Sort