Skip to content
OpenAdvisories

Archive

23 May 2022

Vulnerabilities first published on this day (UTC), newest first.

← April 2022 2022 / May /23 June 2022 →
  1. 127
  2. 276
  3. 3109
  4. 480
  5. 5129
  6. 672
  7. 74
  8. 85
  9. 945
  10. 10196
  11. 11176
  12. 12159
  13. 1388
  14. 142
  15. 157
  16. 16101
  17. 17111
  18. 1878
  19. 1940
  20. 20107
  21. 218
  22. 221
  23. 2347
  24. 2481
  25. 2562
  26. 26157
  27. 2760
  28. 28 
  29. 295
  30. 3027
  31. 31115
All Critical High Medium Low Exploited only Public exploit

47 results · Feed

  • Unscored —
    CVE-2022-1192

    Turn off all comments <= 1.0 - Reflected Cross-Site Scripting

    The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

    Web / CMS
  • Unscored —
    CVE-2022-1093

    WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs

    The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html…

    Web / CMS
  • Unscored —
    CVE-2022-1014

    WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi

    The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.

    Web / CMS
  • Unscored —
    CVE-2022-0781 Scanner template EPSS 13%

    Nirweb support < 2.8.2 - Unauthenticated SQLi

    The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection

    Web / CMS
  • Unscored —
    CVE-2022-0346 Scanner template

    Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting

    The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.

    Web / CMS
  • Medium 5.3
    CVE-2021-41834

    JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality c…

    jfrog artifactory
  • Critical 9.9
    CVE-2022-1810

    Authorization Bypass Through User-Controlled Key in publify/publify

    Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.

    publify publify/publify publify_core RubyGems