Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.2The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJCheck if you run itEPSS 0.41%Sep 30, 2025
- High8.7Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability.Check if you run itEPSS 0.48%Sep 30, 2025
- High8.1The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter.Check if you run itEPSS 0.69%Sep 30, 2025
- Medium6.5The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter.Check if you run itEPSS 0.42%Sep 30, 2025
- Critical9.8The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and incluCheck if you run itEPSS 0.73%Sep 30, 2025
- High8.1The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'.Check if you run itEPSS 0.70%Sep 30, 2025
- Medium6.4The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficientCheck if you run itEPSS 0.21%Sep 30, 2025
- Medium6.4Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and tCheck if you run itEPSS 0.13%Sep 30, 2025
- Medium6.5An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrary SQL queries via theCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium5.4TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.Check if you run itEPSS 0.33%Sep 30, 2025
- Low3.5The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and passwordCheck if you run itEPSS 0.20%Sep 30, 2025
- High7.5Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter.Check if you run itEPSS 0.43%Sep 30, 2025
- Medium5.3dify dify Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.70%Sep 30, 2025
- Critical9.8NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.Check if you run itEPSS 0.45%Sep 30, 2025
- Medium6.1A URL validation bypass vulnerability exists in validator.js through version 13.15.15.Check if you run itEPSS 0.32%Sep 30, 2025
- High7.3liquidfiles liquidfiles Authentication Bypass by Primary WeaknessPatch nowKEVEPSS 0.77%Sep 30, 2025
- Medium6.5An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a vaCheck if you run itEPSS 0.33%Sep 30, 2025
- Medium6.5In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, whiCheck if you run itEPSS 0.27%Sep 30, 2025
- Medium6.5In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker toCheck if you run itEPSS 0.27%Sep 30, 2025
- High7.5Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to intercept authorization codes and gain unauthCheck if you run itEPSS 0.31%Sep 30, 2025
- Critical9.5Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry keyCheck if you run itEPSS 0.48%Sep 29, 2025
- Critical10.0Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal DockerCheck if you run itEPSS 1.45%Sep 29, 2025
- Critical9.4Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated fiCheck if you run itEPSS 1.14%Sep 29, 2025
- Medium6.9Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identCheck if you run itEPSS 0.69%Sep 29, 2025
- Critical10.0Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /Check if you run itEPSS 0.52%Sep 29, 2025
Sort