Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting craf…Check if you run itEPSS 0.40%May 10, 2026
- Medium5.1Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block…Check if you run itEPSS 0.21%May 10, 2026
- High8.8Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbit…Check if you run itEPSS 0.31%May 10, 2026
- Medium5.1Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering pa…Check if you run itEPSS 0.19%May 10, 2026
- High8.8Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code…Check if you run itEPSS 0.28%May 10, 2026
- Medium5.1WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by explo…Check if you run itEPSS 0.19%May 10, 2026
- Medium5.1Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating forms wit…Check if you run itEPSS 0.19%May 10, 2026
- Medium5.1CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted inpu…Check if you run itEPSS 0.24%May 10, 2026
- Medium5.1Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter.Check if you run itEPSS 0.28%May 10, 2026
- Critical9.3OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie.Check if you run itEPSS 0.42%May 10, 2026
- Medium5.1Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter.Check if you run itEPSS 0.24%May 10, 2026
- Medium5.1AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScr…Check if you run itEPSS 0.24%May 10, 2026
- Medium5.1Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code th…Check if you run itEPSS 0.24%May 10, 2026
- Medium5.5A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03.Check if you run itEPSS 0.40%May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstrin…Check if you run itEPSS 0.47%May 10, 2026
- Low2.1A weakness has been identified in Wavlink NU516U1 240425.Check if you run itEPSS 8.07%May 10, 2026
- Medium5.5A vulnerability was identified in Open5GS up to 2.7.7.Check if you run itEPSS 0.49%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a sign…Check if you run itEPSS 0.46%May 10, 2026
- Low2.9In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding proces…Check if you run itEPSS 0.78%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the…Check if you run itEPSS 0.30%May 10, 2026
- Critical9.5In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores point…Check if you run itEPSS 0.89%May 10, 2026
- High7.4In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when prepar…Check if you run itEPSS 0.44%May 10, 2026
- Low1.9A weakness has been identified in Devs Palace ERP Online up to 4.0.0.Check if you run itEPSS 0.21%May 10, 2026
- Low2.9A flaw has been found in JeecgBoot 3.9.1.Check if you run itEPSS 0.46%May 9, 2026
- Low2.1A vulnerability was detected in JeecgBoot up to 3.9.1.Check if you run itEPSS 0.27%May 9, 2026
Sort