Export limit exceeded: 341177 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 341177 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (341177 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-48117 | 2025-05-19 | 5.3 Medium | ||
| Missing Authorization vulnerability in kilbot WooCommerce POS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce POS: from n/a through 1.7.8. | ||||
| CVE-2025-48127 | 2025-05-19 | 6.5 Medium | ||
| Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push notification for Mobile and Web app: from n/a through 2.0.3. | ||||
| CVE-2025-48119 | 2025-05-19 | 5.3 Medium | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase allows Code Injection. This issue affects RS WP Book Showcase: from n/a through 6.7.41. | ||||
| CVE-2025-48131 | 2025-05-19 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite allows Stored XSS. This issue affects UltraAddons Elementor Lite: from n/a through 2.0.0. | ||||
| CVE-2025-48120 | 2025-05-19 | 5.3 Medium | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4. | ||||
| CVE-2025-4804 | 2025-05-19 | N/A | ||
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Fireware OS: from 12.0 through 12.11.1. | ||||
| CVE-2024-1958 | 1 Wpb Show Core Project | 1 Wpb Show Core | 2025-05-19 | 4.8 Medium |
| The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users | ||||
| CVE-2024-1956 | 1 Wpb Show Core Project | 1 Wpb Show Core | 2025-05-19 | 6.1 Medium |
| The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting | ||||
| CVE-2024-1292 | 1 Wpb Show Core Project | 1 Wpb Show Core | 2025-05-19 | 4.7 Medium |
| The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||||
| CVE-2024-2016 | 1 Zhicms | 1 Zhicms | 2025-05-19 | 6.3 Medium |
| A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-48902 | 1 Tramyardg | 1 Autoexpress | 2025-05-19 | 9.8 Critical |
| An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php. | ||||
| CVE-2023-48903 | 1 Tramyardg | 1 Autoexpress | 2025-05-19 | 6.1 Medium |
| Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php. | ||||
| CVE-2023-48901 | 1 Tramyardg | 1 Autoexpress | 2025-05-19 | 9.8 Critical |
| A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php. | ||||
| CVE-2024-2015 | 1 Zhicms | 1 Zhicms | 2025-05-19 | 6.3 Medium |
| A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/mcontroller.php. The manipulation of the argument key leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255269 was assigned to this vulnerability. | ||||
| CVE-2024-2568 | 1 Heyewei | 1 Jfinalcms | 2025-05-19 | 4.7 Medium |
| A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071. | ||||
| CVE-2024-26466 | 1 Web-platform-tests | 1 Web-platform-tests | 2025-05-19 | 6.1 Medium |
| A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before commit 938e843 allows attackers to execute arbitrary Javascript via sending a crafted URL. | ||||
| CVE-2024-41693 | 1 Priority-software | 1 Mashov | 2025-05-19 | 6.1 Medium |
| Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | ||||
| CVE-2025-3952 | 1 Projectopia | 1 Projectopia | 2025-05-19 | 8.1 High |
| The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. | ||||
| CVE-2024-13845 | 1 Rocketgenius | 1 Gravity Forms Webhooks | 2025-05-19 | 5.5 Medium |
| The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed' method of the GF_Webhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. | ||||
| CVE-2025-4149 | 1 Netgear | 2 Ex6200, Ex6200 Firmware | 2025-05-19 | 8.8 High |
| A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||