Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the i…Check if you run itEPSS 0.35%May 10, 2026
- Medium5.1Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.Check if you run itEPSS 0.30%May 10, 2026
- Medium5.1Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject…Check if you run itEPSS 0.19%May 10, 2026
- Medium5.1Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in t…Check if you run itEPSS 0.20%May 10, 2026
- High8.7TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files…Check if you run itEPSS 0.62%May 10, 2026
- Critical9.3WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious…Check if you run itEPSS 0.40%May 10, 2026
- High8.7Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system command…Check if you run itEPSS 0.64%May 10, 2026
- High8.7ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP…Check if you run itEPSS 0.57%May 10, 2026
- High8.7e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uplo…Check if you run itEPSS 0.59%May 10, 2026
- Critical9.3OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disg…Check if you run itEPSS 0.66%May 10, 2026
- Critical9.3WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to…Check if you run itEPSS 0.59%May 10, 2026
- Medium5.1Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter.Check if you run itEPSS 0.28%May 10, 2026
- Low2.1A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0.Check if you run itEPSS 0.32%May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data str…Check if you run itEPSS 0.63%May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstrin…Check if you run itEPSS 0.60%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a sign…Check if you run itEPSS 0.84%May 10, 2026
- Low2.9In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding proces…Check if you run itEPSS 1.05%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the…Check if you run itEPSS 0.53%May 10, 2026
- Low2.1In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to…Check if you run itEPSS 0.34%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype…Check if you run itEPSS 0.40%May 10, 2026
- High7.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to co…Check if you run itEPSS 0.31%May 10, 2026
- Critical9.5In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores point…Check if you run itEPSS 1.29%May 10, 2026
- High7.4In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when prepar…Check if you run itEPSS 0.44%May 10, 2026
- Low2.1A security vulnerability has been detected in osTicket up to 1.18.3.Check if you run itEPSS 0.23%May 9, 2026
- High8.8AzuraCast is a self-hosted, all-in-one web radio management suite.Check if you run itEPSS 1.03%May 9, 2026