Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after s…Check if you run itEPSS 0.51%May 15, 2026
- High8.2phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filt…Check if you run itEPSS 0.34%May 15, 2026
- Medium5.1phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations,…Check if you run itEPSS 0.26%May 15, 2026
- High7.7phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting mal…Check if you run itEPSS 0.36%May 15, 2026
- Critical9.3phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id…Check if you run itEPSS 0.57%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoi…Check if you run itEPSS 0.28%May 15, 2026
- High7.0phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories.Check if you run itEPSS 0.48%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CO…Check if you run itEPSS 0.28%May 15, 2026
- Medium5.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths…Check if you run itEPSS 0.21%May 15, 2026
- High8.8PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated att…Check if you run itEPSS 0.27%May 15, 2026
- High8.7Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension pa…Check if you run itEPSS 0.71%May 15, 2026
- Medium5.3CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files.Check if you run itEPSS 0.24%May 15, 2026
- Critical9.3Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high lev…Check if you run itEPSS 0.49%May 15, 2026
- High8.8The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36.Patch nowKEVEPSS 0.77%May 15, 2026
- Medium6.0Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the s…Check if you run itEPSS 0.37%May 14, 2026
- Critical9.3HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool.Check if you run itEPSS 0.46%May 14, 2026
- High7.1ClipBucket v5 is an open source video sharing platform.Check if you run itEPSS 0.34%May 14, 2026
- High8.6Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by up…Check if you run itEPSS 0.63%May 14, 2026
- High7.1Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on erro…Check if you run itEPSS 0.48%May 14, 2026
- High7.5The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.57%May 14, 2026
- Critical9.1OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.82%May 13, 2026
- High7.2CubeCart is an ecommerce software solution.Check if you run itEPSS 0.54%May 13, 2026
- High8.1CubeCart is an ecommerce software solution.Check if you run itEPSS 0.20%May 13, 2026
- Medium4.9CubeCart is an ecommerce software solution.Check if you run itEPSS 0.40%May 13, 2026
- Critical9.1CubeCart is an ecommerce software solution.Check if you run itEPSS 0.76%May 13, 2026