Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispaCheck this weekEPSS 18.03%Aug 19, 2025
- Critical9.8The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and iCheck if you run itEPSS 0.37%Aug 19, 2025
- High8.8The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and iCheck if you run itEPSS 0.33%Aug 19, 2025
- None0.0This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryAug 19, 2025
- Medium6.1An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image.Check if you run itEPSS 0.22%Aug 19, 2025
- Medium4.3The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capCheck if you run itEPSS 0.34%Aug 19, 2025
- Medium6.4The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficCheck if you run itEPSS 0.21%Aug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- None0.0Rejected reason: Not usedOpen the advisoryAug 19, 2025
- Critical9.8In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison.Check if you run itEPSS 0.55%Aug 19, 2025
- Medium5.3An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accoCheck if you run itEPSS 0.52%Aug 19, 2025
- Medium6.5An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute arbitrary code via uplCheck if you run itEPSS 0.32%Aug 19, 2025
- Critical9.8An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/reset_password endpoint.Check if you run itEPSS 0.34%Aug 19, 2025
- Medium5.3EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)).Check if you run itEPSS 0.24%Aug 19, 2025
- Medium5.3EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interfacCheck if you run itEPSS 0.71%Aug 19, 2025
- Medium6.5In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter.Check if you run itEPSS 0.32%Aug 19, 2025
- Medium6.1Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.Check if you run itEPSS 0.24%Aug 19, 2025
- Medium6.5Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Email Addresses function.Check if you run itEPSS 0.26%Aug 19, 2025
Sort