Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.0The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions uCheck if you run itEPSS 0.29%Oct 23, 2025
- Medium5.3The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6.Check if you run itEPSS 0.29%Oct 23, 2025
- Critical9.8Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ACheck if you run itEPSS 0.57%Oct 23, 2025
- None0.0This is a duplicate.Check if you run itEPSS 0.00%Oct 23, 2025
- Medium5.4An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium4.3A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative dCheck if you run itEPSS 0.25%Oct 23, 2025
- Medium4.3Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups.Check if you run itEPSS 0.27%Oct 23, 2025
- High7.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.Check if you run itEPSS 0.40%Oct 23, 2025
- Medium5.4A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.Check if you run itEPSS 0.25%Oct 23, 2025
- Medium5.3The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.Check if you run itEPSS 0.28%Oct 23, 2025
- Medium5.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.Check if you run itEPSS 0.30%Oct 23, 2025
- Medium4.3Moodle failed to verify enrolment status correctly when sending quiz notifications.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.3A flaw was found in the course overview output function where user access permissions were not fully enforced.Check if you run itEPSS 0.24%Oct 23, 2025
- Medium5.1Open redirection vulnerability in MOLGENIS EMX2 v11.14.0.Check if you run itEPSS 0.30%Oct 23, 2025
- High7.1Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total.Check if you run itEPSS 0.38%Oct 23, 2025
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POCheck if you run itEPSS 0.21%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form).Check if you run itEPSS 0.19%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form).Check if you run itEPSS 0.19%Oct 23, 2025
- High7.5A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications.Check if you run itEPSS 0.46%Oct 23, 2025
- High7.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd.Check if you run itEPSS 0.26%Oct 23, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc.Check if you run itEPSS 0.22%Oct 23, 2025
- High8.4Multiple NAS management applications provided by I-O DATA DEVICE, INC.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium5.1GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.Check if you run itEPSS 0.23%Oct 23, 2025
Sort