Category
Web / CMS
26,715 known vulnerabilities.
1,140 results · Clear filters · Feed
-
Critical 10.0
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…
KEV Nov 3, 2021 -
High 7.1
WordPress Authenticated XXE attack when installation is running PHP 8
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…
-
Unscored —CVE-2020-36287 Public exploit
The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center befo…
-
Unscored —CVE-2021-24174 Public exploit
Database Backups <= 1.2.2.6 - CSRF to Backup Download
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
-
Unscored —
Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
-
Unscored —
Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to …
-
Critical 9.6CVE-2021-22201 Public exploit
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file…
-
High 8.1
BuddyPress privilege escalation via REST API
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint.…
-
Critical 9.9
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authentica…
-
Unscored —CVE-2019-14830 Public exploit
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where th…
-
Unscored —
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
-
Unscored —
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
-
Unscored —CVE-2021-23132 Public exploit
[20210306] - Core - com_media allowed paths that are not intended for image uploads
An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads
-
Critical 9.1CVE-2021-21014 Public exploit
Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console i…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information discl…
-
Medium 6.1CVE-2020-25627 Public exploit
Moodle stored Cross-site Scripting (XSS)
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
-
High 8.8
Drupal core Unrestricted Upload of File with Dangerous Type
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…
KEV Jan 18, 2022 -
Unscored —
Blind SQL Injection in PrestaShop
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Info…
-
High 8.8CVE-2020-2261 Public exploit
OS command execution vulnerability in Perfecto Plugin
Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller
-
Medium 5.4CVE-2020-2231 Public exploit
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission…
-
High 8.0CVE-2020-2229 Public exploit
Jenkins Cross-Site Scripting vulnerability in help icons
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
-
High 8.0
Jenkins Cross-site Scripting vulnerability in project naming strategy
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
-
Unscored —CVE-2020-14166 Public exploit
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows rem…
-
Medium 6.3CVE-2020-13277 Public exploit
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and late…
-
Unscored —
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in…
-
Unscored —
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
-
Medium 6.1
Password reset links invalidation issue in WordPress
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…
-
Unscored —CVE-2020-12077 Public exploit
The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions w…
-
High 7.6CVE-2020-5250 Public exploit
Possible information disclosure in PrestaShop
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all inform…
-
Unscored —
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
-
Unscored —
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
-
Critical 9.1
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any…
-
Medium 6.1
Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
-
Unscored —CVE-2012-1563 Public exploit
Joomla! before 2.5.3 allows Admin Account Creation.
-
Unscored —CVE-2011-4595 Public exploit
Pretty-Link WordPress plugin 1.5.2 has XSS
-
High 8.3
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to …
-
Medium 5.8
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downlo…
-
Critical 9.8CVE-2019-19634 Public exploit
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.