Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter.Check if you run itEPSS 0.21%May 14, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters.Check if you run itEPSS 0.26%May 14, 2026
- High7.5The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.49%May 14, 2026
- High8.1The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.46%May 14, 2026
- High7.5The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.41%May 14, 2026
- Medium5.1podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content d…Check if you run itEPSS 0.19%May 14, 2026
- High8.8Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc.Check if you run itEPSS 0.24%May 14, 2026
- Medium5.3Uncontrolled Recursion vulnerability in Apache Commons.Check if you run itEPSS 0.47%May 14, 2026
- High8.2Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.Check if you run itEPSS 0.62%May 14, 2026
- Medium6.9An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processi…Check if you run itEPSS 0.28%May 14, 2026
- High8.7Comarch ERP Optima client makes use of a hard-coded password for a database user.Check if you run itEPSS 0.23%May 14, 2026
- High7.5Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in.Check if you run itEPSS 0.11%May 14, 2026
- Critical9.8Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd.Check if you run itEPSS 0.43%May 14, 2026
- Critical9.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd.Check if you run itEPSS 0.36%May 14, 2026
- High7.5The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit.Check if you run itEPSS 0.27%May 14, 2026
- Critical9.1The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2.Check if you run itEPSS 0.26%May 14, 2026
- Medium6.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and inc…Check if you run itEPSS 0.26%May 14, 2026
- Medium5.3The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() fun…Check if you run itEPSS 0.35%May 14, 2026
- Medium6.4The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insuff…Check if you run itEPSS 0.16%May 14, 2026
- Medium5.3The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5.Check if you run itEPSS 0.45%May 14, 2026
- Medium6.5The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and 'media_items' parameters.Check if you run itEPSS 0.60%May 14, 2026
- Critical9.8The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2.Check if you run itEPSS 0.44%May 14, 2026
- High8.8The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2.Check if you run itEPSS 0.29%May 14, 2026
- Critical9.8The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler.Check if you run itEPSS 0.66%May 14, 2026
- Medium6.4The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 du…Check if you run itEPSS 0.16%May 14, 2026
Sort