Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.Check if you run itEPSS 0.35%Apr 15, 2026
- High7.5Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active sessio…Check if you run itEPSS 0.42%Apr 15, 2026
- High8.3Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function…Check if you run itEPSS 0.73%Apr 15, 2026
- High7.2Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.30%Apr 15, 2026
- Medium6.9Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.30%Apr 15, 2026
- UnknownWordPress wordpress Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 15.17%Apr 15, 2026
- High7.2BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database.Check if you run itEPSS 0.81%Apr 14, 2026
- High8.8Chamilo LMS is an open-source learning management system.Check if you run itEPSS 2.63%Apr 14, 2026
- High8.6Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.57%Apr 14, 2026
- High7.2Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.35%Apr 14, 2026
- High7.1Chamilo is an open-source learning management system (LMS).Check if you run itEPSS 0.46%Apr 14, 2026
- Medium4.9October is a Content Management System (CMS) and web platform.Check if you run itEPSS 0.33%Apr 14, 2026
- High8.1A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrar…Check if you run itEPSS 0.41%Apr 14, 2026
- High8.1A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrari…Check if you run itEPSS 0.41%Apr 14, 2026
- High8.8A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset…Check if you run itEPSS 0.84%Apr 14, 2026
- High7.1Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.Check if you run itEPSS 0.32%Apr 14, 2026
- Critical9.9An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via u…Check if you run itEPSS 2.35%Apr 14, 2026
- Medium6.1In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.Check if you run itEPSS 0.18%Apr 14, 2026
- Critical9.8In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fro…Check if you run itEPSS 0.29%Apr 14, 2026
- Medium6.1In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.Check if you run itEPSS 0.18%Apr 14, 2026
- Medium6.1alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitra…Check if you run itEPSS 0.18%Apr 14, 2026
- Critical9.8Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.Check if you run itEPSS 0.27%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.Check if you run itEPSS 0.31%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.Check if you run itEPSS 0.31%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.Check if you run itEPSS 0.31%Apr 14, 2026