Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012.Check if you run itEPSS 0.31%Apr 25, 2025
- High8.8The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_Check if you run itEPSS 0.38%Apr 25, 2025
- Medium6.1The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due toCheck if you run itEPSS 0.33%Apr 25, 2025
- High8.8The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30.Check if you run itEPSS 0.38%Apr 25, 2025
- Medium6.1The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.25%Apr 25, 2025
- Medium6.1The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.31%Apr 25, 2025
- Medium6.1The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform StoreCheck if you run itEPSS 0.28%Apr 25, 2025
- Medium4.9The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficientCheck if you run itEPSS 0.29%Apr 25, 2025
- Medium4.4In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter.Check if you run itEPSS 0.28%Apr 25, 2025
- Critical9.3WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.Check if you run itEPSS 0.56%Apr 24, 2025
- Critical9.3UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.Check if you run itEPSS 0.55%Apr 24, 2025
- Medium4.1Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.Check if you run itEPSS 0.27%Apr 24, 2025
- High7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection.Check if you run itEPSS 0.40%Apr 24, 2025
- Critical9.8The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.55%Apr 24, 2025
- Medium4.2The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updatCheck if you run itEPSS 0.22%Apr 24, 2025
- High7.2The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.88%Apr 24, 2025
- High8.8The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8.Check if you run itEPSS 0.44%Apr 24, 2025
- Critical9.8The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.72%Apr 24, 2025
- High8.8The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7.Check if you run itEPSS 0.37%Apr 24, 2025
- High8.8The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_sCheck if you run itEPSS 0.47%Apr 24, 2025
- High8.8The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16.Check if you run itEPSS 0.38%Apr 24, 2025
- Medium4.8The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CCheck if you run itEPSS 0.27%Apr 24, 2025
- Medium4.4The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 dueCheck if you run itEPSS 0.23%Apr 24, 2025
- Medium5.9Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a filCheck if you run itEPSS 0.23%Apr 23, 2025
- Medium6.1Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using.Check if you run itEPSS 0.24%Apr 23, 2025
Sort