Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained byCheck this weekEPSS 36.00%Dec 18, 2025
- High7.5Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from nCheck if you run itEPSS 0.34%Dec 18, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster:Check if you run itEPSS 0.22%Dec 18, 2025
- High7.1Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ParallaxCheck this weekEPSS 27.00%Dec 18, 2025
- High7.5Missing Authorization vulnerability in YayCommerce YayPricing yaypricing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects YayPricing: from n/a thrCheck if you run itEPSS 0.34%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DetailX detailx allows PHP Local File InclusioCheck if you run itEPSS 0.50%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DJ Rainflow dj-rainflow allows PHP Local FileCheck if you run itEPSS 0.50%Dec 18, 2025
- High7.5Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects IDonatePro: from n/a tCheck if you run itEPSS 0.34%Dec 18, 2025
- Medium5.8Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectCheck if you run itEPSS 0.27%Dec 18, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Faith & Hope faith-hope allows PHP Local FileCheck if you run itEPSS 0.53%Dec 18, 2025
- Critical9.3TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files.Check if you run itEPSS 1.11%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcast_details.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (theme_freebox.php).Check if you run itEPSS 0.33%Dec 17, 2025
- Medium5.1PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episodes_upload.php).Check if you run itEPSS 0.34%Dec 17, 2025
- Medium5.1Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scripts.Check if you run itEPSS 0.31%Dec 17, 2025
- Medium5.1WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the meCheck if you run itEPSS 0.33%Dec 17, 2025
- High8.7HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration.Check if you run itEPSS 0.34%Dec 17, 2025
- High7.2RoundCube Webmail Cross-site Scripting VulnerabilityPatch nowKEVEPSS 27.41%Dec 17, 2025
- Medium5.3AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video.Check if you run itEPSS 0.28%Dec 17, 2025
- High8.7AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users.Check if you run itEPSS 0.33%Dec 17, 2025
- Critical9.3AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion.Check if you run itEPSS 0.47%Dec 17, 2025
- Medium4.8AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration.Check if you run itEPSS 0.19%Dec 17, 2025
- Medium6.9AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints.Check if you run itEPSS 0.85%Dec 17, 2025
- Medium6.9AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint.Check if you run itEPSS 0.85%Dec 17, 2025
- High8.7Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.Check if you run itEPSS 0.29%Dec 17, 2025
Sort