Skip to content
OpenAdvisories

Archive

14 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /14 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-42171 Public exploit

    Unrestricted Upload of File with Dangerous Type in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and …

    tribalsystems/zenario Packagist
  • Unscored —
    CVE-2022-0169 Public exploit Scanner template EPSS 75%

    Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

    The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), le…

    Web / CMS
  • Unscored —
    CVE-2022-0165 Public exploit Scanner template

    Page Builder KingComposer <= 2.9.6 - Open Redirect

    The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users

    Web / CMS
  • Unscored —
    CVE-2021-25003 Public exploit Scanner template EPSS 56%

    WPCargo < 6.9.0 - Unauthenticated RCE

    The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

    Web / CMS
  • Unscored —
    CVE-2021-24966 Public exploit

    Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing

    The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder

    Web / CMS
  • Unscored —
    CVE-2021-24959 Public exploit

    WP Email Users <= 1.7.6 - Subscriber+ SQL Injection

    The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.

    Web / CMS
  • Unscored —
    CVE-2022-23943 Public exploit EPSS 50%

    mod_sed: Read/write beyond bounds

    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2022-22720 Public exploit EPSS 28%

    HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

    Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine