Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8File access paths in configuration files uploaded by users with administrator access are not validated.Check if you run itEPSS 1.07%Jul 21, 2025
- High7.5Users with administrator access can create databases files outside the files area of the Fuseki server.Check if you run itEPSS 1.56%Jul 21, 2025
- Medium6.4The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgeCheck if you run itEPSS 0.26%Jul 21, 2025
- Medium6.7A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library.Check if you run itEPSS 0.20%Jul 21, 2025
- Medium6.1WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScriptCheck if you run itEPSS 0.34%Jul 21, 2025
- High8.7The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a spCheck if you run itEPSS 0.61%Jul 21, 2025
- Critical9.3The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contCheck if you run itEPSS 0.70%Jul 21, 2025
- Critical9.3Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and potenCheck if you run itEPSS 0.95%Jul 21, 2025
- Medium4.6Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to accCheck if you run itEPSS 0.23%Jul 21, 2025
- Medium4.6Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini configCheck if you run itEPSS 0.36%Jul 21, 2025
- Medium5.1An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini componentsCheck if you run itEPSS 0.27%Jul 21, 2025
- High7.5Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameCheck if you run itEPSS 0.51%Jul 21, 2025
- High7.5Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversatiCheck if you run itEPSS 0.51%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting aCheck if you run itEPSS 0.97%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injectingCheck if you run itEPSS 0.97%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injectinCheck if you run itEPSS 0.97%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crCheck if you run itEPSS 1.00%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the TelegCheck if you run itEPSS 1.02%Jul 21, 2025
- Unknownakamai cloudtest Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 2.14%Jul 21, 2025
- UnknownImproper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 47.46%Jul 21, 2025
- Critical9.8An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions and pass a client hostname directly to snprintf as the formatCheck if you run itEPSS 1.33%Jul 21, 2025
- Medium5.3An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials forCheck if you run itEPSS 0.55%Jul 21, 2025
- High8.8An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attackerCheck if you run itEPSS 0.54%Jul 21, 2025
- Critical9.8In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions.Check if you run itEPSS 1.17%Jul 21, 2025
- Critical9.8In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file.Check if you run itEPSS 1.20%Jul 21, 2025
Sort