Skip to content
OpenAdvisories

Archive

September 2019

Vulnerabilities first published in this month (UTC), newest first.

← August 2019 2019 / September October 2019 →
  1. 1 
  2. 21
  3. 336
  4. 437
  5. 559
  6. 655
  7. 7 
  8. 822
  9. 997
  10. 1057
  11. 11139
  12. 1242
  13. 1350
  14. 1411
  15. 158
  16. 1671
  17. 1772
  18. 1844
  19. 1918
  20. 2077
  21. 2117
  22. 226
  23. 2340
  24. 2430
  25. 25104
  26. 2668
  27. 27311
  28. 283
  29. 291
  30. 3064
All Critical High Medium Low Exploited only Public exploit

1,540 results · Feed

  • Unscored —
    CVE-2015-9393

    The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

  • Unscored —
    CVE-2015-9392

    The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

  • Unscored —
    CVE-2015-9391

    The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.

  • Unscored —
    CVE-2015-9390

    The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are…

  • Unscored —
    CVE-2015-9389

    The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.

  • Unscored —
    CVE-2015-9388

    The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.

  • Unscored —
    CVE-2015-9386

    The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.

  • Unscored —
    CVE-2015-9387

    The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.

  • Unscored —
    CVE-2015-9385

    The quotes-and-tips plugin before 1.20 for WordPress has XSS.

  • Unscored —
    CVE-2015-9384

    The relevant plugin before 1.0.8 for WordPress has XSS.

  • Unscored —
    CVE-2016-11013

    The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.

  • Unscored —
    CVE-2016-11012

    The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.

  • Unscored —
    CVE-2016-11011

    The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.

  • Unscored —
    CVE-2016-11010

    The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updat…

  • Unscored —
    CVE-2016-11009

    The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata update…

  • Unscored —
    CVE-2016-11008

    The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.

  • Unscored —
    CVE-2016-11007

    The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.

  • Unscored —
    CVE-2016-11006

    The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.

  • Unscored —
    CVE-2016-11005

    The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.

  • Unscored —
    CVE-2016-11004

    The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.

  • Unscored —
    CVE-2016-11002

    The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.

  • Unscored —
    CVE-2016-11003

    The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.

  • Unscored —
    CVE-2016-11001

    The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.

  • Unscored —
    CVE-2016-11000

    The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.

  • Unscored —
    CVE-2019-16642

    App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/g…

  • Unscored —
    CVE-2016-10999

    The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.

  • Unscored —
    CVE-2016-10998

    The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.

  • Unscored —
    CVE-2016-10997

    The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.

  • Unscored —
    CVE-2016-10996

    The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce lea…

  • Unscored —
    CVE-2019-15089

    An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the …

  • Unscored —
    CVE-2019-15088

    An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under spec…

  • Unscored —
    CVE-2019-15087

    An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to an…

  • Unscored —
    CVE-2019-15086

    An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected …

  • Unscored —
    CVE-2019-15085

    An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form.

  • Unscored —
    CVE-2019-14916

    An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file u…

  • Unscored —
    CVE-2019-14915

    An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitti…

  • Unscored —
    CVE-2019-14914

    An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to …

  • Unscored —
    CVE-2019-14913

    An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the admini…

  • Unscored —
    CVE-2019-14912 Public exploit

    An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to …

  • Unscored —
    CVE-2019-14911

    An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to re…