Archive
16 May 2022
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Unscored —
Fusion Builder < 3.6.2 - Unauthenticated SSRF
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could b…
-
Unscored —
Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
-
Unscored —CVE-2022-1051 Public exploit
WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to per…
-
Unscored —CVE-2022-1679 Public exploit
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…
-
Unscored —CVE-2022-29622 Public exploit
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted fi…
-
High 7.5
Shell command injection in gitea
Gitea before 1.16.7 does not escape git fetch remote.