Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficientCheck if you run itEPSS 0.21%Sep 30, 2025
- Medium6.4Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and tCheck if you run itEPSS 0.13%Sep 30, 2025
- Medium6.5An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrary SQL queries via theCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium5.4TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.Check if you run itEPSS 0.33%Sep 30, 2025
- Low3.5The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and passwordCheck if you run itEPSS 0.20%Sep 30, 2025
- High7.5An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.Check if you run itEPSS 0.53%Sep 30, 2025
- High7.5Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter.Check if you run itEPSS 0.43%Sep 30, 2025
- Medium5.3dify dify Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.70%Sep 30, 2025
- Critical9.8NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.Check if you run itEPSS 0.45%Sep 30, 2025
- High8.1An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operatiCheck if you run itEPSS 0.34%Sep 30, 2025
- High7.5An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowing attackers to corrupt exception handling and privilege staCheck if you run itEPSS 0.64%Sep 30, 2025
- Medium6.5A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows usersCheck if you run itEPSS 0.33%Sep 30, 2025
- Medium6.1A URL validation bypass vulnerability exists in validator.js through version 13.15.15.Check if you run itEPSS 0.32%Sep 30, 2025
- High7.3liquidfiles liquidfiles Authentication Bypass by Primary WeaknessPatch nowKEVEPSS 0.77%Sep 30, 2025
- Medium6.1SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category Management via the category name field.Check if you run itEPSS 0.23%Sep 30, 2025
- Medium6.5An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a vaCheck if you run itEPSS 0.33%Sep 30, 2025
- Medium6.5In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, whiCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium6.5In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker toCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium6.5In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all informationCheck if you run itEPSS 0.26%Sep 30, 2025
- Medium6.5In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allCheck if you run itEPSS 0.26%Sep 30, 2025
- Medium4.8A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3.Check if you run itEPSS 0.26%Sep 30, 2025
- High7.5Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to intercept authorization codes and gain unauthCheck if you run itEPSS 0.31%Sep 30, 2025
- Critical9.5Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry keyCheck if you run itEPSS 0.48%Sep 29, 2025
- Critical10.0Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal DockerCheck if you run itEPSS 1.45%Sep 29, 2025
- Critical9.4Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated fiCheck if you run itEPSS 1.14%Sep 29, 2025
Sort