Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Quiz wp-quiz allows Stored XSS.This issue affects WP Quiz: fromCheck if you run itEPSS 0.22%Apr 25, 2025
- Medium5.3The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0.Check if you run itEPSS 0.41%Apr 25, 2025
- Medium6.1The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due toCheck if you run itEPSS 0.33%Apr 25, 2025
- High8.8The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30.Check if you run itEPSS 0.39%Apr 25, 2025
- Medium6.1The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.25%Apr 25, 2025
- Medium6.1The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.Check if you run itEPSS 0.32%Apr 25, 2025
- Medium6.1The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform StoreCheck if you run itEPSS 0.29%Apr 25, 2025
- Medium5.3The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generaCheck if you run itEPSS 0.40%Apr 25, 2025
- Medium5.4The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on tCheck if you run itEPSS 0.30%Apr 25, 2025
- Medium4.9The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficientCheck if you run itEPSS 0.30%Apr 25, 2025
- High7.5Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter moduleCheck if you run itEPSS 0.93%Apr 25, 2025
- Medium6.4The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1Check if you run itEPSS 0.32%Apr 25, 2025
- Medium6.5The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request ForgCheck if you run itEPSS 0.29%Apr 25, 2025
- High8.2React Router is a router for React.Check if you run itEPSS 0.81%Apr 25, 2025
- High7.5React Router is a router for React.Check this weekEPSS 20.47%Apr 25, 2025
- High7.2Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumentedCheck if you run itEPSS 0.29%Apr 25, 2025
- Critical9.9Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file.Check if you run itEPSS 0.75%Apr 25, 2025
- High7.5OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable.Check if you run itEPSS 0.24%Apr 25, 2025
- Medium6.8CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255.Check if you run itEPSS 0.46%Apr 25, 2025
- Medium6.4An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS.Check if you run itEPSS 0.24%Apr 25, 2025
- Medium5.4In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, oCheck if you run itEPSS 0.17%Apr 25, 2025
- Low3.5In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user.Check if you run itEPSS 0.43%Apr 25, 2025
- Medium4.4In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter.Check if you run itEPSS 0.29%Apr 25, 2025
- Medium6.4In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.Check if you run itEPSS 0.29%Apr 25, 2025
- High7.5NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint.Check if you run itEPSS 0.43%Apr 25, 2025
Sort