Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored XSS.This issue affectCheck if you run itEPSS 0.22%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HCheck if you run itEPSS 0.22%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT BlCheck if you run itEPSS 0.23%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects SirvCheck if you run itEPSS 0.23%Apr 22, 2025
- Medium4.3Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DownloadCheck if you run itEPSS 0.29%Apr 22, 2025
- Medium5.4Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliCheck if you run itEPSS 0.17%Apr 22, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This issue affects TextmetriCheck if you run itEPSS 0.23%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows DOM-Based XSS.This issue affects EventCheck if you run itEPSS 0.22%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issueCheck if you run itEPSS 0.22%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.This issue affects MPL-Check if you run itEPSS 0.28%Apr 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS.Check if you run itEPSS 0.28%Apr 22, 2025
- High7.0An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.Check if you run itEPSS 0.30%Apr 22, 2025
- Medium5.3It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.Check if you run itEPSS 0.25%Apr 22, 2025
- High7.5Improper Input Validation vulnerability in Apache Kvrocks.Check if you run itEPSS 0.76%Apr 22, 2025
- High8.1The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to autheCheck if you run itEPSS 9.52%Apr 22, 2025
- High7.1The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting whicCheck if you run itEPSS 0.55%Apr 22, 2025
- Medium6.4The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to iCheck if you run itEPSS 0.33%Apr 22, 2025
- Medium6.4The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to iCheck if you run itEPSS 0.29%Apr 22, 2025
- High8.8The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_requeCheck if you run itEPSS 2.57%Apr 22, 2025
- High7.1Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue affects Hitachi Ops CentCheck if you run itEPSS 0.31%Apr 22, 2025
- Medium5.5Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability.Check if you run itEPSS 0.17%Apr 22, 2025
- Medium4.9**UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0 could allow an authenticatedCheck this weekEPSS 12.62%Apr 22, 2025
- Medium6.7An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attCheck if you run itEPSS 0.20%Apr 22, 2025
- High7.8An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticatCheck if you run itEPSS 0.94%Apr 22, 2025
- Medium5.3A vulnerability was found in xxyopen Novel-Plus 5.1.0.Check if you run itEPSS 0.60%Apr 22, 2025
Sort