Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…Check if you run itEPSS 0.51%Oct 16, 2026
- Medium5.3The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ…Check if you run itEPSS 0.21%Oct 16, 2026
- High8.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.Check if you run itEPSS 0.29%Oct 16, 2026
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…Check if you run itEPSS 0.46%Oct 16, 2026
- Medium6.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' param…Check if you run itEPSS 0.20%Oct 16, 2026
- High7.2The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insuffi…Check if you run itEPSS 0.27%Oct 16, 2026
- High8.1The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in t…Check if you run itEPSS 0.79%Oct 16, 2026
- Critical9.8The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.Check if you run itEPSS 0.89%Oct 16, 2026
- Medium5.3Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other cu…Check if you run itEPSS 0.22%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…Check if you run itEPSS 0.21%Oct 15, 2026
- Medium5.3ZoneMinder is a free, open source closed-circuit television software application.Check if you run itEPSS 0.39%Oct 15, 2026
- High8.8DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment EndpointCheck if you run itEPSS 0.52%Oct 15, 2026
- Medium6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterCheck if you run itEPSS 0.20%Oct 15, 2026
- Low2.3Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via…Check if you run itEPSS 0.48%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and c…Check if you run itEPSS 0.92%Oct 15, 2026
- Medium6.9Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a fi…Check if you run itEPSS 0.84%Oct 15, 2026
- High8.6pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privil…Check if you run itEPSS 6.37%Oct 15, 2026
- Medium5.1Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver:…Check if you run itEPSS 0.81%Oct 15, 2026
- Medium5.1Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lis…Check if you run itEPSS 0.81%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submi…Check if you run itEPSS 0.98%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unesc…Check if you run itEPSS 0.95%Oct 15, 2026
- High8.6pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injectin…Check if you run itEPSS 0.73%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via un…Check if you run itEPSS 0.89%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wire…Check if you run itEPSS 7.05%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Locati…Check if you run itEPSS 0.23%Oct 15, 2026