97,140 results · Clear filters · Feed
-
High 7.1
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
-
High 7.5
WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
-
High 7.1
WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
-
High 7.5
WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
-
High 8.1
WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
-
High 7.1
WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
-
High 7.1
WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
-
High 7.1
WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons…
-
High 8.5
WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
-
High 7.1
WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.
-
High 7.1
WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
-
High 7.1
WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
-
High 7.5
WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
-
High 7.7
WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
-
High 7.1
WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
-
High 7.6
WordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerability
Missing Authorization vulnerability in pubjet Pubjet | پابجت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پابجت: from n/a through 5.4.8.
-
High 8.1
WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
-
High 8.1
WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
-
High 8.1
WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
-
High 7.1
WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
-
High 7.1
WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
-
High 7.1
WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme…
-
High 8.2
WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
-
High 7.2
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
-
High 7.5
WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
-
High 7.5
WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through …
-
High 7.2
WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
-
High 7.1
WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from …
-
High 7.5
OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted eng…
-
High 8.8
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoin…
-
High 8.1
cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener …
-
High 7.3
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/r…
-
High 7.5
Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metachar…
-
High 7.1
WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.
-
High 7.2
WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
-
High 7.1
WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.
-
High 8.8
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
-
High 7.1
WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
-
High 7.5
FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled…
-
High 7.5
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory ex…