Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.1A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9.Check if you run itEPSS 0.41%May 23, 2026
- High7.6Mantis Bug Tracker (MantisBT) is an open source issue tracker.Check if you run itEPSS 0.59%May 22, 2026
- Medium4.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3.Check if you run itEPSS 0.20%May 22, 2026
- Medium6.3In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading p…Check if you run itEPSS 0.31%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concre…Check if you run itEPSS 0.19%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/ .Check if you run itEPSS 0.26%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.Check if you run itEPSS 0.26%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/ .Check if you run itEPSS 0.19%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.Check if you run itEPSS 0.47%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name.Check if you run itEPSS 0.25%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/ .Check if you run itEPSS 0.16%May 21, 2026
- High8.9Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller.Check if you run itEPSS 0.74%May 21, 2026
- Critical9.4Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts.Check if you run itEPSS 1.11%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLO…Check if you run itEPSS 0.27%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VER…Check if you run itEPSS 0.31%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL…Check if you run itEPSS 0.27%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIF…Check if you run itEPSS 0.27%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository.Check if you run itEPSS 0.38%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository.Check if you run itEPSS 0.38%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository.Check if you run itEPSS 0.38%May 21, 2026
- Critical9.2Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.Check if you run itEPSS 0.51%May 21, 2026
- Critical9.2Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository.Check if you run itEPSS 0.52%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHE…Check if you run itEPSS 0.36%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SE…Check if you run itEPSS 0.36%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SE…Check if you run itEPSS 0.36%May 21, 2026