Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets management interface.Check if you run itEPSS 0.92%Dec 15, 2025
- High8.6Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints.Check if you run itEPSS 0.96%Dec 15, 2025
- Medium5.1Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages.Check if you run itEPSS 0.24%Dec 15, 2025
- Medium5.1Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application.Check if you run itEPSS 0.43%Dec 15, 2025
- High8.6Webutler v3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload PHP files with system command execution.Check if you run itEPSS 0.92%Dec 15, 2025
- Medium5.1Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.Check if you run itEPSS 0.27%Dec 15, 2025
- High8.6Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation.Check if you run itEPSS 1.00%Dec 15, 2025
- Medium5.1JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts.Check if you run itEPSS 0.36%Dec 15, 2025
- Critical9.2ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attacCheck if you run itEPSS 0.31%Dec 15, 2025
- Medium4.8Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters.Check if you run itEPSS 0.34%Dec 15, 2025
- Medium6.9Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-Length header parsingCheck if you run itEPSS 0.37%Dec 15, 2025
- Critical9.3Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries.Check if you run itEPSS 0.45%Dec 15, 2025
- Medium5.1Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads.Check if you run itEPSS 0.25%Dec 15, 2025
- High7.5GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code through DNS spoofing.Check if you run itEPSS 0.45%Dec 15, 2025
- Medium6.7GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application.Check if you run itEPSS 0.48%Dec 15, 2025
- High8.7SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service.Check if you run itEPSS 0.49%Dec 15, 2025
- Critical9.3Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands.Check if you run itEPSS 1.12%Dec 15, 2025
- Medium6.9Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application.Check if you run itEPSS 0.64%Dec 15, 2025
- Medium5.1Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts.Check if you run itEPSS 0.36%Dec 15, 2025
- High8.7WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media function.Check if you run itEPSS 0.51%Dec 15, 2025
- High8.7Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager.Check if you run itEPSS 0.85%Dec 15, 2025
- Low1.0Weblate is a web based localization tool.Check if you run itEPSS 0.35%Dec 15, 2025
- Medium5.9IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middleCheck if you run itEPSS 0.19%Dec 15, 2025
- Medium5.0IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 isCheck if you run itEPSS 0.19%Dec 15, 2025
- High7.0EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints.Check if you run itEPSS 0.23%Dec 15, 2025
Sort