Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5.Check if you run itEPSS 0.62%Aug 21, 2025
- Medium6.4The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributeCheck if you run itEPSS 0.20%Aug 21, 2025
- Medium4.3The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_pCheck if you run itEPSS 0.26%Aug 21, 2025
- High8.1The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2.Check if you run itEPSS 0.23%Aug 21, 2025
- Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retrieve Embedded SensitiveCheck if you run itEPSS 0.31%Aug 21, 2025
- Critical9.8Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV SCheck if you run itEPSS 1.19%Aug 21, 2025
- High7.5Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.Check if you run itEPSS 0.40%Aug 21, 2025
- Low3.5agent-zero agent-zero Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 1.12%Aug 21, 2025
- Medium5.3Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing tCheck if you run itEPSS 0.32%Aug 21, 2025
- High8.8Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying theCheck if you run itEPSS 0.38%Aug 21, 2025
- High8.8Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.Check if you run itEPSS 0.38%Aug 21, 2025
- Medium5.3Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any accouCheck if you run itEPSS 0.32%Aug 21, 2025
- Medium5.3Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal priviCheck if you run itEPSS 0.32%Aug 21, 2025
- Critical9.8Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UICheck if you run itEPSS 0.57%Aug 21, 2025
- High8.8Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter inCheck if you run itEPSS 0.24%Aug 21, 2025
- High7.5A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files.Check if you run itEPSS 0.65%Aug 21, 2025
- Medium5.4MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.Check if you run itEPSS 0.26%Aug 21, 2025
- High8.8hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.Check if you run itEPSS 0.35%Aug 21, 2025
- Medium5.4SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalanCheck if you run itEPSS 0.23%Aug 21, 2025
- Medium5.3An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attCheck if you run itEPSS 0.26%Aug 21, 2025
- UnknownNews & Blog Designer Pack Plugin 'bdp_get_more_post' Function VulnerabilityPatch nowKEVEPSS 4.95%Aug 21, 2025
- Critical9.8Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injectionPatch nowKEVEPSS 47.95%Aug 20, 2025
- Medium5.1A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Check if you run itEPSS 0.22%Aug 20, 2025
- Medium5.3A security flaw has been discovered in elunez eladmin up to 2.7.Check if you run itEPSS 0.34%Aug 20, 2025
- Medium6.3A vulnerability was identified in elunez eladmin up to 2.7.Check if you run itEPSS 0.20%Aug 20, 2025
Sort