Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.1DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to coCheck if you run itEPSS 0.41%May 15, 2025
- Medium4.3IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system through a directory listinCheck if you run itEPSS 0.29%May 15, 2025
- Critical9.1Spotipy is a Python library for the Spotify Web API.Check if you run itEPSS 0.63%May 15, 2025
- Medium4.3The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students pageCheck if you run itEPSS 0.40%May 15, 2025
- Low3.5The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform CroCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.4The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users.Check if you run itEPSS 0.31%May 15, 2025
- Low3.5The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Check if you run itEPSS 0.33%May 15, 2025
- Low3.5The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrCheck if you run itEPSS 0.33%May 15, 2025
- Low3.5The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin tCheck if you run itEPSS 0.36%May 15, 2025
- Low3.5The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SCheck if you run itEPSS 0.33%May 15, 2025
- Medium6.8The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (liCheck if you run itEPSS 0.58%May 15, 2025
- Medium4.8The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perforCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CCheck if you run itEPSS 0.33%May 15, 2025
- Medium4.8The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settingsCheck if you run itEPSS 0.36%May 15, 2025
- Medium4.8The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfoCheck if you run itEPSS 0.33%May 15, 2025
- Low3.5The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postsCheck if you run itEPSS 0.34%May 15, 2025
- Medium5.3This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.Check if you run itEPSS 0.38%May 15, 2025
- High8.8The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated userCheck if you run itEPSS 0.71%May 15, 2025
- High7.1The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptiCheck if you run itEPSS 0.32%May 15, 2025
- Low3.5The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them viaCheck if you run itEPSS 0.20%May 15, 2025
- High7.5The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action.Check if you run itEPSS 0.56%May 15, 2025
- High7.3The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.Check if you run itEPSS 0.46%May 15, 2025
- Medium6.1The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site ScriptingCheck if you run itEPSS 0.39%May 15, 2025
- Medium5.5The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them viCheck if you run itEPSS 0.18%May 15, 2025
- Medium6.1The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.Check if you run itEPSS 0.32%May 15, 2025
Sort