Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.8A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code executiCheck this weekEPSS 12.26%Jul 21, 2025
- High8.1A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment toCheck if you run itEPSS 9.07%Jul 21, 2025
- Medium5.1A vulnerability, which was classified as problematic, was found in PHPGurukul Online Banquet Booking System 1.0.Check if you run itEPSS 0.38%Jul 21, 2025
- High8.8A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High AvaiCheck if you run itEPSS 4.86%Jul 21, 2025
- Critical9.8An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantiningCheck this weekEPSS 10.51%Jul 21, 2025
- Critical9.8An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code executionCheck this weekEPSS 11.77%Jul 21, 2025
- High7.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.Check if you run itEPSS 0.27%Jul 21, 2025
- Medium5.9Incorrect authentication vulnerability in ParkingDoor.Check if you run itEPSS 0.21%Jul 21, 2025
- Medium5.3A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0.Check if you run itEPSS 0.57%Jul 21, 2025
- Medium5.1A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0.Check if you run itEPSS 0.38%Jul 21, 2025
- Medium5.5Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.Check if you run itEPSS 0.10%Jul 21, 2025
- High8.8File access paths in configuration files uploaded by users with administrator access are not validated.Check if you run itEPSS 1.07%Jul 21, 2025
- High7.5Users with administrator access can create databases files outside the files area of the Fuseki server.Check if you run itEPSS 1.56%Jul 21, 2025
- Medium6.4The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgeCheck if you run itEPSS 0.26%Jul 21, 2025
- Medium6.7A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library.Check if you run itEPSS 0.20%Jul 21, 2025
- Medium6.1WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScriptCheck if you run itEPSS 0.34%Jul 21, 2025
- High8.7The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a spCheck if you run itEPSS 0.61%Jul 21, 2025
- Critical9.3The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contCheck if you run itEPSS 0.70%Jul 21, 2025
- Critical9.3Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and potenCheck if you run itEPSS 0.95%Jul 21, 2025
- Medium4.6Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to accCheck if you run itEPSS 0.23%Jul 21, 2025
- Medium4.6Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini configCheck if you run itEPSS 0.36%Jul 21, 2025
- Medium5.1An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini componentsCheck if you run itEPSS 0.27%Jul 21, 2025
- High7.5Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameCheck if you run itEPSS 0.51%Jul 21, 2025
- High7.5Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversatiCheck if you run itEPSS 0.51%Jul 21, 2025
- Medium5.4A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting aCheck if you run itEPSS 0.97%Jul 21, 2025
Sort