Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
656 results · Clear filters · Feed
-
High 7.5
An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via …
-
High 8.8
An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges…
-
High 8.6
Enphase Installer Toolkit Android App Use of Hard-coded Credentials
Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.
-
High 8.4
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an a…
KEV Jul 28, 2025 -
High 7.3
PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication
A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. The manipulation lead…
-
High 7.1
WordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1 versions.
-
High 7.1
WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.
-
High 7.3
Remote access to warp-svc.exe in Cloudflare WARP
Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and di…
-
High 7.1
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not prope…
-
High 7.1
WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
-
High 8.1
CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated…
-
High 8.0
Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser functi…
-
High 8.8
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and …
-
High 7.5
SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist …
-
High 8.8
An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the funct…
-
High 7.2
SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id…
-
High 7.2
An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden pa…
-
High 8.8
File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type param…
-
High 7.2
SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via th…
-
High 8.8
GilaCMS Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.
-
High 7.2
File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sens…
-
High 7.5
SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via t…
-
High 7.2CVE-2020-20969 Public exploit
File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_rest…
-
High 7.5
Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote at…
-
High 7.1
WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versions.
-
High 7.1
WordPress WP Backup Manager Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 versions.
-
High 8.7
WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion
Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <= 0.1.3 versions.
-
High 8.2
WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection
Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.
-
High 7.2
QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
-
High 7.2
WP Custom Cursors < 3.2 - Admin+ SQLi
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
-
High 8.8
SupportCandy < 3.1.7 - Subscriber+ SQLi
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
-
High 7.5
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null…
-
High 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below vers…
-
High 7.8
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on …
-
High 7.8
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on …
-
High 7.5
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability m…
-
High 7.5
JeecgBoot vulnerable to SQL injection in queryTableDictItemsByCode
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.
-
High 7.5
JeecgBoot vulnerable to SQL injection in queryFilterTableDictInfo
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.
-
High 7.5
Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may caus…
-
High 7.5
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerab…