Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and iCheck if you run itEPSS 0.37%May 15, 2025
- Medium4.7powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted asCheck if you run itEPSS 0.44%May 15, 2025
- High7.5In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.Check if you run itEPSS 0.51%May 15, 2025
- Medium5.4The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.Check if you run itEPSS 0.31%May 15, 2025
- Medium5.0In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.Check if you run itEPSS 0.36%May 15, 2025
- Medium5.1A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and RCheck if you run itEPSS 0.26%May 15, 2025
- Critical9.8An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload intoCheck if you run itEPSS 0.52%May 15, 2025
- Medium5.4SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.Check if you run itEPSS 0.21%May 15, 2025
- Medium6.1Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters.Check if you run itEPSS 0.29%May 15, 2025
- Medium6.1Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, enginenumber' iCheck if you run itEPSS 0.30%May 15, 2025
- Medium6.1Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter.Check if you run itEPSS 0.29%May 15, 2025
- Medium6.1Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.Check if you run itEPSS 0.29%May 15, 2025
- Medium5.4FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.Check if you run itEPSS 0.26%May 15, 2025
- High7.9An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05Check if you run itEPSS 0.19%May 15, 2025
- High7.5An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05Check if you run itEPSS 0.48%May 15, 2025
- High7.5An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05Check if you run itEPSS 0.48%May 15, 2025
- High7.5An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05Check if you run itEPSS 0.48%May 15, 2025
- Medium6.6net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system.Check if you run itEPSS 0.20%May 14, 2025
- Medium5.4Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalation of privilege via loCheck if you run itEPSS 0.17%May 14, 2025
- Critical9.8In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log inCheck if you run itEPSS 0.65%May 14, 2025
- Medium5.9Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.Check if you run itEPSS 0.23%May 14, 2025
- Medium4.3Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifieCheck if you run itEPSS 0.33%May 14, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URLCheck if you run itEPSS 0.25%May 14, 2025
- High8.8Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scriptiCheck if you run itEPSS 0.56%May 14, 2025
- Critical9.1In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunctionCheck if you run itEPSS 0.64%May 14, 2025
Sort