Atomicorp WAF Research Notes
Selected CVE-related research notes documenting testing results, engineering observations, attack-pattern analysis, and WAF rule interactions. These notes are not a CVE coverage matrix, completeness claim, certification list, or list of all vulnerabilities mitigated by Atomicorp products. A published CVE research note documents a positive research finding for that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Last updated: 2026-10-09
| CVE | Vulnerability Name | Product | CVSS | Severity | Rules Observed |
|---|---|---|---|---|---|
| CVE-2026-12260 | SQL injection in the NetBoard CRM demo platform | NetBoard CRM Demo Platform | 10.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85097 | Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter | Bricksforge | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-105110 | Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter | Innbox | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-107780 | Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter | skyeye | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-9209 | mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx | mJobTime | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | skyeye | 9.1 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-17196 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute | Super Forms – Drag & Drop Form Builder | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-107639 | ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename | ILIAS | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-107303 | JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob | generator-jhipster | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107362 | Server-Side Request Forgery in Malcolm | Malcolm | 7.1 (v3.1) | High | 337109 , 337110 , 340813 , 340814 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-71428 | Jivejdon through 5.0 SQL Injection via username in userListAction | jivejdon | 6.9 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102783 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 | Gridbox extension for Joomla | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-107393 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header | freescout | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2026-107797 | Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters | jivejdon | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107799 | Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering | jivejdon | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107800 | Jivejdon through 5.0 Stored XSS via Private Short Messages | jivejdon | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-107449 | Heimdall Server-Side Request Forgery Vulnerability | Heimdall | 3.4 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-62251 | Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query | homer | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89417 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107273 | Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site | gophish | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-106102 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() | quasar | 10.0 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-82531 | Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache | smarty | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105797 | SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport) | simplechat | 8.8 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105985 | Authenticated RCE via render-components Entry Type overrides | cms | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint | dify | 8.3 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-45871 | LogicalDOC Enterprise up to and for 9.1.1 SQL Injection Vulnerability | - | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-4889 | SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies | eLoanApp Platform | 7.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105764 | Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE | immich | 7.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82988 | vCast Improper Authentication Vulnerability | vCast | 7.5 (v3.1) | High | 351000 |
| CVE-2026-96594 | Gitea repository media API stored XSS | Gitea | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105471 | girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection | Online-Appointment-Booking-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105776 | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection | Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105918 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection | Learning-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105919 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection | Learning-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105920 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection | Learning-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-106033 | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | Red Hat Ansible Automation Platform 2 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | Gitea | 4.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105705 | SourceCodester Drug Recommendation System add_drug.php cross site scripting | Drug Recommendation System | 2.1 (v4.0) | Low | 346755 |
| CVE-2026-105708 | imgproxy SVG svg.go sanitizeElement cross site scripting | imgproxy | 2.1 (v4.0) | Low | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105809 | SourceCodester Simple Student Information System Profile Field register.php cross site scripting | Simple Student Information System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105921 | Kusalkasilva Learning-Management-System search_class.php sql injection | Learning-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105957 | SourceCodester Performance Indicator System view_product.php sql injection | Performance Indicator System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105808 | SourceCodester Simple Student Information System searchresults.php clean cross site scripting | Simple Student Information System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105691 | Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color | penpot | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-105697 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | langflow | 9.9 (v3.1) | Critical | 300008 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-105740 | Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server | langflow | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-88393 | WookTeam 1.6.6 and Earlier Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-88395 | GouGuOA 6.0.5 and Earlier SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88424 | FineAdmin v1.0 SQL Injection Vulnerability | FineAdmin v1.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-21589 | Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read | jira,confluence,bitbucket | 9.3 (v4.0) | Critical | 340024 |
| CVE-2026-104977 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebindi | plane | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104973 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery | plane | 7.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | plane | 7.6 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-88392 | Unimall v4 Arbitrary Code Execution Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-88394 | WookTeam 1.6.6 and Earlier Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-95265 | Feehi CMS 2.1.1 Server-Side Request Forgery Vulnerability | Feehi CMS 2.1.1 | 7.5 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-88396 | ApiAdmin 5.0 and Earlier Arbitrary Code Execution Vulnerability | - | 7.2 (v3.1) | High | 351000 |
| CVE-2026-88397 | ApiAdmin 5.0 and Earlier SQL Injection Vulnerability | - | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-95264 | Feehi CMS 2.1.1 Path Traversal Vulnerability | - | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-105689 | Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download | penpot | 6.0 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105743 | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTM | docling | 5.8 (v3.1) | Medium | 390719 |
| CVE-2026-105169 | kishor-23 food-waste-management-system Take Order delivery.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105172 | itsourcecode Online Admission System login1.php sql injection | Online Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105182 | SourceCodester Online Reviewer Management System btn_functions.php update sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105183 | itsourcecode Online Admission System confirm.php sql injection | Online Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105184 | itsourcecode Online Admission System creteria.php sql injection | Online Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105185 | itsourcecode Online Admission System examinee.php sql injection | Online Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105229 | kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105230 | kishor-23 food-waste-management-system deliverymyord.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105231 | kishor-23 food-waste-management-system Admin Registration signup.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105232 | kishor-23 food-waste-management-system Registration deliverysignup.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105246 | SourceCodester Online Reviewer Management System btn_functions.php update sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-105247 | SourceCodester Online Reviewer Management System btn_functions.php course sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-105253 | itsourcecode Online Admission System Project login1.php sql injection | Online Admission System Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105290 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery | feelcrm-os | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-105383 | onetwothreeneth HospitalManagementSystem controller.php sql injection | HospitalManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105384 | UNION HospitalManagementSystem patient_info.php sql injection | HospitalManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105385 | onetwothreeneth HospitalManagementSystem transaction_details.php sql injection | HospitalManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105386 | onetwothreeneth HospitalManagementSystem print.php get sql injection | HospitalManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105468 | girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection | Online-Appointment-Booking-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105469 | girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection | Online-Appointment-Booking-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102295 | Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter | Red Hat Quay 3 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-105694 | Penpot: Stored XSS via Unsanitised SVG Uploads | penpot | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-95166 | In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-105263 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery | Shaarli | 5.1 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-102576 | Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page | Red Hat Quay 3 | 4.2 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105168 | kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection | food-waste-management-system | 2.1 (v4.0) | Low | 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105174 | Gerapy Project Management views.py project_create path traversal | Gerapy | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-105181 | itsourcecode Online Admission System register1.php sql injection | Online Admission System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105186 | itsourcecode Online Admission System new.php sql injection | Online Admission System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105187 | itsourcecode Online Admission System key.php sql injection | Online Admission System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105254 | itsourcecode Online Admission System schoolyear.php sql injection | Online Admission System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105286 | Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal | A3002MU | 2.1 (v4.0) | Low | 344360 , 390709 |
| CVE-2026-105287 | feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection | feelcrm-os | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105288 | feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105291 | feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105329 | TallCMS PluginManager ThemeManager.php code injection | TallCMS | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-105388 | feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection | feelcrm-os | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105389 | feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload | feelcrm-os | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-105438 | O2OA General url ActionUploadExcelWithUrl server-side request forgery | O2OA | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105226 | osCommerce osCommerce2 Newsletter Management newsletters.php include code injection | osCommerce2 | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105289 | feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripti | feelcrm-os | 2.0 (v4.0) | Low | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-105086 | WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105123 | W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API | wcms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-105125 | LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint | laradashboard | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-105148 | SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery | R2R | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105149 | mooSocial all-products sql injection | mooSocial | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105166 | kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105167 | kishor-23 food-waste-management-system donate.php sql injection | food-waste-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105124 | W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments | wcms | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-105128 | LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url | laradashboard | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-105224 | YesWiki before 4.6.7 Stored XSS via Bazar valeur Action | yeswiki | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105146 | Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection | Discuz! | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103913 | GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-96267 | WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter | WP Visitor Statistics (Real Time Traffic) | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101928 | Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override | Magic Tooltips For Contact Form 7 | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-87091 | Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters | Welcart e-Commerce | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103888 | WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter | WPC Smart Quick View for WooCommerce | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-92974 | Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-103421 | WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment | WPMobile.App – Android and iOS App Builder | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page | OpenAM | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-105122 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri | OpenAM | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104983 | Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal | Xreader | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-93698 | cPanel OS Command Injection Vulnerability | cPanel | 9.9 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-51911 | vanna v2.0.2 Code Injection Vulnerability | vanna v2.0.2 | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54405 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token | CVM | 9.3 (v4.0) | Critical | 351000 |
| CVE-2026-15896 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter | Super Forms – Drag & Drop Form Builder | 9.1 (v3.1) | Critical | 340006 , 340748 , 344360 , 347006 , 390709 |
| CVE-2026-93697 | cPanel Arbitrary Code Execution Vulnerability | cPanel | 9.0 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-104462 | YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter | yeswiki | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104464 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter | yeswiki | 8.8 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104851 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution | filesystem spec | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2014-125130 | CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php | CodeArt Google MP3 Audio Player | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-37278 | Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile | e-Bridge | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-104460 | YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch | yeswiki | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82039 | UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter | UTMStack | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103766 | ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter | clipbucket-v5 | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104471 | YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import | yeswiki | 8.6 (v4.0) | High | 351000 |
| CVE-2026-104458 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses | yeswiki | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-104463 | YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox | yeswiki | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-104450 | YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action | yeswiki | 8.2 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-51907 | Path Traversal | - | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92174 | SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter | SiteOrigin Widgets Bundle | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-102626 | LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute | LimeSurvey | 7.2 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93756 | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93875 | JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter | JetAppointment | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-95670 | No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect | No External Links | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-96566 | Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter | Newsletter – Send awesome emails from WordPress | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82045 | UTMStack < 11.2.16 JPQL Injection via searchPropertyValues | UTMStack | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104440 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter | yeswiki | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104441 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action | yeswiki | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104442 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action | yeswiki | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104459 | YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle | yeswiki | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12951 | MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter | MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82044 | UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf | UTMStack | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-84925 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter | Avada | Website Builder For WordPress & WooCommerce | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104123 | SourceCodester Online Reviewer Management System btn_functions.php activity sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104609 | onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection | HospitalManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104637 | onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload | HospitalManagementSystem | 5.5 (v4.0) | Medium | 351000 , 390501 |
| CVE-2026-82040 | UTMStack < 11.2.16 SSRF via IdentityProviderService | UTMStack | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104461 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField | yeswiki | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104465 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler | yeswiki | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104466 | YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute | yeswiki | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-104473 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages | yeswiki | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59659 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59660 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59661 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59663 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59664 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59665 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59666 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59667 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59668 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59669 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-59670 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59672 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59673 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-95662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104052 | itsourcecode Pet Shop Management System admin_reject_completed.php sql injection | Pet Shop Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104606 | itsourcecode Online Admission System Project confirm.php sql injection | Online Admission System Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104613 | CodeAstro Simple Pharmacy Management System view.php sql injection | Simple Pharmacy Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104614 | CodeAstro Simple Pharmacy Management System delete.php sql injection | Simple Pharmacy Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104625 | CodeAstro Simple Loan Management System index.php sql injection | Simple Loan Management System | 2.1 (v4.0) | Low | 340017 , 340145 , 340156 , 340457 , 341245 , 360147 , 360148 , 370016 , 380026 , 380122 , 390572 |
| CVE-2026-51881 | deeptutor 1.4.0 Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-51884 | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 Path Traversal Vulnerability | - | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2026-51886 | Arbitrary Code Execution | - | 9.8 (v3.1) | Critical | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-51882 | The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 Path Traversal Vulnerability | - | 9.1 (v3.1) | Critical | 344360 , 390709 |
| CVE-2026-51883 | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 Path Traversal Vulnerability | - | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-70650 | GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c | GetSimpleCMS-CE | 8.8 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-58388 | Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html | Multiple Multifunction Printers | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54049 | Sakai Conversations has a Stored XSS Issue | sakai | 8.7 (v3.1) | High | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2026-55230 | Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character | Vvveb | 8.7 (v3.1) | High | 333141 , 340095 , 340247 , 340248 , 342259 , 346755 , 350148 |
| CVE-2026-71542 | GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php | GetSimpleCMS-CE | 8.7 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 346755 |
| CVE-2026-103757 | Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation | budibase | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-15983 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter | Super Forms – Drag & Drop Form Builder | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-55232 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy | Vvveb | 7.6 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-51888 | Path Traversal | - | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2026-55231 | Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools | Vvveb | 7.2 (v3.1) | High | 344360 |
| CVE-2026-92144 | Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 7.2 (v3.1) | High | 333140 , 340095 , 342259 |
| CVE-2026-96561 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71426 | GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field | GetSimpleCMS-CE | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-103530 | decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery | 9Router | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-101925 | bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name | bbp style pack | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2026-96268 | Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gd | Awesome Support – WordPress HelpDesk & Support Plugin | 6.4 (v3.1) | Medium | 346755 |
| CVE-2026-89047 | Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL | Social Media Share Buttons & Social Sharing Icons | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103687 | rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist | dom-sanitizer | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55252 | OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect | openrun | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-7173 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7174 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7175 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7176 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-103540 | formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine | Form Tools | 2.1 (v4.0) | Low | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-103541 | formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload | Form Tools | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-103543 | itsourcecode Leave Management System controller.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103690 | itsourcecode Leave Management System controller.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76570 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1 | jc tables | 10.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-51861 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-51866 | Code Injection | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-103056 | AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR | AiSOC | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-51859 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Path Traversal Vulnerability | - | 9.1 (v3.1) | Critical | 344360 , 390709 |
| CVE-2026-51862 | DB-GPT 0.8.0 Path Traversal Vulnerability | - | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-51864 | DB-GPT v0.7.5 and v0.8.0 Path Traversal Vulnerability | - | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-62308 | Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint | tugtainer | 9.1 (v3.1) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2023-54402 | iDocView SSRF via /doc/upload Endpoint Hardcoded Token | iDocView | 8.7 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-54403 | Yonyou U8 CRM Arbitrary File Read via getemaildata.php | U8 CRM | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-58387 | Inspur HCM Cloud Arbitrary File Read via file/download Endpoint | Haiyue HCM Cloud | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-103474 | yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE | yii2-starter-kit | 8.7 (v4.0) | High | 351000 |
| CVE-2026-55094 | Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where) | taskcluster | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-102911 | zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection | pi-llm-wiki | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-46711 | Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly | security | 8.3 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55177 | CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guar | CloudTAK | 7.6 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-51852 | agent-zero 1.7, 1.8, 1.9, and 1.10 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-51853 | agent-zero 1.7, 1.8, 1.9, and 1.10 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | astro | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-102874 | HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection | AnyTool | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-102909 | SourceCodester Online Reviewer Management System btn_functions.php sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102913 | SourceCodester Car Driving School Management System Master.php save_enrollment sql injection | Car Driving School Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103229 | AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection | Restaurant-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103230 | AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection | Restaurant-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103231 | AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection | Restaurant-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103232 | AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection | Restaurant-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-47096 | AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter | HELO Plus | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters | QloApps | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103589 | QloApps through 1.7.0 Reflected XSS via Room Type Editor | QloApps | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103590 | QloApps through 1.7.0 Reflected XSS via Length of Stay Fields | QloApps | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-102906 | 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection | github-mcp-server | 2.1 (v4.0) | Low | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-103114 | OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection | openSIS-Classic | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103115 | OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection | openSIS-Classic | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103116 | OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection | openSIS-Classic | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102912 | SourceCodester Online Leave Management System page reports sql injection | Online Leave Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103113 | OS4ED openSIS-Classic General Information Tab Student.php save action sql injection | openSIS-Classic | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103117 | OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection | openSIS-Classic | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-31026 | Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39117 | AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-79538 | metatool-ai MetaMCP up to and including 2.4.22 Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54400 | Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname | Fumeng Cloud | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102240 | Netcore NAP930 Network Tools CGI network_tools eval os command injection | NAP930 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85520 | Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module | Google Merchant Center Feed | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82804 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin | Apache DolphinScheduler | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2015-20122 | Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp | A6 OA | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101860 | RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management | raspap-webgui | 7.4 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-102570 | ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter | clipbucket-v5 | 7.0 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102616 | risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection | WorkFlow-Engine | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-31027 | Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability | Greek Universities Network (GUnet) Open eClass Platform v.3.15 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53989 | Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint | dockhand | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-101859 | RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection | raspap-webgui | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-102244 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery | SurfSense | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-102366 | mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints | mall4j | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-102264 | mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting | robo-cafe-rms | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-85526 | Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD | LXD | 9.9 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-85185 | Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root | LXD | 9.6 (v3.1) | Critical | 340006 , 390719 |
| CVE-2026-88804 | Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher | Rancher | 9.6 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-101001 | Netcore NBR200V2 Web Management network_tools eval os command injection | NBR200V2 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-101072 | Netcore NR289-GE CGI ap_ip.cgi system os command injection | NR289-GE | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-101075 | Netcore NR289-GE Location Time location_time.cgi system os command injection | NR289-GE | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-101076 | Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection | NR289-GE | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100896 | TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection | N150RT | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-54710 | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) | security-reporting | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-101009 | aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection | BaoTa | 8.5 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-55160 | Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer | stringer | 7.6 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 350147 , 398021 , 398022 |
| CVE-2024-58386 | ZoneMinder 1.37.x Path Traversal via files view | zoneminder | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-101091 | SiYuan before v3.8.4 SQL Injection via Block Query Embed | siyuan | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-55096 | SSRF via DNS-resolution gap in _validate_url_security (file download by URL) | fast-mcp-telegram | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-101898 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | axios | 7.0 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82382 | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter | Apache Roller | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-100893 | Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery | VoceChat Server | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100901 | athlon1600 youtube-downloader stream.php stream server-side request forgery | youtube-downloader | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100909 | OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery | the file modules/system/classes/ResizeImages.php | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-101005 | October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery | October CMS | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-101012 | mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101013 | mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101067 | dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal | dbgate | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-101068 | dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal | dbgate | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-101070 | dbgate Files Endpoint runners.js files path traversal | dbgate | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-101082 | PMWeb downloader.aspx path traversal | PMWeb | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-102333 | httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL | httpdbg | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55156 | Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | token-optimizer-mcp | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-100904 | amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting | mini-inventory-and-sales-management-system | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7171 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium | 310717 , 310718 , 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-7172 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium | 310717 , 310718 , 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-102332 | Dozzle before 11.1.2 Path Traversal via Log ZIP Download | dozzle | 4.6 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-86334 | CLI Path Traversal via Content-Disposition in LXD Image Export/Copy | LXD | 4.2 (v3.1) | Medium | 340006 , 390719 |
| CVE-2026-100887 | amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection | Mini-Inventory-and-Sales-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100894 | mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100898 | DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection | project-management | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101071 | Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload | Unet Web Service | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-101105 | code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection | Matrimonial System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101861 | Langflow Code Execution via eval() in Component Input Schema | langflow | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100900 | DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery | project-management | 2.0 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-101010 | aaPanel BaoTa data.py getData sql injection | BaoTa | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101011 | aaPanel BaoTa Domain domainMod.py get_domain_status sql injection | BaoTa | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101018 | dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection | XunruiCMS | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101141 | Eleveo Call Recording Software Play Audio audio.jsp cross site scripting | Call Recording Software | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-101090 | Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri | nezha | 9.3 (v4.0) | Critical | 344365 |
| CVE-2026-100852 | AzuraCast through 0.23.x Command Injection via Streamer Username | AzuraCast | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100856 | AzuraCast before 0.23.6 Code Injection via Remote Relay Password | AzuraCast | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100864 | heym before 0.0.91 Remote Code Execution via Expression Engine | heym | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100858 | heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes | heym | 7.6 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-96896 | Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request | Malcure Malware Shield — Removal, Repair, Monitor | 7.2 (v3.1) | High | 340014 , 340023 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360029 , 390904 |
| CVE-2026-100849 | AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs | AzuraCast | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100859 | Heym before 0.0.106 Credential Exfiltration via URL Override | heym | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-100875 | mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100861 | heym before 0.0.105 SSRF via credential-controlled base URLs | heym | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-84069 | WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php | WebFacing™ | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-100850 | AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist | AzuraCast | 4.8 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-101046 | Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints | fleet | 2.3 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101061 | utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass | python-utcp | 2.3 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100877 | mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100880 | zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting | StarTraining | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100882 | Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting | laravel-crm | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 |
| CVE-2026-100714 | Froxlor before 2.3.12 Command Injection via letsencryptchallengepath | froxlor | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100720 | Froxlor before 2.3.12 Stored XSS via SSL certificate issuer | froxlor | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100683 | Budibase before 3.45.0 SQL Injection via column-rename DDL | server | 8.9 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100520 | Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint | Laranode | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-100644 | SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath | siyuan | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100682 | Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink | server | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-100645 | SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban | siyuan | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100643 | SiYuan before v3.8.4 Stored XSS via Attribute View textarea | siyuan | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100673 | Grav Data Manager before 1.4.5 Stored XSS via item-detail view | grav-plugin-datamanager | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2026-100601 | ClawHub SSRF via Unchecked DNS Resolution in Profile Image | clawhub | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100696 | Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver | adminer | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-100681 | Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook | server | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100314 | mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100315 | mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100739 | mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100697 | Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver | adminer | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-100521 | Cotonti through 1.0.0 Reflected XSS via search highlight parameter | Cotonti | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-100522 | Cotonti through 1.0.0 Reflected XSS via message.php lng parameter | Cotonti | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100523 | Cotonti through 1.0.0 Open Redirect via message.php redirect parameter | Cotonti | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-100630 | AVideo Stored XSS via HTML Entity Bypass in trailer1 Field | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100312 | mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100313 | mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100382 | Unauthenticated remote code execution through wikitext in ExternalData | Mediawiki - ExternalData Extension | 10.0 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-39353 | InvoicePlane: Remote Code Execution via Writable Templates Directory | InvoicePlane | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-62262 | Piwigo: Unauthenticated SQL injection in pwg.images.filteredSearch.create | Piwigo | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-51457 | D-Link DAP-2610 up to 2.06B08r099 Command Injection Vulnerability | D-Link DAP-2610 up to 2.06B08r099 | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-100391 | MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation | mediaflow-proxy | 8.8 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-61525 | Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller | zammad | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-96795 | Horilla: Authenticated RCE in Horilla List-View Export | horilla-hr | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-100372 | ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php | clipbucket-v5 | 8.6 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-100172 | Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attribute | ail framework | 8.5 (v4.0) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-100176 | Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip | ail framework | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71483 | Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View | horilla-hr | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44642 | Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) | Piwigo | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-51773 | SSRF | - | 8.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-97875 | DNS rebinding vulnerability in rojo serve HTTP API | rojo | 8.1 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-50547 | InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier | InvoicePlane | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67237 | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint | rabbitmq-server | 7.5 (v4.0) | High | 333140 , 333141 , 340099 , 341099 , 342259 , 346755 |
| CVE-2026-42323 | Piwigo: SQL Injection in Batch Manager | Piwigo | 7.2 (v3.1) | High | 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42324 | Piwigo: Second-Order SQL Injection | Piwigo | 7.2 (v3.1) | High | 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93654 | Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter | Premium Packages – Sell Digital Products Securely | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53629 | GLPI - Blind SQL Injection in History Log Filter (LogBleed) | glpi | 7.1 (v4.0) | High | 380026 |
| CVE-2026-97865 | Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization | Open-Web-Analytics | 6.9 (v4.0) | Medium | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-51772 | Server-Side Request Forgery | - | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63432 | Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password | horilla-hr | 6.5 (v3.1) | Medium | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-100190 | Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page | ail framework | 6.3 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78902 | Netgate pfSense 26.03.1-RELEASE Arbitrary Code Execution Vulnerability | Netgate pfSense 26.03.1-RELEASE | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54790 | InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module | InvoicePlane | 6.0 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-97882 | mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-97883 | mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-97885 | mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection | CloudClassroom-PHP-Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSS | Mediawiki - UploadWizard Extension | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-100174 | Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names | ail framework | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100373 | OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass | OpenMetadata | 5.1 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-6082 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-6083 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-6084 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-6085 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-6086 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-6087 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-6088 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-100376 | TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix | Mediawiki - TemplateSandbox Extension | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-85293 | InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms | InvoicePlane | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 340149 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-97886 | mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-97896 | krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting | laravel-crm | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340148 , 350148 |
| CVE-2026-12227 | Visual Composer <= 45.16.0 - Unauthenticated LFI | visualcomposer | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2026-79766 | Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email | Termix | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-77581 | BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass | bentopdf | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56739 | Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint | logto | 8.5 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 344362 , 344370 , 398021 , 398022 |
| CVE-2026-62368 | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | snipe-it | 8.4 (v3.1) | High | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | phpMyFAQ | 8.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-77294 | TREK: Server-Side Request Forgery via User-Configurable LLM Base URL | TREK | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-90959 | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pul | Red Hat Ansible Automation Platform 2 | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79764 | Termix: Authenticated SSRF via /homepage/proxy — No Destination Allowlist | Termix | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79761 | Termix: Command injection in SSH key deployment verification | Termix | 6.6 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-79760 | Termix: Authenticated blind SSRF through notification channel test endpoints | Termix | 6.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-85738 | TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) | TREK | 6.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-96751 | pmTicket Project-Management-Software add_project.php setSync sql injection | Project-Management-Software | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-96803 | java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection | MicroCommunity | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-96898 | yhx070424 ShopXO Ueditor Upload ueditor.php path traversal | ShopXO | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-47132 | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | phpMyFAQ | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | snipe-it | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48540 | Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title | laravel-crm | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-77825 | IBM ContextForge MCP Gateway is affected by path traversal | contextforge | 4.9 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-96773 | Intelliants Subrion CMS Login Page login.php authorize redirect | Subrion CMS | 2.1 (v4.0) | Low | 340162 , 340163 , 344365 |
| CVE-2026-96777 | Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection | LMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-97232 | volotat Anagnorisis page.html start_streaming path traversal | Anagnorisis | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-96810 | huanzi-qch base-admin Add User CommonController.java save cross site scripting | base-admin | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18872 | IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities | financial transaction manager | 9.3 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-96754 | orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path | orval | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-77601 | OpenC3 COSMOS: Authenticated OS command injection via the pypi_url setting | cosmos | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-84683 | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job st | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-96673 | Photoview through 2.4.0 SQL Injection via album download route | Photoview | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76086 | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | formie | 8.5 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5695 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | 8.4 (v4.0) | High | 351000 |
| CVE-2026-77394 | OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget | cosmos | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75887 | Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler | Red Hat OpenShift Container Platform 4.12 | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-91775 | LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings | LimeSurvey | 7.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-96651 | Plex Media Server path traversal | media server | 7.1 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-5696 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | 5.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-96602 | Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection | online-makeup-store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-96652 | Plex Media Server SSRF | media server | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | media server | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63001 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in mediaIsInUse() | core | 4.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-63002 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames | core | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67224 | RabbitMQ: Admin path-traversal write via trace name | rabbitmq-server | 2.1 (v4.0) | Low | 347009 |
| CVE-2026-96678 | weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal | spring-boot-forum | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-88414 | MCMS 6.1.1 through 6.2.1 SQL Injection Vulnerability | MCMS 6.1.1 through 6.2.1 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88416 | MCMS 6.1.1 through 6.2.1 SQL Injection Vulnerability | MCMS 6.1.1 through 6.2.1 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88415 | MCMS 6.1.1 through 6.2.1 Cross-Site Scripting Vulnerability | - | 8.7 (v3.1) | High | 333140 |
| CVE-2026-87902 | WordPress Core - PHP Template Path Traversal | WordPress | 8.1 (v3.1) | High | 340007 |
| CVE-2026-79920 | Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task | ajenti | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67827 | Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58491 | Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter | warpgate | 9.3 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12999 | Eclipse Open VSX Insufficient Verification of Data Authenticity Vulnerability | Eclipse Open VSX | 9.1 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79916 | MaxKB AWS Bedrock model credential injection leads to remote code execution | MaxKB | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55105 | Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer | joplin | 7.7 (v3.1) | High | 333140 |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | drawio | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59814 | Joplin: Stored XSS via inline-served note attachment on published shares | joplin | 7.6 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | envoy | 7.4 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-61647 | @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended va | notebooklm-mcp | 7.1 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-52835 | Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database | Tautulli | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | drawio | 6.8 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-88403 | nocobase v2.1.21 Server-Side Request Forgery Vulnerability | nocobase v2.1.21 | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-36468 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-55473 | HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadat | homebox | 6.0 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-36470 | CuteNews v.2.1.2 Cross-Site Scripting Vulnerability | - | 5.8 (v3.1) | Medium | 333141 , 340003 , 340099 , 340158 , 341099 , 342259 |
| CVE-2026-61852 | Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool | chartbrew | 5.8 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344360 , 344366 , 344370 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94110 | QCMS Content Detail Controllers.php self_Tmp sql injection | QCMS | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54915 | Tautulli: Open redirect via whitespace bypass in /auth/redirect | Tautulli | 5.4 (v3.1) | Medium | 344365 |
| CVE-2026-45381 | Tautulli: Reflected XSS in /search endpoint | Tautulli | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2026-59816 | Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash | joplin | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-77522 | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no inter | MaxKB | 4.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61681 | Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler | hatchet | 4.1 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91165 | Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values | warpgate | 2.4 (v3.1) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94102 | WuzhiCMS Login index.php redirect | WuzhiCMS | 2.1 (v4.0) | Low | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-94214 | ST Engineering iDirect Evolution/Velocity WebServer Evolution Management Service login.html redirect | Evolution | 2.1 (v4.0) | Low | 340165 , 344365 |
| CVE-2026-94216 | ST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Header webserver authorize redirect | Evolution | 2.1 (v4.0) | Low | 340165 , 344365 |
| CVE-2026-94103 | RooCMS Frontend Rendering site_pagePHP.php eval code injection | RooCMS | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-94145 | xuxueli xxl-job Task Management JobInfoController.java cross site scripting | xxl-job | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94426 | xuxueli xxl-job insert cross site scripting | xxl-job | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-94150 | Omega Solution HRM OS SVG File Upload view cross site scripting | HRM OS | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88756 | Pagekit CMS <= 1.0.18 SQL Injection Vulnerability | - | N/A | N/A | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94104 | NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager | nivocart | 8.7 (v4.0) | High | 351000 |
| CVE-2026-93959 | SourceCodester Online Reviewer Management System btn_functions.php sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93972 | SourceCodester Online Reviewer Management System btn_functions.php sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93973 | SourceCodester Online Reviewer Management System btn_functions.php remove sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-93974 | SourceCodester Online Reviewer Management System btn_functions.php remove sql injection | Online Reviewer Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-93978 | code-projects Internship Management System login.php sql injection | Internship Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93979 | code-projects Internship Management System login.php sql injection | Internship Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93980 | code-projects Internship Management System Admin Login Form login.php sql injection | Internship Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93997 | SourceCodester Drug Recommendation System edit_symptom.php sql injection | Drug Recommendation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94015 | SourceCodester Drug Recommendation System edit_user.php sql injection | Drug Recommendation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94038 | NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery | dim-sum-app | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-94039 | vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery | TaxHacker | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-94040 | vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery | TaxHacker | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-94044 | 03-lovepreetSingh MCP route.ts create_file path traversal | MCP | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-93963 | itsourcecode Leave Management System controller.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94028 | mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request fo | Mealie | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-94032 | itsourcecode Leave Management System index.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94035 | SourceCodester Drug Recommendation System index.php cross site scripting | Drug Recommendation System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94041 | AdithyaYelloju Restaurant-Management-System add_menu.php sql injection | Restaurant-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94042 | AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection | Restaurant Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-94046 | 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal | ACE-MCP | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-94049 | 06ketan slideshot renderer.ts render_slides path traversal | slideshot | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-93977 | code-projects Assessment Management add-single-mark.php cross site scripting | Assessment Management | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94033 | SourceCodester Drug Recommendation System User Management add_user cross site scripting | Drug Recommendation System | 2.0 (v4.0) | Low | 346755 |
| CVE-2026-94034 | SourceCodester Drug Recommendation System Password Change change_password cross site scripting | Drug Recommendation System | 2.0 (v4.0) | Low | 346755 |
| CVE-2026-93975 | code-projects Assessment Management User Editing edit-user.php cross site scripting | Assessment Management | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93976 | code-projects Assessment Management add-user.php cross site scripting | Assessment Management | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-94016 | SourceCodester Drug Recommendation System add_symptom cross site scripting | Drug Recommendation System | 1.9 (v4.0) | Low | 346755 |
| CVE-2026-93985 | OpenPanel js-runtime JavaScript Template Sandbox Escape RCE | openpanel | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-4327 | The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_lo | The Welcomizer | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | Estatik Real Estate Plugin | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-93988 | QloApps through 1.7.0 Arbitrary File Read via getEmailHTML | qloapps | 7.1 (v4.0) | High | 344360 |
| CVE-2026-13770 | AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler | AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | 6.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-93983 | OpenPanel SQL Injection via ClickHouse Property Key Filter | openpanel | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93956 | olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting | PHP-FTS | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2025-66455 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/con | lmdeploy | 9.8 (v3.1) | Critical | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2026-75031 | Interchange Arbitrary Code Execution Vulnerability | Interchange | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54399 | Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree | e-HR | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75885 | Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint | Red Hat OpenShift Container Platform 4.12 | 9.3 (v3.1) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-81656 | IBM Guardium Data Protection is affected by multiple vulnerabilities. | guardium data protection | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88622 | NUUO Network Video Recorder 2.0.0 Command Injection Vulnerability | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2017-20284 | Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet | Resin | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-25776 | Weaver E-cology SQL Injection via SyncUserInfo.jsp | E-cology | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-48008 | Chanjet CRM SQL Injection via get_usedspace.php | CRM | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-62278 | LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directo | lubelog | 8.1 (v3.1) | High | 344360 , 390709 |
| CVE-2026-93872 | Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter | Cotonti | 7.7 (v4.0) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-88623 | NUUO Network Video Recorder 2.0.0 Files or Directories Accessible to External Parties Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-81669 | IBM Guardium Data Protection is affected by multiple vulnerabilities. | guardium data protection | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-93591 | SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go | siyuan | 7.2 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63445 | Perses: Unvalidated project parameter enables filesystem path traversal | perses | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-76900 | CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime | CordysCRM | 6.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-17576 | InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key | InfiniteWP Client | 6.5 (v3.1) | Medium | 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-62282 | OpenCVE: Server-Side Request Forgery (SSRF) in notifications | opencve | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-77386 | Kyoo: OIDC login token can be redirected to an attacker-controlled URL | Kyoo | 6.5 (v3.1) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-76899 | CordysCRM: Authenticated SQL injection via sort.name on POST /account-pool/page | CordysCRM | 5.7 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-52745 | CordysCRM: Customer Public Pool Sorting Field SQL Injection | CordysCRM | 5.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93597 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses | arcadedb | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-93871 | Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix | Cotonti | 5.1 (v4.0) | Medium | 344365 |
| CVE-2025-55787 | SQL Injection | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54670 | WeGIA: Unauthenticated Auth Bypass + Local File Inclusion | WeGIA | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-45143 | Chamilo LMS: Student-to-admin stored XSS in private messages via v-html | chamilo-lms | 9.0 (v3.1) | Critical | 333140 |
| CVE-2026-47252 | Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari) | anyquery | 9.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-52483 | OS Command Injection | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-63459 | Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions | vendure | 8.7 (v3.1) | High | 333140 , 333141 |
| CVE-2026-92970 | HUBzero CMS through 2.2.32 Path Traversal via File Upload | hubzero-cms | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-92985 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels | siyuan | 8.6 (v4.0) | High | 333140 , 333141 , 334168 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-92986 | SiYuan before 3.8.4 Cross-Site Scripting via Document Title | siyuan | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54507 | Vvveb oEmbedProxy vulnerable to server-side request forgery | Vvveb | 8.4 (v4.0) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-93292 | SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders | signoz | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93426 | SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names | signoz | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54597 | ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter | itflow | 8.3 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-54253 | TS3 Manager: Reflected XSS via /api/download port parameter steals operator session | ts3-manager | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54354 | MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation | MapServer | 8.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54596 | ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration | itflow | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-53557 | SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution | SQLBot | 7.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54339 | Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover | glean | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54506 | Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field | Vvveb | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 340247 , 340248 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53534 | JabRef CAYW Sublime Text integration permits operating-system command injection | jabref | 7.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-53554 | SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing | SQLBot | 7.3 (v4.0) | High | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-54646 | CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php | v6 | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 380026 , 380122 , 390572 |
| CVE-2026-54647 | CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php | v6 | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92919 | admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename | admin3 | 7.2 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-93014 | RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter | RosarioSIS | 7.1 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-61793 | Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter | og-image | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2021-3030 | Cute Editor for ASP.NET 6.4 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-53556 | SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read | SQLBot | 6.0 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92926 | code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection | Matrimonial System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54613 | Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter | Vvveb | 5.4 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-53555 | Stored XSS via SVG Upload | SQLBot | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54546 | CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard | CloudTAK | 5.0 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-54645 | CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass | v6 | 4.8 (v3.1) | Medium | 333140 , 333141 |
| CVE-2026-92993 | Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection | mayfly-go | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-56563 | Server-Side Request Forgery | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58146 | Unauthorized remote code execution in T-Mobile 5G Box IDU routers | T-Mobile 5G Box IDU | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58147 | Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers | T-Mobile 5G Box IDU | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-92576 | HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool | nanobot | 9.2 (v4.0) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-85731 | oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) | oras-go | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390719 , 393655 |
| CVE-2026-92566 | DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview | datagear | 8.8 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92580 | AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF | AVideo | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 341245 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-92719 | Quickwit through 0.9.0 SSRF via SQS queue_url Parameter | quickwit | 8.7 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92791 | Uber Kraken through 0.1.29 Path Traversal via tag parameter | kraken | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92815 | changedetection.io through 0.60.6 SSRF via browser-step Goto URL | changedetection.io | 8.7 (v4.0) | High | 337109 , 337110 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-92397 | Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection | RG-EW3000GX | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-92398 | Ruijie RG-EW3000GX user_list_note admin os command injection | RG-EW3000GX | 8.5 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-92604 | Scirius through 3.8.0 Arbitrary File Write via PCAP Upload | scirius | 7.2 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-92775 | Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch | Wiki.js | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92804 | Nango through 0.70.4 Server-Side Request Forgery via Configuration | Nango | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | Metabase | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-92380 | WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery | WuzhiCMS | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-92405 | SourceCodester Inventory and Monitoring System index.php sql injection | Inventory and Monitoring System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92406 | SourceCodester Inventory and Monitoring System btn_functions.php add sql injection | Inventory and Monitoring System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92184 | ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery | ag-ui | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92569 | Hippo4j through 1.5.0 SSRF via clientAddress Parameter | hippo4j | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92584 | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-92364 | itsourcecode Leave Management System index.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92526 | itsourcecode Leave Management System index.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-92527 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery | chatwoot | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92418 | ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting | crm | 2.0 (v4.0) | Low | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-61560 | @zereight/mcp-gitlab's unauthenticated arbitrary file read via upload_markdown enables PAT exfiltration and full accou | gitlab-mcp | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-62379 | OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback | OpenAM | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61559 | @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | gitlab-mcp | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-61568 | @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport | gitlab-mcp | 9.6 (v3.1) | Critical | 390719 |
| CVE-2023-54398 | Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet | U8 Cloud | 9.3 (v4.0) | Critical | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2024-58385 | Yonyou U8 CRM SQL Injection via fillbacksettingedit.php | U8 CRM | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89026 | Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate | Issabel Framework | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-89308 | Arbitrary command execution in TrxTimeATTENDANCE | TrxTimeATTENDANCE | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-91931 | Flowise before 3.1.4 Remote Code Execution via Custom MCP npx | Flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-52484 | MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 Arbitrary Code Execution Vulnerability | - | 8.8 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-91771 | Weights & Biases wandb before 0.29.0 Path Traversal via File Download | wandb | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-91935 | Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes | Flowise | 8.7 (v4.0) | High | 310047 , 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-91940 | crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy | crawl4ai | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-91989 | atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py | atomic-agents-stack | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-44203 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) | OpenAM | 8.3 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54549 | Meta Ads MCP: Server-Side Request Forgery (SSRF) in upload_ad_image via Unrestricted image_url Fetch | meta-ads-mcp | 8.3 (v3.1) | High | 334168 , 390719 |
| CVE-2026-91943 | Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy | crawl4ai | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-79425 | CRMEB v6.0.0 Server-Side Request Forgery Vulnerability | CRMEB v6.0.0 | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55864 | GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool | core-geonetwork | 7.8 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76820 | OpenCTI: Synchronizer SSRF: stream fetch has no URL validation | opencti | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-54544 | Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints | fireshare | 7.2 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54077 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users | arcadedb | 7.1 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58485 | mcp-searxng: DNS-resolved Private Hostname SSRF in web_url_read | mcp-searxng | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-58502 | githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow | githubtoplanguages | 7.1 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-91750 | WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects | WeKnora | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host Header | AVideo | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54688 | mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) | mcp-searxng | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-88618 | 1024-lab SmartAdmin v3.30.0 Arbitrary Code Execution Vulnerability | 1024-lab SmartAdmin v3.30.0 | 6.5 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39038 | BharatMLStack up to and including v1.3.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-51133 | za-internet GmbH C-MOR Video Surveillance <= V6.0104 Arbitrary Code Execution Vulnerability | za-internet GmbH C-MOR Video Surveillance <= V6.0104 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-62280 | OpenAM Reflected XSS in the OAuth2/OIDC wap consent page | OpenAM | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55591 | Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints | signalk-server | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-90841 | PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection | Blood Donor Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90843 | SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection | WebMap | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90844 | PHPGurukul Daily Expense Tracker System Login index.php sql injection | Daily Expense Tracker System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90849 | SourceCodester College Notes Gallery Management System login.php sql injection | College Notes Gallery Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90876 | SourceCodester Online Faculty Clearance System delete_requirement.php sql injection | Online Faculty Clearance System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90877 | SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection | Online Faculty Clearance System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90879 | zyx0814 FilePress Publish search.php sql injection | FilePress | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-91004 | SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection | Online Faculty Clearance System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-91848 | WuzhiCMS index.php getDataOfJson sql injection | WuzhiCMS | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39040 | BharatMLStack up to and including 1.3.0 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-32599 | Netmaker has a boolean‑based SQL Injection | netmaker | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via /sessionservice | OpenAM | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-91772 | Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter | halo | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-91922 | Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render | steedos-platform | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-91967 | AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL | AVideo | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91944 | crawl4ai before 0.9.3 DOM-based XSS via Playground UI | crawl4ai | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55374 | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | canto-saas-api | 4.8 (v3.1) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-90857 | SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload | College Notes Gallery Management System | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-91005 | SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted u | Online Faculty Clearance System | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-91849 | WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload | WuzhiCMS | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-91853 | TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection | X5000R | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-91854 | code-projects Record Management System reg.php cross site scripting | Record Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90845 | PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting | Daily Expense Tracker System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90850 | PHPGurukul Hostel Management System manage-students.php cross site scripting | Hostel Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-57124 | PraisonAI UI MCP connect endpoint allows unauthenticated local command execution | PraisonAI | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-57131 | praisonai: Jobs API exposes agent-execution endpoints with no authentication | PraisonAI | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50006 | Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in | anyquery | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390501 , 390709 , 390716 , 390904 , 393655 |
| CVE-2026-55416 | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fiel | pimcore | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82028 | Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API | magistrala | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15600 | SQL Injection in Alior Bank raty PrestaShop module | raty | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90699 | D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection | DWR-M920 | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-57126 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | PraisonAI | 8.5 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-90702 | D-Link DWR-M921 formDiskFormat system os command injection | DWR-M921 | 8.5 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90703 | D-Link DWR-M921 formDiskCreateShare system os command injection | DWR-M921 | 8.5 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34151 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ | xwiki-platform | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54629 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode | anyquery | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-57119 | PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API | PraisonAI | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-57129 | PraisonAI: Arbitrary File Read via @file: Mention Path Traversal | praisonaiagents | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-54150 | next-video: Unauthenticated arbitrary file read via /api/video request handler | next-video | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-91081 | Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint | docs | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53708 | ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (/admin/gateways/test) | mcp-context-forge | 6.6 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12767 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | Langflow OSS | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-91079 | Huly Platform through 0.7.426 SSRF via Print Service | platform | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-51769 | Frappe Cross-Site Scripting Vulnerability | Frappe | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90617 | GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection | PentestAgent | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90619 | 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection | HexStrike AI | 5.5 (v4.0) | Medium | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90690 | 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection | HexStrike AI | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90691 | 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal | HexStrike AI | 5.5 (v4.0) | Medium | 344360 , 390709 |
| CVE-2026-90701 | subhajitkhan online-clinic-management-system listdoctor.php sql injection | online-clinic-management-system | 5.5 (v4.0) | Medium | 340017 |
| CVE-2026-90708 | Yot CMS Cookie global.php login sql injection | CMS | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90789 | itsourcecode Leave Management System login.php sql injection | Leave Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-23176 | MassMessage Cross-Site Scripting Vulnerability | MassMessage | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-91021 | Trillium Notes Cross-Site Scripting Vulnerability | Trillium Notes | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-91199 | Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint | refly | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-90931 | LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload | laradashboard | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38924 | Serena Incorrect Resource Transfer Between Spheres Vulnerability | Serena | 2.9 (v3.1) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-90615 | SourceCodester Class and Exam Timetabling System subject1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |
| CVE-2026-90700 | itsourcecode Sales and Inventory System pro_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90795 | itsourcecode Loan Management System navbar.php cross site scripting | Loan Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-90796 | itsourcecode Leave Management System index.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90814 | cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery | mercury-agent | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-90694 | SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-90695 | SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90696 | SourceCodester Inventory Management System Product Management products_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90705 | D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection | DWR-M921 | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90706 | D-Link DWR-M921 formWsc os command injection | DWR-M921 | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90709 | Yot CMS Admin Console admin.php eval code injection | CMS | 2.0 (v4.0) | Low | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-90788 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection | MacCMS10 | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-90770 | Spug through 3.4.0 Remote Code Execution via ping_check | spug | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90769 | Open Notebook before 1.11.0 Server-Side Request Forgery via link-source | open-notebook | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-90603 | Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload | Open-Generative-AI | 6.9 (v4.0) | Medium | 351000 |
| CVE-2026-36989 | LuxCal Web Calendar SQL Injection Vulnerability | LuxCal Web Calendar | 5.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90514 | SourceCodester School Registration and Fee System save_stud.php sql injection | School Registration and Fee System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90515 | SourceCodester School Registration and Fee System delete_stud.php sql injection | School Registration and Fee System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90516 | SourceCodester School Registration and Fee System pay_report.php sql injection | School Registration and Fee System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90526 | SourceCodester School Registration and Fee System save_class.php sql injection | School Registration and Fee System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90527 | quequnlong shiyi-blog Add Message API index.vue cross site scripting | shiyi-blog | 5.3 (v4.0) | Medium | 333140 |
| CVE-2026-90571 | Exrick xmall Order Printing order-print.jsp cross site scripting | xmall | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90528 | TDuckApp tduck-platform Form Write View index.vue cross site scripting | tduck-platform | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-90529 | DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting | DataEase | 5.1 (v4.0) | Medium | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-90563 | maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting | bbs-springboot | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90564 | quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting | shiyi-blog | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-90567 | quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting | shiyi-blog | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90568 | moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting | Mogu Blog v2 | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90602 | Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting | Open-Generative-AI | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-15875 | LibreNMS SQL Injection Vulnerability | LibreNMS | 5.0 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90569 | linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting | litemall | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90570 | linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting | litemall | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-90575 | PHPGurukul Small CRM Login Success login.php unserialize deserialization | Small CRM | 2.9 (v4.0) | Low | 340014 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 360152 , 390613 , 390614 , 390722 |
| CVE-2026-90488 | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection | xxl-job | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-90500 | lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload | vhr | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-90511 | GongShengyue OnlineBooks listSplit BooksServlet.java sql injection | OnlineBooks | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90525 | itsourcecode Sales and Inventory System cust_pos_trans.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90574 | itsourcecode Sales and Inventory System emp_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90580 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery | flowise | 2.1 (v4.0) | Low | 390719 |
| CVE-2026-90581 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection | nginxWebUI | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-90597 | itsourcecode Sales and Inventory System sup_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90600 | itsourcecode Sales and Inventory System inv_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-90489 | Xuxueli xxl-job insert cross site scripting | xxl-job | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85706 | GitLab Unauthenticated Arbitrary File Read | gitlab | 10.0 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-86793 | SGLang Unsafe Deserialization Vulnerability | SGLang | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8778 | MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload | MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields. | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-72710 | SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection | SPIP | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-89249 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89253 | AVideo Stored XSS via donationLink in watch page button | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89254 | AVideo CustomizeUser Stored XSS via field_name Parameter | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89256 | AVideo Bookmark Plugin Stored XSS via Chapter Names | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89243 | WWBN AVideo Stored XSS via UserGroups setGroup_name | AVideo | 9.2 (v4.0) | Critical | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72708 | SPIP < 4.4.18 Unauthenticated SQL Injection via sitemap annee Parameter | SPIP | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89250 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php | AVideo | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54166 | Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass | shelf.nu | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-89242 | WWBN AVideo Unauthenticated SSRF via login.json.php | AVideo | 6.9 (v4.0) | Medium | 337109 , 337110 , 398022 |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | AVideo | 5.3 (v4.0) | Medium | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 350147 , 380018 |
| CVE-2026-89148 | AVideo Open Redirect via playlistSort.php Referer Header | AVideo | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2025-69904 | Linkstack 4.8.4 and Earlier Path Traversal Vulnerability | - | 4.9 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-38626 | Garlic-Hub v1.0.1 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88062 | OmniRoute < 3.8.49 - Unauthenticated RCE | OmniRoute | 9.5 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 380026 , 393655 |
| CVE-2026-88866 | WWBN AVideo LoginControl Stored XSS via User-Agent Header | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88867 | WWBN AVideo Stored XSS via Category Name and Icon Class | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88868 | AVideo LiveLinks Stored XSS via title and description fields | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84889 | A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbit | langflow | 8.8 (v3.1) | High | 340007 , 344360 , 390709 , 390719 |
| CVE-2026-64837 | ICEcoder through 8.1 OS Command Injection via lib/properties.php | ICEcoder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-64838 | ICEcoder through 8.1 Path Traversal via oldFileName Parameter | ICEcoder | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81213 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-88937 | knowns through 0.33.0 Path Traversal via Template Engine | knowns | 8.6 (v4.0) | High | 344360 , 390709 |
| CVE-2026-88890 | OpenPanel SQL Injection via unvalidated profile filter column identifier | openpanel | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-57231 | Docmost 0.2.1-0.21.0 - Arbitrary File Read | docmost | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-81265 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-88938 | knowns through 0.33.0 Path Traversal via code.find MCP tool | knowns | 7.1 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-88940 | knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint | knowns | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54054 | Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects | transmute | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-88055 | AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator | anything-llm | 5.5 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-36392 | FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88892 | OpenPanel SSRF via Unguarded Importer File URL Fetch | openpanel | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-79723 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | 5.0 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-87926 | Rizwan17 inventory-management-system Login Page index.php cross site scripting | inventory-management-system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-71805 | Path Traversal | - | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-54694 | NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover | skills-service | 9.6 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-76801 | FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation | FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86775 | knowns before 0.30.0 Path Traversal via Document API | knowns | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-87927 | MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher | MaxSite CMS | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-87807 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock | siyuan | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-26212 | Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE | Rara One Click Demo Import | 8.6 (v4.0) | High | 351000 |
| CVE-2026-79322 | mageplaza blog SQL Injection Vulnerability | mageplaza blog | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | siyuan | 8.4 (v4.0) | High | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | siyuan | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86771 | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num | snipe-it | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-18147 | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | Red Hat Enterprise Linux 10 | 8.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13359 | Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown P | Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | 7.2 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-87821 | Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch | laradashboard | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | open webui | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75307 | zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71802 | REBUILD 4.4.3 Cross-Site Scripting Vulnerability | REBUILD 4.4.3 | 5.4 (v3.1) | Medium | 333140 |
| CVE-2026-86756 | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState | snipe-it | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-79387 | PbootCMS versions 3.2.0 through 3.2.5 SQL Injection Vulnerability | PbootCMS versions 3.2.0 through 3.2.5 | 4.3 (v3.1) | Medium | 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79569 | Movie_Recommend v1.0.0 SQL Injection Vulnerability | Movie Recommend v1.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79570 | mfish-nocode-pro v1.0.0 SQL Injection Vulnerability | mfish-nocode-pro v1.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86738 | Snipe-IT before 8.7.0 CSS Injection via Custom CSS | snipe-it | 9.3 (v4.0) | Critical | 333140 , 340095 , 342259 |
| CVE-2026-53581 | ntp: write path traversal | core | 9.0 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-78834 | Code Injection | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61517 | Netis NX10 OS Command Injection via Ping Diagnostic Handler | NX10 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86733 | Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore | snipe-it | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78837 | A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 Vulnerability | - | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86806 | opengeos GeoLibre _is_within_roots server-side request forgery | GeoLibre | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 350591 , 390722 , 398021 , 398022 |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-79573 | L-ONE v1.0.0 was discovered to SQL Injection Vulnerability | - | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86590 | Eclipse Che Server-Side Request Forgery Vulnerability | Eclipse Che | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78738 | Silverpeas Core 6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 340099 , 341099 |
| CVE-2026-78742 | Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86735 | snipe-it before 8.7.0 SSRF via IPv6 transition address bypass | snipe-it | 5.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54611 | InstantCMS has Remote Code Execution in package installer | icms2 | 5.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-86666 | aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload | iWebShop-5 | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48707 | InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning | icms2 | 3.1 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86517 | itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86518 | code-projects Student Crud Operation edit.php sql injection | Student Crud Operation | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86668 | aircheng-org iWebShop-5 pic.php uploadFile cross site scripting | iWebShop-5 | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86675 | itsourcecode Sales and Inventory System us_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86644 | star7th showdoc API Page Save Endpoint editormd.js cross site scripting | showdoc | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86667 | aircheng-org iWebShop-5 member.php member_list sql injection | iWebShop-5 | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86542 | knowns before 0.30.0 Path Traversal via Import Name | knowns | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-86538 | knowns before 0.30.0 Path Traversal via templateFile parameter | knowns | 8.7 (v4.0) | High | 344360 , 390709 |
| CVE-2026-86299 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection | RE7000 | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86437 | Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload | laradashboard | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-86438 | Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action | laradashboard | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86539 | knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint | knowns | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86237 | openagents-org openagents http.py test_default_model server-side request forgery | openagents | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86239 | liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload | FeehiCMS | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-86268 | itsourcecode School Management System User_Login.php sql injection | School Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86273 | projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery | siga | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86290 | SourceCodester Online Voting System ajax.php save_category sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86298 | SourceCodester Class and Exam Timetabling System delete_subject.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86305 | light0011 cms Upload.class.php upload unrestricted upload | cms | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-86233 | itsourcecode Sales and Inventory System us_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86234 | itsourcecode Sales and Inventory System cust_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86235 | itsourcecode Sales and Inventory System pos_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86236 | itsourcecode Sales and Inventory System pro_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86244 | FastAdmin User Controller User.php login cross site scripting | FastAdmin | 2.1 (v4.0) | Low | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86245 | itsourcecode Sales and Inventory System sup_transac.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86265 | itsourcecode Sales and Inventory System us_transac.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86267 | itsourcecode Information System Society Membership System check_student.php sql injection | Information System Society Membership System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86269 | itsourcecode Sales and Inventory System emp_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86270 | itsourcecode Sales and Inventory System settings_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86278 | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting | Syllabus-Aligned Learning Management & Examination System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-86291 | itsourcecode Sales and Inventory System us_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86294 | SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting | Simple Traffic Offense System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-86309 | itsourcecode Sales and Inventory System pro_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86310 | itsourcecode Sales and Inventory System cust_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86240 | liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery | FeehiCMS | 2.0 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86259 | OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation | OpenMAIC | 9.0 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-86159 | SourceCodester Online Voting System ajax.php save_user sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86160 | SourceCodester Online Voting System ajax.php delete_voting sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86161 | SourceCodester Online Voting System ajax.php delete_category sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86162 | SourceCodester Online Voting System ajax.php login sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-86168 | code-projects Content Management System login.php sql injection | Content Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86180 | code-projects Task Management System In PHP Login index.php sql injection | Task Management System In PHP | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86208 | SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86209 | SourceCodester Class and Exam Timetabling System delete_user.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86210 | SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86211 | rabindralamsal inventory-management-system Login index.php sql injection | inventory-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86213 | Mstfakts College-Management-System Search university.php mysqli_query sql injection | College-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86220 | SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86221 | SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86222 | SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86223 | SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86224 | SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86225 | SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86205 | h3 before 2.0.1-rc.18 Open Redirect via redirectBack() | h3 | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-86256 | wger before 2.6 Open Redirect via trainer-login next parameter | wger | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-86163 | itsourcecode Sales and Inventory System pro_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86164 | itsourcecode Sales and Inventory System trans_view.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86170 | DefaultFuction CRM edit.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86171 | DefaultFuction CRM delete.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86172 | DefaultFuction CRM delete.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86232 | itsourcecode Sales and Inventory System sup_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86181 | code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting | Task Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-83627 | Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via | Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-86123 | SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints | sqlchat | 9.4 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86189 | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php | AVideo | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-86119 | Webstudio through 0.296.0 SSRF via /cgi proxy routes | webstudio | 9.2 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-52775 | YesWiki Authenticated SQL Injection in ReactionManager | yeswiki | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67281 | Unauthenticated file read in Mikrotik RouterOS | routeros | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-52769 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId | yeswiki | 8.3 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-52771 | YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (ApiController::deletePage) | yeswiki | 8.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86207 | N-able N-central - Authentication Bypass | N-central | 7.7 (v4.0) | High | 344365 |
| CVE-2026-52770 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki | yeswiki | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-83625 | Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header | Contact Form by Supsystic | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86206 | N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing | N-central | 6.9 (v4.0) | Medium | 344365 |
| CVE-2026-18843 | Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview P | Beaver Builder Plugin (Starter Version) | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 |
| CVE-2026-52773 | YesWiki Archived Revision - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 340148 |
| CVE-2026-52774 | YesWiki Bazar Widget - Reflected XSS via 'id' Parameter | yeswiki | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67066 | oasys sysoa version 1.0 Arbitrary Code Execution Vulnerability | oasys sysoa version 1.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-50894 | easyadmin v2.0.2.2 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-44402 | Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi | SNMP Web Pro | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85688 | TEN Framework - Arbitrary File Read & Write | ten-framework | 9.3 (v4.0) | Critical | 344360 , 390709 |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker | openpanel | 9.2 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-79423 | seacms v13.6 Arbitrary Code Execution Vulnerability | seacms v13.6 | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53758 | Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized | emlog | 8.7 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85604 | Grav before 2.0.19 Remote Code Execution via sort filter | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85608 | Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter | Douyin TikTok Download API | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85610 | OpenPanel before 2.3.0 Remote Code Execution via chart formulas | openpanel | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints | openpanel | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85666 | ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url | ogx | 8.7 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85673 | LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding | LlamaFactory | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85685 | AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill | agentscope | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85691 | MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url | megaparse | 8.7 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-50553 | Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) | note-mark | 8.6 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19303 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing c | langflow | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63464 | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allow_private | nebula-mesh | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-61686 | SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop | SolidInvoice | 7.5 (v3.1) | High | 340014 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53757 | Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE | emlog | 6.9 (v4.0) | Medium | 344360 |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-74235 | GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler | GFI Exinda AI | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint | openpanel | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85662 | Marqo 2.26.0 Server-Side Request Forgery via Media URLs | marqo | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-14470 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9138 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing c | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-75170 | the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability | the HubCore platform (version 14.1.1) | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85379 | light0011 cms Query Builder ChapterController.class.php searchChapter sql injection | cms | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85380 | light0011 cms UEditor controller.php catchimage server-side request forgery | cms | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85397 | code-projects Hospital Information System addReq.php findBySearch sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85398 | code-projects Hospital Information System viewReq.php viewReq sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85399 | code-projects Hospital Information System PrespController.php getSinglePresp sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85402 | code-projects Doctor Appointment System booking.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85403 | code-projects Doctor Appointment System contactus.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85512 | SourceCodester Class and Exam Timetabling System session.php authorization | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85516 | code-projects Vehicle Management System busprofile.php sql injection | Vehicle Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-35497 | TM4WEB Cross-Site Scripting Vulnerability | TM4WEB | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17621 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 5.4 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-78849 | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-85650 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel | trigger.dev | 5.3 (v4.0) | Medium | 334168 , 337109 , 337110 , 344360 , 390719 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85676 | Dub Open Redirect via Unrestricted redir_url Parameter | dub | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-85601 | Grav Admin before 2.0.20 Cross-Site Scripting via marked.js | grav | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-85382 | light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting | cms | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-85383 | itsourcecode Sales and Inventory System inv_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85643 | code-projects Online Shopping System adduser.php mysqli_query sql injection | Online Shopping System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82526 | R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint | R2R | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-58400 | GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter | core-geonetwork | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85199 | Eclipse aeriOS Path Traversal Vulnerability | Eclipse aeriOS | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-82527 | R2R 3.6.6 SQL Injection via Retrieval Search Filter Key | R2R | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85155 | WWBN AVideo SQL Injection via get.json.php APIName channels | AVideo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85223 | D-Link DNS-340L CGI dropbox.cgi os command injection | DNS-340L | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85222 | D-Link DNS-340L Add-On Center addon_center.cgi os command injection | DNS-340L | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-85224 | D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | DNS-320 ShareCenter | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85160 | AVideo through c91b5975d CSRF and Path Traversal via stopLive.php | AVideo | 7.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-53728 | Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage | medplum | 7.1 (v3.1) | High | 340162 , 340163 , 344365 |
| CVE-2026-85163 | AVideo Server-Side Request Forgery via epg_link parameter | AVideo | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | AVideo | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-75602 | OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool | OpenList | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-85137 | SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection | SeaCMS | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85138 | SeaCMS WeChat index.php addslashes sql injection | SeaCMS | 5.5 (v4.0) | Medium | 340156 |
| CVE-2026-85187 | itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85208 | itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-85225 | code-projects Doctor Appointment System patient_login.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85205 | itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection | Online Medicine Delivery System | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56126 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56127 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-56128 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85186 | itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload | Online Medicine Delivery System | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85040 | ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection | CRMEB | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85207 | itsourcecode Online Medicine Delivery System index.php cross site scripting | Online Medicine Delivery System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9314 | Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload | The Developer Tools WordPress plugin through 1.1.3 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-53649 | Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE | joro | 9.6 (v3.1) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14357 | DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Ex | DevKit Pro | 8.8 (v3.1) | High | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 |
| CVE-2026-79756 | Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform | nuclio | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82524 | UnoPim File Upload RCE via TinyMCE Image Upload Endpoint | unopim | 8.6 (v4.0) | High | 351000 |
| CVE-2026-84803 | SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist | siyuan | 8.6 (v4.0) | High | 333140 , 333141 |
| CVE-2026-52831 | Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE | nuclio | 8.0 (v3.1) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 |
| CVE-2026-79755 | Nuclio: Unauthenticated OS command injection via function namespace in docker ps –filter label (local Docker platform) | nuclio | 8.0 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75528 | Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log | Broken Link Checker | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-55421 | Open edX Platform: SSRF in Studio Video Download Endpoint | openedx-platform | 6.8 (v3.1) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-10821 | Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE | Yoast SEO Premium | 6.6 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-84441 | Piwigo Image Derivative i.php path traversal | Piwigo | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-84175 | Eclipse Ditto Uncontrolled Recursion Vulnerability | Eclipse Ditto | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-52832 | Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container | nuclio | 4.9 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-53683 | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html | Red Hat Enterprise Linux 10 | 4.3 (v3.1) | Medium | 340163 , 344365 |
| CVE-2023-3360 | Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection | Weaver Show Posts | 3.3 (v3.1) | Low | 340014 , 340023 , 344362 , 344363 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-84437 | OpenCart Autocomplete Workflow address.php cross site scripting | OpenCart | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 340247 , 340248 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-83548 | SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution | sma8200v | 10.0 (v3.1) | Critical | 330925 |
| CVE-2026-84372 | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | predis | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390722 , 393655 |
| CVE-2026-84189 | LibreNMS before 26.7.0 Stored XSS via Oxidized API | librenms | 9.2 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-84208 | AVideo User_Location Plugin Unauthenticated SQL Injection | AVideo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84194 | LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname | librenms | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-84196 | Kyverno before 1.18.0 Server-Side Request Forgery via apiCall | kyverno | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-83549 | SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution | sma8200v | 7.8 (v3.1) | High | 330925 |
| CVE-2026-19914 | Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter | Welcart e-Commerce | 7.2 (v3.1) | High | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-84199 | Kyverno before 1.16.2 SSRF via APICall Feature | kyverno | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-8712 | Wyoming < 1.10.2 SSRF via uri Query Parameter | wyoming | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-13203 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium | 333140 , 340087 , 340095 , 340099 , 340147 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-16786 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output S | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-16788 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Short | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-18488 | Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy | Blocksy Companion | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84111 | Chanjet CRM jxf_dump_table.php sql injection | CRM | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84191 | LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields | librenms | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84207 | Heym before 0.0.98 SSRF via WebSocket endpoints | heym | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-84477 | AVideo Stored XSS via Live Schedule Title Description | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-77823 | LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 4.9 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-83744 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery | Invoice Ninja | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-84109 | Xinhu Rainrock RockOA webmainAction.php getOrder sql injection | Rainrock RockOA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84153 | Xinhu Rainrock RockOA index.php toaddval sql injection | Rainrock RockOA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79408 | MetaGPT 0.8.1 Command Injection Vulnerability | MetaGPT 0.8.1 | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-59111 | Command Injection vulnerability in eObčanka-Identifikace | eObčanka-Identifikace | 9.3 (v3.1) | Critical | 340014 , 347009 , 393655 |
| CVE-2026-51152 | Server-Side Request Forgery | - | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-77956 | EEx template evaluation of prompt content in AshAi enables remote code execution | ash ai | 8.9 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-82866 | @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch | common | 8.9 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82217 | Eclipse Theia Path Traversal Vulnerability | Eclipse Theia | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback | elFinder | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82692 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | DNS-340L | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | Wallos | 8.5 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82690 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | DNS-327L | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-82691 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | DNS-320L | 8.5 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-77850 | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | ash admin | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-82673 | Path traversal in AshAdmin file uploads via unsanitized client filename | ash admin | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port | Wallos | 8.2 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | 8.2 (v3.1) | High | 337109 , 337110 , 340790 , 340791 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-53553 | Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise | goploy | 7.7 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | mcphub | 7.6 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-79407 | the SPO extension of MetaGPT 0.8.1 Path Traversal Vulnerability | the SPO extension of MetaGPT 0.8.1 | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2026-75132 | WAPT Server SQL Injection via /api/v3/hosts Endpoint | WAPT | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79747 | MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy | mcphub | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82877 | ILIAS before 9.22 Arbitrary File Read via SOAP addFile | ILIAS | 7.1 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75592 | Kirby: Access to image files outside of the site root via path traversal in the media handling | kirby | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79743 | MCPHub: Path Traversal via Malicious MCPB Manifest Name | mcphub | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82598 | SeaCMS Template search.php parseIf code injection | SeaCMS | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82600 | SeaCMS zyapi.php sql injection | SeaCMS | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82610 | itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82611 | itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82612 | itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82613 | itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82614 | itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82615 | itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82630 | PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery | PowerJob | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82701 | code-projects Online Shopping System Search Functionality action.php sql injection | Online Shopping System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82801 | NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82802 | NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) | Wallos | 4.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings | Wallos | 3.5 (v3.1) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82599 | SeaCMS Avatar Upload member.php unlink path traversal | SeaCMS | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-82603 | SeaCMS Comment Cache member.php del_pl path traversal | SeaCMS | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82609 | itsourcecode Sales and Inventory System inv_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82625 | code-projects Simple Inventory System User Registration register.php cross site scripting | Simple Inventory System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82679 | diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload | diem | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-82696 | itsourcecode Sales and Inventory System inv_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82700 | code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-82905 | sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery | chats | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82622 | code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting | Employee Leave Managing System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-82629 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload | jeewx-boot | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82678 | diem-project diem Administrative Console actions.class.php executeCommand os command injection | diem | 2.0 (v4.0) | Low | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-82702 | Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection | BR-6214K | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82703 | Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection | BR-6214K | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82638 | jina-ai reader Server-Side Request Forgery via disabled private-address guard | reader | 8.7 (v4.0) | High | 344360 , 347009 , 390719 , 390722 , 398001 , 398021 |
| CVE-2026-82655 | Admidio before 5.0.12 SQL Injection via relation_type_list | admidio | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82650 | SiYuan before v3.8.1 Path Traversal via /api/template/render | siyuan | 5.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82484 | itsourcecode Sales and Inventory System emp_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82485 | itsourcecode Sales and Inventory System pro_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82540 | itsourcecode Sales and Inventory System cust_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82541 | itsourcecode Sales and Inventory System sup_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82545 | itsourcecode Sales and Inventory System sup_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82656 | Admidio before 5.0.12 Path Traversal via Photo ZIP Download | admidio | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-82483 | coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting | Coppermine Photo Gallery | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82488 | Beetel 450TC3 User Management cross site scripting | 450TC3 | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16061 | Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name} | Rest Routes | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82451 | Formwork through 2.3.14 Stored XSS via Referer Header | Formwork | 5.3 (v4.0) | Medium | 333140 , 333141 , 340003 , 340087 , 340095 , 340099 , 340147 , 340158 , 341099 , 341266 , 342259 |
| CVE-2026-82421 | itsourcecode Sales and Inventory System emp_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82422 | itsourcecode Sales and Inventory System emp_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82424 | PHPGurukul Student Information System student_edit1.php sql injection | Student Information System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54745 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENAB | pipelines | 10.0 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-55565 | Yamcs: Authenticated remote code execution via unescaped StreamSQL LIKE pattern compiled by Janino (LikeExpression) | yamcs | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55634 | Pimcore: Remote Code Execution via DataObject Class-Definition Field Name | pimcore | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55559 | Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) | yamcs | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75337 | Yu AI Code Mother v4.3 is vulnerable to path traversal Vulnerability | Yu AI Code Mother v4.3 is vulnerable to path traversal | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82329 | JFrog Artifactory Access Blank Join Key Authentication Bypass | artifactory | 9.8 (v3.1) | Critical | 300022 |
| CVE-2026-82078 | PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078) | papercut mf | 9.4 (v4.0) | Critical | 340145 , 340155 , 340156 , 341145 , 341245 , 344370 |
| CVE-2026-82244 | Budibase before 3.41.3 Remote Code Execution via Plugin eval() | server | 9.4 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-55511 | Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs executeSql | yamcs | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-18729 | Langflow AI Custom Component Authenticated RCE | langflow | 8.8 (v3.1) | High | 330791 , 340095 , 340152 , 344361 , 344363 |
| CVE-2026-55509 | WsgiDAV: Blind SQL injection in the MySQL provider | wsgidav | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81578 | PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078) | papercut mf | 8.8 (v4.0) | High | 340145 , 340155 , 340156 , 341145 , 341245 , 344370 |
| CVE-2026-82286 | gpt-crawler Arbitrary File Write via outputFileName Parameter | gpt-crawler | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-55245 | Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL | bifrost | 8.7 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-76060 | OS Command Injection in PayRange API | Zoneminder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82270 | Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* | gateway | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82278 | BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once | bisheng | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75121 | PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75122 | PLANET GS-4210-16P2S Command Injection via httpuploadcert.cgi | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75123 | PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-82243 | Budibase Server before 3.41.3 SSRF with Credential Leakage | server | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82262 | Logto Server-Side Request Forgery via webhook test endpoint | logto | 8.2 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-54083 | Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion | wazuh | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-18983 | One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file | One User Avatar | User Profile Picture | 7.5 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55552 | Yamcs <=5.11.12 - Arbitrary File Read | yamcs | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5934 | WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpo | WP Rocket | 7.2 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-77939 | Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint | flextype | 7.1 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | server | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82246 | Budibase Server before 3.41.3 SSRF via Query Import | server | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-82233 | SiYuan before v3.8.1 Path Traversal via asset.upload | siyuan | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-55549 | Yamcs <=5.8.6 - Cross-Site Scripting | yamcs | 6.5 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82081 | wallabag Server-Side Request Forgery Vulnerability | wallabag | 6.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-4246 | ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter | ElementsKit Pro | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38725 | xipblog module 2.0.1 and Earlier for PrestaShop Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 346755 |
| CVE-2026-82274 | Twenty Open Redirect via OAuth Propagator Callback | twenty | 5.3 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-82112 | houtini-ai houtini-lm code_task_files index.ts path traversal | houtini-lm | 5.1 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55834 | Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none | pocket-id | 4.3 (v3.1) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-81845 | arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal | mcp-sequential-thinking | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-81835 | RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection | Roo-Code | 2.0 (v4.0) | Low | 340014 , 344360 , 347009 , 393655 |
| CVE-2026-81847 | MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal | MaaMCP | 2.0 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-81735 | UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi | UI-TARS-desktop | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-81672 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81673 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81674 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81675 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57499 | Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE) | core | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-26899 | OS Command Injection | - | 8.8 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81676 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81677 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81730 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename | dolibarr erp/crm | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-81093 | Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton | actors-mcp-server | 8.7 (v4.0) | High | 340162 , 340165 , 347009 , 390722 |
| CVE-2026-81728 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys | dolibarr erp/crm | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-53580 | Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature | Trilium | 8.1 (v3.1) | High | 340007 , 347009 |
| CVE-2026-40526 | Volmarg Personal Management System Path Traversal via get-file Endpoint | personal-management-system | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | AVideo | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79653 | Eclipse SW360 Path Traversal Vulnerability | Eclipse SW360 | 6.0 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81421 | ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery | sentry-selfhosted-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-81486 | bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal | mcp-file-context-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81491 | boxpositron with-context-mcp index.ts project_folder path traversal | with-context-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81931 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting | Prospero Flow CRM | 4.8 (v4.0) | Medium | 351000 |
| CVE-2026-18080 | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-60004 | Gitea <= 1.27.0 - Pre-Auth Remote Code Execution | gitea | 9.8 (v3.1) | Critical | 330907 , 330908 , 330909 |
| CVE-2026-68000 | MCMS <=6.2.0 is vulnerable to SQL injection Vulnerability | MCMS <=6.2.0 is vulnerable to SQL injection | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75327 | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java Arbitrary File Upload Vulnerability | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-75330 | super-diamond-server <= 1.3.3 is vulnerable to SQL injection Vulnerability | super-diamond-server <= 1.3.3 is vulnerable to SQL injection | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75336 | Funiture 1.0.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340145 , 380122 |
| CVE-2026-75411 | JeecgBoot v3.9.2 Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75414 | In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75332 | Zyplayer-Doc <=1.0.0 Server-Side Request Forgery Vulnerability | - | 9.1 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2020-15874 | Command Injection | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2020-15876 | SQL Injection | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-15878 | SQL Injection | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 393655 |
| CVE-2026-47665 | Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML | penpot | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55182 | LibreNMS: Remote Code Execution by Signal Alert Transportation Module | librenms | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-80214 | LibreNMS Virtualisation Discovery Module RCE | librenms | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-81029 | OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI | OpenMetadata | 8.5 (v4.0) | High | 344365 |
| CVE-2026-81036 | Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri | stalwart | 8.5 (v4.0) | High | 344365 |
| CVE-2026-15973 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries | LimeSurvey | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36851 | UnPoller 2.33.0 password field Path Traversal Vulnerability | UnPoller 2.33.0 password field | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-75328 | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java Path Traversal Vulnerability | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75333 | yx-image-recognition v1.0 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16809 | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering | LimeSurvey | 7.2 (v4.0) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-80350 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL | OneUptime | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-81030 | Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint | mage-ai | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-80426 | FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description | fiftyone | 7.0 (v4.0) | High | 333140 , 333141 |
| CVE-2026-5092 | Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI | Greenshift – animation and page builder blocks | 6.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-39275 | Cockpit CMS v.2.13.5 and before Arbitrary Code Execution Vulnerability | Cockpit CMS v.2.13.5 and before | 6.1 (v3.1) | Medium | 340099 , 341099 |
| CVE-2026-81203 | SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-80200 | Kimai before 2.53.0 Open Redirect via RelayState | kimai | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-65930 | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields | LimeSurvey | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-75331 | tamguo 1.5.3 Cross-Site Scripting Vulnerability | - | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-45018 | Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution | chainlit | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-80104 | DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename | DB-GPT | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-80138 | ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter | clipbucket-v5 | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55585 | QWED: Authenticated Remote Code Execution via Unsafe SymPy parse_expr() | qwed-verification | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-79662 | Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass | Ech0 | 8.8 (v4.0) | High | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-57863 | Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint | crater | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-62865 | TypeBot: Arbitrary server file read via Send Email block attachment path | typebot.io | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75574 | Grav before 4.2.2 Remote Code Execution via Email Twig | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-56703 | Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO | adminer | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-79659 | Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo | Ech0 | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-34968 | Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop | adminer | 7.2 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-45019 | Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access | chainlit | 7.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55537 | PraisonAI: Webhook SSRF via DNS fail-open in JobSubmitRequest.validate_webhook_url() — bypass of CVE-2026-40114 | PraisonAI | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56702 | Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload | adminer | 7.1 (v4.0) | High | 351000 |
| CVE-2026-72695 | Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile | grav | 7.1 (v4.0) | High | 344360 |
| CVE-2026-79788 | Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address | dradis-ce | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-79786 | Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration | coroot | 7.0 (v4.0) | High | 344365 |
| CVE-2026-34964 | Adminer before 5.5.0 SSRF via PDO DSN Injection | adminer | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79773 | Winter CMS before 1.2.13 Local File Inclusion via JavaScript | winter | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79781 | rclone serve s3 Path Traversal via dot-dot object keys | rclone | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-14280 | Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys | Events Manager – Calendar, Bookings, Tickets, and more! | 6.6 (v3.1) | Medium | 340748 , 344360 , 347006 |
| CVE-2026-79717 | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction | Red Hat Ansible Automation Platform 2 | 6.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78886 | liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal | TREK | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-79804 | SililaWijesinghe Food Ordering System search.php sql injection | Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79845 | code-projects Simple Inventory System edit.php sql injection | Simple Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-38467 | the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 SQL Injection Vulnerability | the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34959 | Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix | adminer | 5.3 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-34967 | Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write | adminer | 5.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55419 | Reachy Mini: Unrestricted Upload of File with Dangerous Type | reachy mini | 5.3 (v3.1) | Medium | 351000 |
| CVE-2026-78864 | liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection | TREK | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79671 | Ech0 before 4.4.3 SSRF via DNS Resolution Bypass | Ech0 | 5.1 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26211 | Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field | Ekushey Project Manager CRM | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-79663 | Ech0 before 4.7.3 Stored XSS via RSS feed tag names | Ech0 | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-79670 | Ech0 before 4.4.3 Stored XSS via SVG Upload | Ech0 | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38468 | the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 SQL Injection Vulnerability | the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 4.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16434 | Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass | adminer | 2.3 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78656 | itsourcecode Sales and Inventory System cust_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71921 | DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi | VigorSwitch G2540xs | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-76070 | Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter | NC63 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76071 | Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter | NC63 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76842 | Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients | mercadopago | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-76836 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | AzuraCast | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-78416 | Authenticated RCE via condition.config JSON cleanse bypass | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71906 | DrayTek VigorAP Multiple Models OS Command Injection via setLan | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71907 | DrayTek VigorAP Multiple Models OS Command Injection via setcamset | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71908 | DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71913 | DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71915 | DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71918 | DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71919 | DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-71923 | DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71924 | DrayTek VigorSwitch Multiple Models OS Command Injection via getVid | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71925 | DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71926 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71927 | DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71928 | DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71929 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71930 | DrayTek VigorSwitch Multiple Models OS Command Injection via setTime | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71931 | DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71943 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76844 | webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath | zlib | 8.3 (v4.0) | High | 347009 |
| CVE-2026-71932 | DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile | VigorSwitch G2540xs | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-30983 | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-78171 | itsourcecode Sales and Inventory System processlogin.php sql injection | Sales and Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78197 | SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-78198 | SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-78199 | SourceCodester Simple Online Food Ordering System view_prod.php sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78201 | itsourcecode Payroll System admin_class.php login sql injection | Payroll System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78202 | itsourcecode Payroll System admin_class.php save_settings unrestricted upload | Payroll System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-78244 | itsourcecode Real Estate Management System search.php sql injection | Real Estate Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78245 | itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload | Online Pharmacy System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-78246 | itsourcecode Online Clinic Management System Admin Login login.php sql injection | Online Clinic Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78247 | SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-78248 | SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-76837 | Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name | Baserow | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78337 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG | Prospero Flow CRM | 4.8 (v4.0) | Medium | 351000 |
| CVE-2026-78166 | provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection | kafka-ui | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-78185 | itsourcecode Sales and Inventory System cust_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78200 | itsourcecode Library Management System editbooks.php sql injection | Library Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78435 | Faveo Helpdesk Logo SettingsController.php unlink path traversal | Helpdesk | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78143 | code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection | Barangay Resident Profiling Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78056 | sambitraj Student-Management-System Dashboard sql injection | Student-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78057 | sambitraj Student-Management-System Management Mutation sql injection | Student-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78059 | SourceCodester Stock Management System printOrder.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78060 | SourceCodester Stock Management System getOrderReport.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78112 | itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection | Hospital Management System Project in PHP | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78140 | Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine | UJCMS | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | siyuan | 6.9 (v4.0) | Medium | 337109 , 347009 , 390722 |
| CVE-2026-77806 | SPIP < 4.4.22 - Unauthenticated RCE | SPIP | 9.8 (v3.1) | Critical | 380018 , 380026 |
| CVE-2026-77086 | SiYuan before v3.7.4 Path Traversal via packageName | siyuan | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-49849 | xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution | xshop | 9.1 (v3.1) | Critical | 351000 |
| CVE-2026-62674 | Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE | omnigent | 9.0 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-62675 | Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools | omnigent | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62677 | Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUN | omnigent | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-75933 | Jet Admin Stored XSS | Jet Admin | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-22681 | OpenViking < 0.3.4 SSRF via /api/v1/resources | OpenViking | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48105 | Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path | arc | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-63135 | YOURLS: Stored XSS in referrer statistics chart via crafted Referer header | YOURLS | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-64679 | Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation | atlantis | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-77775 | Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation | Headroom | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47735 | Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks | arc | 7.1 (v4.0) | High | 340007 , 344360 , 390709 , 390719 |
| CVE-2026-54134 | OctoPrint: File exfiltration possible via query parameters on upload endpoints | OctoPrint | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55185 | Miniflux 2: Open Redirect Bypass | v2 | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-53468 | Typemill has Stored HTML Attribute Injection in Metadata Fields | typemill | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-77681 | CodeAstro Online Job Portal update-profile.php unrestricted upload | Online Job Portal | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-18482 | neo-mjs Command Injection Vulnerability | neo-mjs | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-77647 | SPIP X-Spip-Filtre Unauthenticated RCE | SPIP | 9.8 (v3.1) | Critical | 390722 |
| CVE-2026-19586 | Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways | er7212pc firmware | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53804 | OTRS Community Edition OS Command Injection via PGP Configuration | OTRS Community Edition | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-76635 | baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php | basercms | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15686 | Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability | Adminer | 7.2 (v3.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-18274 | Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability | Database Proxy | 7.2 (v3.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-73255 | Mongoose: Path traversal in SSI #include directives enables arbitrary file read | mongoose | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72860 | 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unre | 9router | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-49244 | SFTPGo: Path confinement bypass in public browsable share partial ZIP download | sftpgo | 5.9 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75628 | Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_pa | - | 5.7 (v3.1) | Medium | 344365 |
| CVE-2026-76762 | code-projects Assessment Management welcome.php sql injection | Assessment Management | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76764 | code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection | Employee Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76795 | AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery | PullMD | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76990 | code-projects Simple Inventory System delete.php sql injection | Simple Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76996 | SourceCodester Simple Online Food Ordering System view_order.php sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76998 | SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-77019 | CodeAstro Apartment Visitor Management System forgotpw.php sql injection | Apartment Visitor Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-77020 | CodeAstro Apartment Visitor Management System password-recovery.php sql injection | Apartment Visitor Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-54508 | TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution | TREK | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-72846 | Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery | lightdash | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77067 | Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation | omnivore | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77648 | Glance Server-Side Request Forgery Vulnerability | Glance | 2.2 (v3.1) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76785 | amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection | Mini-Inventory-and-Sales-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76991 | itsourcecode Hospital Management System viewappointmentapproved.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76997 | SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection | Simple Online Food Ordering System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-77025 | itsourcecode Hospital Management System viewappointmentpending.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76995 | SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload | Simple Online Food Ordering System | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-51366 | Bottinelli Informatica Vedo Suite v.1.2.5 Arbitrary Code Execution Vulnerability | Bottinelli Informatica Vedo Suite v.1.2.5 | 9.9 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-53545 | Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection | Termix | 9.8 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45272 | MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File | talebook | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62668 | Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols | grav | 9.4 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-66794 | Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route | multicluster engine for Kubernetes 2.10 | 9.3 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48024 | Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager | wazuh | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-48162 | Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file pa | wazuh | 9.1 (v3.1) | Critical | 340007 , 344360 , 350591 , 390709 |
| CVE-2026-32475 | Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler | Elementor Pro | 9.0 (v3.1) | Critical | 398001 |
| CVE-2026-44829 | Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename | gotenberg | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-61518 | ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter | ispconfig3 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63722 | ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php | ICEcoder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-64850 | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | grav | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344365 , 344366 , 344370 , 393655 |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback | wekan | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76205 | phpMyFAQ before 4.1.7 SQL Injection via Glossary | phpmyfaq | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-64851 | Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers | grav-plugin-shortcode-core | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68558 | Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) | wekan | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76225 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV | arcadedb | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 390109 , 398021 , 398022 |
| CVE-2026-19942 | Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta | Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53549 | Termix: Server-Side Request Forgery via Proxy Connectivity Test | Termix | 7.7 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15780 | WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-18430 | HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason | HumHub | 7.2 (v4.0) | High | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | phpmyfaq | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15446 | EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Att | EWWW Image Optimizer | 6.4 (v3.1) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75986 | code-projects Online Job Portal System Password Recovery ForPass.php sql injection | Online Job Portal System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76048 | SourceCodester Simple Online Food Ordering System ajax.php login sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-76049 | SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-76574 | code-projects Hospital Information System User Login UsersController.php login sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76760 | chenhg5 cc-connect webhook.go authenticate code injection | cc-connect | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76761 | chenhg5 cc-connect Management API engine.go shellExecCommand os command injection | cc-connect | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53452 | Ground Station: Unauthenticated out-of-containment file read via sigmfplayback recordingPath | ground-station | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-76239 | Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address | stigmem-node | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76614 | OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore | openemr | 5.3 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal | openemr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76203 | CSS sanitizer bypass in Pentestify report themes allows forced outbound requests | Pentestify | 5.1 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76576 | yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal | RuoYi-Vue | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and cr | lemur | 9.9 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12564 | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credenti | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical | 333140 , 333141 , 340003 , 340087 , 340095 , 340099 , 340147 , 340148 , 340158 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | siyuan | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-52610 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-50186 | 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export | 4gaBoards | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75914 | CodeWhale before 0.8.64 Path Traversal via image_analyze symlink | CodeWhale | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75833 | Grav API Plugin Open Redirect via Backslash Bypass | grav | 8.6 (v4.0) | High | 344365 |
| CVE-2026-75855 | ArcadeDB before 26.8.1 Path Traversal via create/drop database | arcadedb | 8.4 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75898 | RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component | ragflow | 8.4 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75842 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV | arcadedb | 8.3 (v4.0) | High | 340007 , 340029 , 344360 , 344370 , 390109 , 390709 |
| CVE-2026-74907 | Grav before 2.0.15 Path Traversal via plugin-asset-map.php | grav | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-50143 | Actor MCP path authority injection leaks Apify token | apify-mcp-server | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71303 | Lemur: Incomplete fix for CVE-2026-55166 – ACME authority update endpoint allows non-admin to replace acme_url with i | lemur | 7.7 (v3.1) | High | 337109 , 337110 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71365 | Awx: webhook status callback ssrf leaks the git pat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-70666 | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs | lemur | 7.4 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75830 | grav-plugin-api before 1.0.15 Path Traversal via batchCopy | grav | 7.1 (v4.0) | High | 340007 , 344360 |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | arcadedb | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-74038 | Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment | wazuh | 7.0 (v4.0) | High | 340007 , 344360 |
| CVE-2026-52607 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63643 | MagicMirror: ssrf calendar .js | MagicMirror | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-70667 | Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fi | lemur | 6.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-68922 | MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads | Mobile-Security-Framework-MobSF | 5.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75079 | SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75080 | SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75089 | PHPGurukul Complaint Management System check_availability.php sql injection | Complaint Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-75778 | code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-54543 | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | froxlor | 5.4 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-47720 | FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString | FUXA | 5.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74908 | Grav plugin-api before 1.0.15 Script Injection via SVG | grav | 5.1 (v4.0) | Medium | 351000 |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68927 | MobSF: SSRF port restriction bypass in assetlinks_check | Mobile-Security-Framework-MobSF | 3.0 (v3.1) | Low | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2024-14046 | OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload | OpenBoxes | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-75086 | itsourcecode Hospital Management System viewroom.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75087 | itsourcecode Hospital Management System viewdepartment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75088 | itsourcecode Hospital Management System viewbilling.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75876 | xianrendzw EasyReport Move Operations ModuleController.java sql injection | EasyReport | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67678 | RainyGao-Hithub DocSys v.2.02.80 Arbitrary Code Execution Vulnerability | RainyGao-Hithub DocSys v.2.02.80 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-67919 | Halo 2.25.4 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67926 | JeecgBoot v.3.9.2 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-15623 | Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service | Google SecOps (Chronicle SOAR) | 9.4 (v4.0) | Critical | 341245 , 344367 |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirect | mlflow | 9.3 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-74798 | SiYuan kernel Path Traversal via database_clean MCP tool | siyuan | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-75111 | Evidently UI Path Traversal via Dataset Materialization Filename | evidently | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-75482 | SWE-agent Trajectory Inspector Path Traversal File Disclosure | SWE-agent | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-56677 | 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint | 9router | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-64657 | Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL | budibase | 8.4 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-33437 | Stirling PDF: Stored XSS in Info Summary | Stirling-PDF | 8.1 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-27621 | UpTrain has a Constant Default API Key | uptrain | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50776 | Pronis Loisirs Billetterie CSE - < 04/2026 Arbitrary Code Execution Vulnerability | Pronis Loisirs Billetterie CSE - < 04/2026 | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40506 | OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php | openemr | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19983 | GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection | A1300 | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63667 | ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal | apostrophe | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-48053 | Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset | kolibri | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-75014 | SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection | Pet Grooming Management Software | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74858 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery | fetcher-mcp | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19972 | itsourcecode Hospital Management System viewpatient.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19973 | itsourcecode Hospital Management System viewpaymentreport.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19984 | jkawamoto mcp-florence2 init.py get_images server-side request forgery | mcp-florence2 | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19998 | code-projects Online Shopping System offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-20000 | itsourcecode Hospital Management System viewprescriptionrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74842 | Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery | PromptShopMCP | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19964 | Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection | Jij-MCP-Server | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14498 | Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter | Query Wrangler | 8.8 (v3.1) | High | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 |
| CVE-2026-73058 | stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass | stoatchat | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19919 | code-projects Online Shopping System Login login.php sql injection | Online Shopping System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19926 | Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection | Evergreen | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19956 | gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery | facebook-ads-mcp-server | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-17604 | Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter | Kirki – Freeform Page Builder, Website Builder & Customizer | 4.9 (v3.1) | Medium | 347009 , 381206 |
| CVE-2026-12905 | Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Refere | Online Scheduling and Appointment Booking System – Bookly | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19920 | code-projects Online Shopping System action.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19921 | code-projects Online Shopping System homeaction.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19923 | code-projects Online Shopping System checkout_process.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19927 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery | OpenBoxes | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19932 | DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection | Notice-System-Managent | 2.1 (v4.0) | Low | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19934 | itsourcecode Hospital Management System vieworder.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19958 | iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection | pptr-mcp | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19922 | code-projects Online Shopping System checkout.php cross site scripting | Online Shopping System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19925 | SourceCodester Stock Management System Master.php delete_supplier sql injection | Stock Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19598 | Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router | pods | 9.8 (v3.1) | Critical | 377360 |
| CVE-2026-73041 | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations | siyuan | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73042 | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata | siyuan | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15965 | MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter | MaxUpload – Big File Uploads – Increase Maximum File Upload Size | 8.8 (v3.1) | High | 351000 |
| CVE-2026-18438 | Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Im | Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | 8.8 (v3.1) | High | 351000 |
| CVE-2026-19900 | LB-LINK Routers - Unauthenticated Command Injection | bl-wr9000 firmware | 8.2 (v4.0) | High | 390904 |
| CVE-2026-15162 | Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection | Object Sync for Salesforce | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16007 | Authenticated SQL Injection in AppFlowy | AppFlowy-Cloud | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19899 | SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19894 | itsourcecode Hospital Management System viewmedicine.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19917 | code-projects Online Food Order System delete_food_items1.php sql injection | Online Food Order System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19188 | Haiwell IoT Cloud HMI Gateway OS Command Injection | Haiwell IoT Cloud HMI Gateway | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-48528 | Metacat has an unauthenticated SQL injection vulnerability | metacat | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19626 | Tenable Security Center Report Charting RCE | security center | 9.4 (v4.0) | Critical | 330791 , 340011 , 340128 , 340152 , 380018 , 390801 |
| CVE-2026-19681 | Tenable Security Center SCAP Audit File Command Injection | security center | 9.4 (v4.0) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2026-72819 | Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload | grav | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72827 | Grav CMS before 2.0.13 Remote Code Execution via Twig | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72830 | Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass | grav | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73680 | Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename | Cockpit CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73850 | Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function | emlog | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-69101 | Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint | tis | 8.3 (v4.0) | High | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 398008 |
| CVE-2026-19771 | Baicells EG3661M LuCI Web luci os command injection | EG3661M | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-74247 | Quay: ssrf via build archive_url in quay build api | openshift update service | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-72814 | actix-web before 0.6.10 Information Disclosure via Files | actix-web | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-18403 | LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB | LimeSurvey | 6.0 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19758 | dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal | lamp-cloud | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19762 | DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal | Taier | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19827 | alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal | alldata | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19785 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection | RosarioSIS | 5.3 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-73845 | CKAN MCP Server: MQA server allowlist bypass via unanchored regex (isValidMqaServer) | ckan-mcp-server | 5.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19761 | DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal | Taier | 5.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19763 | DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal | Taier | 5.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72821 | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72832 | Grav before 2.0.12 Stored XSS via quoted-attribute bypass | grav | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-19767 | itsourcecode Hospital Management System viewdoctortimings.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19828 | 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19829 | 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low | 344360 , 347009 , 390709 |
| CVE-2026-19787 | SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection | Air Cargo Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19839 | SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload | Simple Doctors Appointment System | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-49819 | UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd | UpSnap | 9.8 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-49827 | WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) | WebErpMesv2 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-72850 | Budibase before 3.40.0 Arbitrary File Write via Path Traversal | server | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73483 | Flowise before 3.1.3 Sandbox Escape via Puppeteer | flowise | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72851 | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook | server | 9.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-73485 | Flowise before 3.1.3 Remote Code Execution via Airtable Agent | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73486 | Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73487 | Flowise before 3.1.3 Prompt Injection RCE via CSV Agent | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73570 | zimbra collaboration suite Arbitrary Code Execution Vulnerability | zimbra collaboration suite | 8.9 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2019-25765 | ASP-CMS SQL Injection via commentList.asp id Parameter | ASP-CMS | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-58374 | Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree | e-HR | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 344365 , 346755 , 350147 , 350148 |
| CVE-2026-73664 | FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module | backup | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73670 | CMS Admin SQL Injection via db_data.php table_name Parameter | Saurus CMS Community Edition | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 380026 , 380122 , 390572 |
| CVE-2026-57894 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil | Gitea Open Source Git Server | 8.5 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | server | 8.4 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73629 | Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses | Serendipity | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73658 | Trigger.dev: Cross-tenant object store read and write via URL path traversal | trigger.dev | 8.2 (v3.1) | High | 347009 |
| CVE-2026-61979 | WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability | SAML SP Single Sign On | 8.1 (v3.1) | High | 300022 |
| CVE-2026-73659 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API | trigger.dev | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-58314 | Two SSRF findings in Gitea 1.26.2 | Gitea Open Source Git Server | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59765 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | Gitea Open Source Git Server | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-49857 | auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback | auth-fetch-mcp | 7.4 (v3.1) | High | 337109 , 337110 , 344360 , 398004 , 398021 , 398022 |
| CVE-2026-45725 | compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal | compliance-trestle | 7.1 (v4.0) | High | 347009 |
| CVE-2026-45774 | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal | compliance-trestle | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-58442 | Repository migration SSRF via multi-answer DNS allow-list bypass | Gitea Open Source Git Server | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73573 | zimbra collaboration suite Path Traversal Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73574 | zimbra collaboration suite Incorrect Resource Transfer Between Spheres Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73530 | Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() | flyto-core | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19710 | SourceCodester Simple Student Information System view_department.php sql injection | Simple Student Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery | mcp-rdf-explorer | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-3835 | Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access | Prevent Direct Access – Protect WordPress Files | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73038 | NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name | NodeBB | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19716 | Stored Cross-site Scripting in Pentestify user account deletion via unescaped username | Pentestify | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73671 | Saurus CMS Unauthenticated Open Redirect via logout url parameter | Saurus CMS Community Edition | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-49856 | @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization | jshookmcp | 4.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-73657 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay | trigger.dev | 4.2 (v3.1) | Medium | 347009 |
| CVE-2026-23603 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | Gitea Open Source Git Server | 3.1 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19752 | EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery | mcp-dominican-layer | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19756 | Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal | lamp-cloud | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-63298 | LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration | lxd | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-66898 | Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE | lxd | 9.9 (v3.1) | Critical | 390719 |
| CVE-2026-73263 | Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path | prowler | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73294 | Semaphore U: OS Command Injection | semaphore | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-44741 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parame | pimcore | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15217 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16033 | Arbitrary file read+write on host via templates/ symlink in malicious image | lxd | 8.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-65937 | WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI | whatsup gold | 8.0 (v3.1) | High | 340147 , 340148 , 340149 |
| CVE-2026-73498 | MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_at | mcp-atlassian | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-64826 | rConfig < 8.2.13 Path Traversal File Read via FileDownloadController | rConfig | 7.1 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | astro | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium | 333140 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-70560 | Ultimate POS Stored XSS via First Name Field in Leave Notifications | Ultimate POS (Stock Management & Point of Sale) | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49262 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | pagible | 3.0 (v3.1) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-46670 | YesWiki: Unauthenticated SQL Injection | yeswiki | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-31114 | Fooocus webui vulnerable to Remote Code Execution | Fooocus | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73069 | Twenty: SQL Injection in the searchVector Field Settings Allows Arbitrary PostgreSQL Execution | twenty | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | sharepoint server | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72557 | Cockpit CMS Cockpit CMS - Unrestricted File Upload | Cockpit CMS | 8.8 (v3.1) | High | 351000 |
| CVE-2026-73222 | Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio) | claude-code-templates | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2016-20097 | Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad | E-cology 8.0 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-50997 | Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp | E-cology 9.0 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-55676 | Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component | Malcolm | 8.7 (v4.0) | High | 351000 |
| CVE-2026-72713 | XAgent Path Traversal Arbitrary File Read via /workspace/file | XAgent | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-5917 | libgit2 Shell Command Injection via ssh_libssh2 Backend | libgit2 | 8.6 (v4.0) | High | 340014 , 347009 , 393655 |
| CVE-2026-51583 | usememos through v0.30.0 Server-Side Request Forgery Vulnerability | - | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73079 | Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstrea | sub2api | 8.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67179 | Genkit improper host header validation | genkit | 7.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72607 | Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age | Koha | 7.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72609 | Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl | Koha | 7.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-71475 | Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path | advanced cluster management for kubernetes | 6.8 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72608 | Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name | Koha | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-73243 | kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass | kkFileView | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48483 | TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server | typebot.io | 5.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48762 | TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler | typebot.io | 5.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73082 | Activepieces: Server-side request forgery in MCP tool validation endpoint | activepieces | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73244 | kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing | kkFileView | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19434 | Stored Cross-site Scripting in Pentestify finding severity field | Pentestify | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72747 | AVideo Stored Cross-Site Scripting via Unauthenticated Registration | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72610 | Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation | Koha | 4.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-73087 | Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher | dozzle | 2.3 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-72899 | Metabase SQL injection via public card or dashboard | Metabase | 10.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72738 | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72740 | Dokploy: OS Command Injection via SSH-form customGitUrl domain in ssh-keyscan | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72865 | Dokploy: OS Command Injection via compose composePath | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72868 | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72869 | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72872 | Dokploy: OS Command Injection via Bitbucket owner/repository in git clone | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72882 | Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72902 | Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72592 | dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload | phpfm | 9.8 (v3.1) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72878 | Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments | dokploy | 9.6 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72879 | Dokploy: Command Injection via Registry Credentials in Swarm Upload | dokploy | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-47754 | unauthenticated path traversal in Metacat 2.x | metacat | 9.3 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63106 | ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php | Ready eCommerce | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72875 | Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile | dokploy | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71966 | CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer | cyberpanel | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72870 | Dokploy: Command Injection via Docker Credentials in buildRemoteDocker | dokploy | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72874 | Dokploy: Command Injection via Unescaped Git URL in Clone Commands | dokploy | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-66738 | SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite | SPIP | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-71964 | CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload | cyberpanel | 7.1 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73033 | Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php | sucuri-wordpress-plugin | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72739 | Dokploy: Command Injection via Compose Shell Execution | dokploy | 6.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-16949 | Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup | Term Pages | 5.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-19379 | EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection | ipTIME AX8004M | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-19384 | SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection | Simple Doctors Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-17010 | Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta | Saitama Addon Pack | 5.4 (v3.1) | Medium | 346755 |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14860 | Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery | Podcast Player | 5.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-69116 | FlyEnv < 4.18.0 Cross-Site Scripting via v-html | FlyEnv | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | SQLBot | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-14238 | Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report | vitepos | 4.1 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19375 | dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery | article-scraper-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19378 | code-projects Task Management System CommentSave.php cross site scripting | Task Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19383 | saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload | SaiAdmin | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-71984 | MSI Radix AXE6600 v781521 Command Injection via urlfilter | Radix AXE6600 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71992 | MSI Radix AXE6600 v781521 Command Injection via macfilter | Radix AXE6600 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-19343 | code-projects Task Management System AdminLogin.php sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19344 | code-projects Task Management System comment_count_user.php sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19374 | adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery | api-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-17011 | Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection | Nexter Blocks | 3.8 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19340 | anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery | ProjectHub-Mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19347 | itsourcecode Hospital Management System viewdoctor.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19364 | itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19369 | KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery | jira-mcp-server | 1.9 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19373 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery | KoboldCPP-MCP-Server | 1.9 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19353 | DedeCMS Installation Wizard index.php _4_Setup file inclusion | DedeCMS | 1.3 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-71944 | D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71945 | D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71946 | D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71947 | D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71948 | D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71949 | D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71950 | D-Link DWR-M961 Command Injection via /boafrm/formSmsManage | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71951 | D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71952 | D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71953 | D-Link DWR-M961 Command Injection via /boafrm/formNtp | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71954 | D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71955 | D-Link DWR-M961 Command Injection via /boafrm/formWsc | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71956 | D-Link DWR-M961 Command Injection via app.cgi | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-16559 | YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload | YMC Filter | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | flowise | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16558 | YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema | YMC Filter | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-16955 | AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription | AI Engine | 5.0 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-64637 | All Plesk Versions below 18.0.79.5 Reseller Privilege Escalation to Root | Plesk | 9.9 (v3.0) | Critical | 341245 , 344366 |
| CVE-2022-4995 | Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp | E-cology 9.0 | 9.3 (v4.0) | Critical | 351000 |
| CVE-2026-64638 | WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) | WordPress | 8.9 (v4.0) | High | 344370 |
| CVE-2026-47659 | Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} | pathling | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-47661 | Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read | pathling | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-64636 | Plesk 18.0.51 up to 18.0.79.4 Blind SQL Injection | Plesk | 7.7 (v3.1) | High | 341245 |
| CVE-2026-48093 | Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed | code-embed | 6.5 (v3.1) | Medium | 333140 |
| CVE-2026-19196 | SourceCodester Photo Share Website ajax.php login sql injection | Photo Share Website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-19211 | SourceCodester Photo Share Website ajax.php signup sql injection | Photo Share Website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17597 | Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification | nexus repository manager | 5.1 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19210 | SourceCodester Photo Share Website ajax.php save_upload unrestricted upload | Photo Share Website | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-19246 | HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery | nanobot | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19209 | SourceCodester Photo Share Website index.php home cross site scripting | Photo Share Website | 2.0 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2026-19207 | PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting | Company Visitor Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15732 | WGDashboard Server-Side Request Forgery Vulnerability | WGDashboard | 9.8 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-15733 | WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read | WGDashboard | 9.8 (v3.1) | Critical | 344360 , 393655 |
| CVE-2026-67688 | ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability | ICS-Park Smart Park Management System v2.0 | 9.8 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67689 | FineAdmin V1.0 Arbitrary Code Execution Vulnerability | FineAdmin V1.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12605 | glassfish Server-Side Request Forgery Vulnerability | glassfish | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53975 | OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec | OpenChamber | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-53976 | OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read | OpenChamber | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-70558 | Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token | Dinky | 9.3 (v4.0) | Critical | 351000 |
| CVE-2024-39024 | In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62857 | Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources | fedify | 8.8 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-3430 | Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi | Creative Mail | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-63725 | sysPass FileBackupService Authenticated OS Command Injection via Backup Path | sysPass | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-16268 | Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler | Newsletters | 8.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48081 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer | appointment-booking-software | 8.1 (v3.1) | High | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-16065 | Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import | Welcart e-Commerce | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-18400 | Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2026-45573 | Decidim: Push subscriptions can be abused for server-side requests | decidim | 6.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-5391 | LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11588 | EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation | EONSR AEO Agent | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18973 | heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery | super-agent-party | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19000 | JeecgBoot Anonymous Chat Attachment send server-side request forgery | JeecgBoot | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19021 | SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection | Computer Repair Shop Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-19020 | itsourcecode Hospital Management System servicetype.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19040 | MissionSquad mcp-api dcrClients.ts server-side request forgery | mcp-api | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19067 | itsourcecode Hospital Management System treatment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19068 | itsourcecode Hospital Management System treatmentdetail.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19069 | itsourcecode Hospital Management System treatmentrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19070 | itsourcecode Hospital Management System viewadmin.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19071 | itsourcecode Hospital Management System viewappointment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19110 | DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting | DataGear | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15360 | Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args | Ajax Load More | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-17623 | Langflow is affected OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-17625 | Langflow is affected by OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-60009 | theia Arbitrary Code Execution Vulnerability | theia | 8.8 (v3.1) | High | 351000 |
| CVE-2026-6147 | LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload | LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock | 8.8 (v3.1) | High | 351000 |
| CVE-2026-34966 | Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass | Gitea | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71320 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props | nuxt | 8.1 (v3.1) | High | 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8183 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10716 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation | Directus | 7.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15918 | VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection | VikAppointments Services Booking Calendar | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16573 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload | Bit Form | 7.5 (v3.1) | High | 346755 |
| CVE-2026-18881 | TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter | TableOn – WordPress Posts Table Filterable | 7.5 (v3.1) | High | 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-46581 | mojarra Path Traversal Vulnerability | mojarra | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-61891 | theia Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | theia | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-71209 | audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Trave | audiobookshelf | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-18900 | H3C NX15 Backend RPC esps file.exec os command injection | NX15 | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-16143 | VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting | VikRentItems Flexible Rental Management System | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 , 350147 , 350148 |
| CVE-2026-17506 | Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting | Independent Analytics – WordPress Analytics Plugin | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-6020 | ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71284 | Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename | fledge | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7693 | Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter | Backup Migration | 7.2 (v3.1) | High | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-11977 | WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7646 | Langflow is affected by security vulnerabilities in Model Context Protocol features | langflow | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2026-7658 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-17505 | WordPress TranslatePress < 3.2.6 - Cross-Site Scripting | translatepress-multilingual | 6.1 (v3.1) | Medium | 333141 , 341256 , 346755 , 347198 , 350148 |
| CVE-2026-17532 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting | Seraphinite Accelerator | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-7869 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 5.4 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5062 | PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links | 4.9 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-71283 | Fledge IoT Gateway Backup Restore Tar Path Traversal | fledge | 4.9 (v3.1) | Medium | 344360 , 390709 |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | GeoDirectory | 3.5 (v3.1) | Low | 346755 |
| CVE-2026-18896 | lavkush-maurya Student-Registration-System changepass.php sql injection | Student-Registration-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-18959 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal | InnoShop | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-18856 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | Rhymix CMS | 2.0 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-70477 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | flowise | 9.5 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69256 | Flowise: Remote Code Execution Vulnerability in CSVAgent | flowise | 9.4 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-69110 | OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music | opencode-studio | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-70553 | MaxSite CMS Unauthenticated RCE via Install Endpoint | MaxSite CMS | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69251 | Flowise RCE via TypeORM DataSource | flowise | 9.0 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-70369 | Koha - SQL Injection in reports/acquisitions_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-70370 | Koha - SQL Injection in reports/catalogue_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-70373 | Koha - SQL Injection in reports/issues_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67200 | Perspective 5.0.0 Path Traversal via cwd_static_file_handler | perspective | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69100 | LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution | lamp-cloud | 8.7 (v4.0) | High | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-65986 | CVAT has stored XSS via annotation guide assets | cvat | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 341256 , 342259 , 350147 , 350148 |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | flowise | 8.5 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-69704 | Atals-Livre SQL Injection via Unsanitized GET Parameter in supp() | Atals-Livre | 7.0 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14872 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter | Database for Contact Form 7, WPforms, Elementor forms | 6.8 (v3.1) | Medium | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | Brizy | 6.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-16548 | Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat | 6.5 (v3.1) | Medium | 351000 |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | open webui | 6.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-70620 | Odysseus SSRF via Embedding Endpoint Configuration | odysseus | 6.1 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | EmbedPress | 5.8 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18788 | Trippo ResponsiveFilemanager dialog.php unrestricted upload | ResponsiveFilemanager | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-70492 | Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages | open webui | 5.4 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id | Simple Google Calendar Outlook Events Widget | 5.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15233 | Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title | Nested Pages | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18766 | chetans9 core-php-admin-panel customers.php sql injection | core-php-admin-panel | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-18774 | NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery | hermes-agent | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-69083 | SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69084 | SiYuan - SQL Execution | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344366 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69085 | SiYuan before v3.7.3 SQL Injection via searchDocs | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-51775 | Fastadmin v.1.6.1.20250430 SQL Injection Vulnerability | Fastadmin v.1.6.1.20250430 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69240 | Sequelize: SQL Injection (Oracle DB) | sequelize | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39932 | OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection | openemr | 9.4 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-16532 | Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form | Link Library | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41453 | Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter | laravel-crm | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69089 | Grav CMS before 2.0.11 Path Traversal via watermark | grav | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69095 | OpenWrt luci-app-bmx7 Path Traversal via bmx7-info | luci | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69096 | OpenWrt luci-app-dockerman Read ACL Remote Code Execution | luci | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 350147 , 390904 , 393655 |
| CVE-2026-39931 | OpenEMR Authenticated SQL Injection via backup.php Import Feature | openemr | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-61523 | WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor | WebsiteBaker CMS | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67599 | ClearOS 7.9 OS Command Injection via Log Viewer filter parameter | ClearOS | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-67608 | Telenia TVox 26.5.3 OS Command Injection via action_audio.php | TVox | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 |
| CVE-2026-69088 | Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint | grav | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69086 | SiYuan before v3.7.3 Path Traversal via unvalidated avID | siyuan | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-69192 | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trus | ip-address | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18737 | Shlink Blind SQL Injection via tags/stats orderBy Parameter | Shlink | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38444 | osTicket v1.18.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-38446 | Cross-Site Scripting | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-18641 | Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginC | Operation and Maintenance Security Management System | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-18646 | danpros HTMLy Author Name htmly.php path traversal | HTMLy | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 |
| CVE-2026-49131 | OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field | OPNsense | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-49132 | OPNsense < 26.1.9 Stored XSS via Certificate Description Field | OPNsense | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15673 | Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read | Import and export users and customers | 4.9 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16297 | Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import | Clearfy Cache | 4.1 (v3.1) | Medium | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390904 , 398008 |
| CVE-2026-18644 | danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal | HTMLy | 2.1 (v4.0) | Low | 344360 |
| CVE-2026-18645 | danpros HTMLy Admin Content Endpoint admin.php add_content path traversal | HTMLy | 2.1 (v4.0) | Low | 344360 |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | AcyMailing | 8.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-18352 | User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter | User Access Manager | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | King Addons for Elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | JetEngine | 5.4 (v3.1) | Medium | 333140 , 340095 , 340147 , 342259 , 346755 |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68583 | luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name | luci | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | Narrative Publisher | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 346755 , 350147 , 350148 |
| CVE-2026-67308 | Wazuh GitHub Actions Shell Injection via Fork Pull Request | wazuh | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-3141 | FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter | FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | sso | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-67309 | Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass | traefik | 7.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | Theme Demo Import | 7.2 (v3.1) | High | 351000 |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | Everest Toolkit | 7.2 (v3.1) | High | 351000 , 382238 , 390501 |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search | HUSKY | 7.2 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-13725 | Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax | Dynamic Pricing With Discount Rules for WooCommerce | 7.1 (v3.1) | High | 346755 |
| CVE-2026-67352 | luci-app-https-dns-proxy Stored XSS via resolver_url | luci | 6.8 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16087 | Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter | Icegram Engage – Popups, Optins, CTAs & Lead Generation | 6.5 (v3.1) | Medium | 340156 |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | Codeless Page Builder | 5.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | Admin Columns for ACF Fields | 5.4 (v3.1) | Medium | 333141 , 340087 , 340095 , 340099 , 341099 , 341266 |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | Support Genix | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes | Spectra Legacy | 3.5 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 , 350147 , 350148 |
| CVE-2025-69946 | SourceCodester Modern Loan Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69948 | SourceCodester Modern Loan Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | Kirki | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | Product Feed Manager For WooCommerce | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | Kirki | 7.5 (v3.1) | High | 340014 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo | core | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-56671 | ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read | ComfyUI | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite) | ElementsKit Elementor Addons | 7.2 (v3.1) | High | 340014 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14833 | Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute | Lightbox with PhotoSwipe | 6.8 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-14554 | Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters | Check & Log Email | 6.5 (v3.1) | Medium | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-52371 | xxl-job v3.4.0 Server-Side Request Forgery Vulnerability | xxl-job v3.4.0 | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-14845 | NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget | NewStatPress | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode | Ultimate Addons for WPBakery Page Builder | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-52232 | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-45376 | Decidim: Admin user search allows SQL injection through similarity-based sorting | decidim | 5.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-59231 | Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs | Pentestify | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59232 | Stored Cross-site Scripting in Prospero Flow CRM lead name field | Prospero Flow CRM | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-55495 | Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account | cloudreve | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | WP Go Maps | 3.7 (v3.1) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) | ElementsKit Elementor Addons | 3.5 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-55825 | Contao: Possible path traversal in job download URIs | contao | 3.1 (v3.1) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67350 | Serendipity < 2.6.1 Open Redirect via exit.php | Serendipity | 2.1 (v4.0) | Low | 344365 |
| CVE-2025-65336 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69930 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69931 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69933 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69934 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69935 | SQL Injection | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69936 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69937 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69938 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69941 | SourceCodester Tailor Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69947 | SourceCodester Tailor Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12940 | Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint | langflow | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-35847 | the CheckUils.php file Arbitrary Code Execution Vulnerability | the CheckUils.php file | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-66418 | OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field | openclaw agent dashboard | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-67206 | Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload | wolfcms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-57862 | Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation | Kanboard | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-67346 | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass | swarms | 7.7 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16969 | DFIR-IRIS Stored XSS in Assets | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18360 | DFIR-IRIS Stored XSS in Custom Attributes | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18361 | DFIR-IRIS Stored XSS in Datastore Upload | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | tourmaster | 7.1 (v3.1) | High | 333141 , 340087 , 340095 , 340099 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | boruta | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15153 | WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search | WP Hotel Booking | 6.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15974 | sglang Server-Side Request Forgery Vulnerability | sglang | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-65341 | Ecommerce Fruits Bazar 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | Animation Addons for Elementor | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14207 | LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information | LifterLMS | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16531 | Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet | Red Hat Enterprise Linux 10 | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-64870 | MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation | MaxKB | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-66414 | Leantime Open Redirect in Login Controller via redirectUrl Parameter | Leantime | 5.1 (v4.0) | Medium | 344365 |
| CVE-2025-65340 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67403 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67404 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69942 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69943 | SQL Injection | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41939 | Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly | Care Everywhere Gateway | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-67426 | Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration | flyto-core | 9.3 (v3.1) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-11974 | Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download | wp-media-folder-addon | 8.6 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-67424 | Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation | flyto-core | 8.5 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-67428 | Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF | flyto-core | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-5487 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5491 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-67405 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67406 | Advocate office management system Arbitrary Code Execution Vulnerability | Advocate office management system | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67407 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67408 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69944 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69945 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69949 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-13425 | Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values | Database for CF7 | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 346755 , 350147 , 350148 |
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | WOLF | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | PhotoSwipe | 6.8 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-8791 | Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting | Booking System Trafft | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability | Dify | 5.4 (v3.0) | Medium | 344365 |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17524 | zip-lib Path Traversal Vulnerability | zip-lib | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54650 | openhole-server vulnerable to path traversal via URL-decoded request path | openhole | 8.6 (v3.1) | High | 347009 |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | 8.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54691 | datamodel-code-generator vulnerable to SSRF via –url: no host/IP validation, follows redirects | datamodel-code-generator | 8.2 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10207 | PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter | PickPlugins Question Answer | 7.5 (v3.1) | High | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-14490 | Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action | Demi – One Click Demo Import, Backup & Site Migration | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2026-13440 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unau | StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | 7.2 (v3.1) | High | 346755 |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | Database for Contact Form 7, WPforms, Elementor forms | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-6251 | Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter | Chaty Pro | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56722 | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | dompdf | 6.3 (v4.0) | Medium | 344360 , 390709 |
| CVE-2026-63302 | Local File Inclusion in Quick.CMS | Quick.CMS | 5.1 (v4.0) | Medium | 344360 , 347009 |
| CVE-2026-5114 | SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read | SpeedyCache – Cache, Optimization, Performance | 4.9 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55554 | Dompdf: Chroot Validation Bypass | dompdf | 2.3 (v4.0) | Low | 344360 , 390709 |
| CVE-2026-48030 | Pheditor 2.0.1-2.0.3 - OS Command Injection | pheditor | 9.9 (v3.1) | Critical | 320008 , 320019 , 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-63077 | JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical | 340155 , 341155 |
| CVE-2026-66395 | SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol | siyuan | 9.4 (v4.0) | Critical | 333140 , 340095 , 341266 |
| CVE-2026-66398 | phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API | phpMyFAQ | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61511 | vBulletin 6.x - Remote Code Execution | vBulletin | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360151 , 393655 |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical | 300013 , 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | siyuan | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-50455 | the CodeIgniter Query Builder Arbitrary Code Execution Vulnerability | the CodeIgniter Query Builder | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-17552 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten | Plack::App::Prerender | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-59239 | Stored XSS in Prospero Flow CRM email body allows administrator account takeover | Prospero Flow CRM | 8.6 (v4.0) | High | 333140 , 333141 , 340095 |
| CVE-2026-66397 | phpMyFAQ before 4.1.6 Path Traversal via category image deletion | phpMyFAQ | 8.6 (v4.0) | High | 344360 , 390109 |
| CVE-2026-51077 | Dede CMS v.5.7.118 SQL Injection Vulnerability | Dede CMS v.5.7.118 | 7.5 (v3.1) | High | 340145 , 380122 |
| CVE-2026-51078 | Dede CMS v.5.7.118 Information Disclosure Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14827 | Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter | Calendar | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-12982 | Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery | Document Gallery | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-13400 | Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information | Simply Schedule Appointments | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14190 | Sina Extension for Elementor < 3.10.2 - Reflected XSS | Sina Extension for Elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-51564 | the redirect parameter in Milk admin <=0.9.8 Open Redirect Vulnerability | - | 4.9 (v3.1) | Medium | 344365 |
| CVE-2026-14203 | Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title | Smart Manager | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-14236 | Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect | Contact Form 7 | 4.7 (v3.1) | Medium | 344365 |
| CVE-2026-14189 | WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields | WPBot | 3.8 (v3.1) | Low | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-48051 | Papra: SSRF via HTTP redirect bypass in webhook delivery | papra | 3.5 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | astro | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17458 | mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery | openclaw-cn | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10818 | WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering | WPForms Pro | 8.1 (v3.1) | High | 351000 |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-65693 | Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates | microweber | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-65711 | sysPass 3.2.11 Authenticated OS Command Injection via Backup Path | sysPass | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-65707 | Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint | likeshop | 8.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15401 | VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Pa | VikBooking Hotel Booking Engine & PMS | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-6454 | Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' At | Firelight Lightbox | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-66004 | BlenderMCP Path Traversal via download_polyhaven_asset API | blender-mcp | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16910 | Quay: ssrf in red hat quay notification webhooks (slack/generic) | Red Hat OpenShift Update Service | 5.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47668 | DbGate - Remote Code Execution via Anonymous JWT | dbgate | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 360151 , 380026 |
| CVE-2026-47670 | DbGate - Remote Code Execution via Dynamic Import Bypass | dbgate | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 340149 , 340162 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 346755 , 380026 , 393655 |
| CVE-2026-63732 | 9router before 0.4.60 Remote Code Execution via default password | 9router | 9.4 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47669 | DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE | dbgate | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-65700 | h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API | h2ogpt | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-65701 | SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route | so-vits-svc | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-65761 | Joomla Easy Store - SQL Injection | Easy Store | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-65760 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0 | Easy Store extension for Joomla | 9.2 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65702 | Vanna 2.0.2 Path Traversal via FileSystemConversationStore | vanna | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | nebula-mesh | 8.7 (v4.0) | High | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | shopper | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-65694 | Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read | microweber | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65759 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 | Easy Store extension for Joomla | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65919 | Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload | meshery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63313 | 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch | 9router | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65695 | Office-Word-MCP-Server 1.1.11 Path Traversal via document tools | Office-Word-MCP-Server | 7.6 (v4.0) | High | 344360 , 390709 |
| CVE-2026-7534 | SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter | SUMO Reward Points for WooCommerce | 7.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13119 | Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter | Registrations for the Events Calendar – Event Registration Plugin | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-15761 | Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter | Tickera – Sell Tickets & Manage Events | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-65698 | Void 1.3.4 Path Traversal via AI Agent File-Reading Tools | void | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16765 | CodeAstro Online Classroom loginlinkadmin.php sql injection | Online Classroom | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48530 | GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48531 | GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48532 | GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48534 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48535 | GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48536 | GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48537 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-48539 | GFI Archiver < 15.13 Stored XSS via MailInsights.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9577 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter | Post Status Notifier Lite | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-48012 | Shopware SSO referer trust leading to an arbitrary redirect target | shopware | 4.3 (v3.1) | Medium | 344365 |
| CVE-2026-48013 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | shopware | 4.1 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16232 | Check Point SmartConsole Authentication Bypass Run Script RCE | multi-domain security management | 9.3 (v4.0) | Critical | 344361 , 344363 |
| CVE-2026-12968 | Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload | Product Addons and Product Options With Custom Fields | 8.8 (v3.1) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | traefik | 7.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-12987 | Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration | Events Manager | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-65012 | InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder | InvokeAI | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65593 | n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters | n8n | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-8984 | Unauthenticated RCE | maxicharger single charger firmware | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8985 | Unauthenticated Command Injection | maxicharger single charger firmware | 10.0 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-47391 | PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool execution | PraisonAI | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-52472 | Wgcloud 3.6.4 SQL Injection Vulnerability | Wgcloud 3.6.4 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8986 | Command Injection via Malicious OCPP Server | maxicharger single charger firmware | 9.5 (v4.0) | Critical | 340014 , 340023 , 340193 , 344360 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 |
| CVE-2016-20096 | Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp | Linknat VOS3000 | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-64824 | Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore | Home Assistant Core | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-65008 | Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData | grav | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344365 , 344366 , 344370 , 393655 |
| CVE-2026-65057 | Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck | keep | 9.2 (v4.0) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65317 | Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass | Verba | 9.2 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-65318 | Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader | Verba | 9.2 (v4.0) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47731 | NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by u | AIT-Core | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-43945 | FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection | FUXA | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55084 | SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read | dhis2-core | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-47394 | PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate | PraisonAI | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-65056 | mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering | mcp-webresearch | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47398 | PraisonAI: Arbitrary code execution via unguarded spec.loader.exec_module in agents_generator.py - sibling of CVE-20 | PraisonAI | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50758 | DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability | DayuanJiang next-ai-draw-io 0.4.13 | 8.1 (v3.1) | High | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass | lmdeploy | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-52476 | aiflowy <= 2.1.2 SQL Injection Vulnerability | aiflowy <= 2.1.2 | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63080 | Aptabase SQL Injection via ClickHouse query backend | aptabase | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46556 | FlaskBB: SSRF in get_image_info() via unrestricted avatar URL | flaskbb | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-52475 | aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability | aiflowy <= 2.1.2 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13693 | Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal | Bit Form | 5.9 (v3.1) | Medium | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-16484 | SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16336 | trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect | trino | 5.3 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-64628 | Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16334 | itsourcecode Hospital Management System prescriptionorder.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16449 | zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection | ZS-Admin | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16451 | zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload | ZS-Admin | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-51027 | FileThingie v.2.5.7 Information Disclosure Vulnerability | - | 9.9 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-35048 | Piwigo RCE via PHP Code Injection into Config File in Installer | Piwigo | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-63766 | GPT-SoVITS 20250606v2pro OS Command Injection via webui.py | GPT-SoVITS | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-64625 | AVideo before 29.0 OS Command Injection via execAsync | AVideo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-13147 | WordPress Kirki < 6.0.12 - Server-Side Request Forgery | kirki | 9.1 (v3.1) | Critical | 320010 , 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35198 | HeyForm vulnerable to stored XSS via form field titles | heyform | 9.0 (v3.1) | Critical | 333140 , 333141 , 340095 , 342259 , 350147 , 350148 |
| CVE-2026-45270 | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | ci4ms | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-11349 | Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more | Modern Event Calendar Pro | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-40187 | Authenticated RCE via Malicious eTemplate Upload in EGroupware | egroupware | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63429 | HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context | heyform | 8.6 (v3.1) | High | 351000 |
| CVE-2026-45711 | Mailpit: Path traversal & arbitrary file write in mailpit dump –http via attacker-controlled message IDs | mailpit | 8.2 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-54910 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files | filebrowser | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | SlimStat Analytics | 7.5 (v3.1) | High | 333141 , 334168 , 340003 , 340099 , 340158 , 341099 , 342259 |
| CVE-2026-32820 | dataCycle Public Markdown Path Traversal Via /docs/*path | dataCycle-CORE | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34239 | Chamilo Authenticated Remote Code Execution | chamilo-lms | 7.5 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-46555 | WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration | whatsapp mcp server | 7.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-59238 | Stored XSS in Pentestify via unsanitized finding images and report client logo | Pentestify | 6.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write | all-in-one-wp-migration | 6.5 (v3.1) | Medium | 330791 , 340152 , 340748 , 344360 , 347006 , 390709 , 390716 |
| CVE-2026-45797 | HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload | heyform | 6.4 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-63107 | LimeSurvey SSRF via REST API Survey Template Host Header | LimeSurvey | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63731 | HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint | hyperdx | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63769 | Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method | huginn | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26483 | Mettle SendPortal 3.0.1 and earlier Cross-Site Scripting Vulnerability | Mettle SendPortal 3.0.1 and earlier | 6.1 (v3.1) | Medium | 333140 |
| CVE-2026-45709 | Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filte | mailpit | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63428 | HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's dec | heyform | 5.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 , 350147 , 350148 |
| CVE-2026-16252 | Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection | Multimedia Integrated Business Display System | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-45138 | CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule | ci4ms | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-44583 | Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module | Paymenter | 5.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-63730 | HyperDX < 2.31.0 SSRF via Webhook Test Endpoint | hyperdx | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63768 | cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State | cal.diy | 5.3 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | AVideo | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53594 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path | freescout | 4.9 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-46516 | Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) | frogman | 4.8 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password | Kirki | 4.3 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16244 | itsourcecode Hospital Management System prescriptionorderreport.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16227 | SourceCodester Class and Exam Timetabling System edit_subject.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16228 | SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16219 | Croogo CMS Admin File Manager FileManager.php isEditable path traversal | CMS | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16222 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery | CordysCRM | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16223 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery | CordysCRM | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16229 | itsourcecode Courier Management System index.php cross site scripting | Courier Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16205 | Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting | CMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16125 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16127 | zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16128 | zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16152 | SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16154 | SourceCodester Class and Exam Timetabling System edit_room1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57857 | Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter | Flow Payment | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 |
| CVE-2026-16124 | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery | GoClaw | 2.1 (v4.0) | Low | 334168 , 390719 |
| CVE-2026-16131 | itsourcecode Hospital Management System prescriptionrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16194 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery | CowAgent | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16088 | halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal | halo | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16129 | princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist | SafestClaw | 1.9 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8481 | Remote Code Execution via Code Validation Endpoint | langflow | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-36669 | ck_upload_handler.php in Feng Office 3.11.13.11 Arbitrary File Upload Vulnerability | ck upload handler.php in Feng Office 3.11.13.11 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-52348 | cool-admin-java 8.0.0 SQL Injection Vulnerability | cool-admin-java 8.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63030 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | WordPress | 9.8 (v3.1) | Critical | 340156 , 344370 |
| CVE-2026-9103 | Langflow OSS - Superuser Token Issuance | langflow | 9.8 (v3.1) | Critical | 300008 |
| CVE-2026-9198 | Langflow AI auto_login RCE | langflow | 9.8 (v3.1) | Critical | 300008 , 330791 , 340095 , 340152 |
| CVE-2026-9586 | Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection | switchvox | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-58195 | Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into ex | agentic-flow | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44739 | Pimcore: SQL Injection in Custom Reports Column Configuration | pimcore | 8.7 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-62234 | Grav < 2.0.4 SSRF via Unrestricted cURL Protocols | grav | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63094 | SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft | signoz | 7.6 (v4.0) | High | 344365 |
| CVE-2026-39359 | Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name | wazuh | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-50151 | oras-go: credential forwarding via unvalidated Location header in blob upload | oras | 7.5 (v3.1) | High | 390719 |
| CVE-2026-15094 | WP Hotel Booking <= 2.3.2 - Cross-Site Scripting | wp-hotel-booking | 6.1 (v3.1) | Medium | 300002 |
| CVE-2026-60137 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | WordPress | 5.9 (v3.1) | Medium | 340156 , 344370 |
| CVE-2026-16074 | AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery | AstrBot | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44181 | Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution | enterprise gateway | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44182 | Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering | enterprise gateway | 10.0 (v4.0) | Critical | 340014 , 344362 , 344363 , 344364 , 344366 |
| CVE-2026-45695 | Kopia Server 0.23.0 - Remote Code Execution | kopia | 9.8 (v3.1) | Critical | 393655 |
| CVE-2026-46562 | Yamcs: Remote Code Execution via Mission Database algorithm override | yamcs | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63304 | AVideo through 29.0 OS Command Injection via listFFmpegProcesses | AVideo | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-63305 | AVideo through 29.0 OS Command Injection via ffmpeg.json.php | AVideo | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-63306 | stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints | stoatchat | 9.2 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-46621 | Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection | yamcs | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-45868 | LogicalDOC Enterprise up to and for v9.1.1 SQL Injection Vulnerability | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-45870 | LogicalDOC Enterprise up to and for v9.1.1 Path Traversal Vulnerability | - | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-30623 | LiteLLM 1.18.10 - Command Injection | LiteLLM 1.18.10 | 9.8 (v3.1) | Critical | 320009 |
| CVE-2026-53513 | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration | better-auth/sso | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-45806 | Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url | penpot | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | directus | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-20297 | Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise | splunk | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33213 | Redash: Open redirect vulnerability in post-login redirect handling | redash | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-41580 | Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) | stirling pdf | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-61453 | Grav before 2.0.1 XSS via Twig String Concatenation | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36214 | osTicket Cross-Site Scripting Vulnerability | osTicket | 6.4 (v3.1) | Medium | 333140 , 342259 |
| CVE-2026-6875 | ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE | servicenow | 9.5 (v4.0) | Critical | 380026 |
| CVE-2026-60121 | Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php | flamingo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61498 | Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php | flamingo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-61875 | luci-app-upnp Stored XSS via UPnP Port Mapping Description | luci | 8.7 (v4.0) | High | 333140 , 333141 |
| CVE-2026-56281 | Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint | Capgo | 5.1 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57827 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 | rsfiles! | 10.0 (v4.0) | Critical | 351000 |
| CVE-2026-9282 | W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read | W3 Total Cache | 7.5 (v3.1) | High | 336461 , 344360 |
| CVE-2026-3576 | Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576) | Planyo online reservation system | 7.2 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2026-14894 | WordPress Super Forms <= 6.3.313 - Arbitrary File Upload | super-forms | 9.8 (v3.1) | Critical | 340748 |
| CVE-2025-30007 | HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management | control panel | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text | dify | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11977 | HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion | Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | 6.6 (v3.1) | Medium | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-56292 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection | acymailing | 9.2 (v4.0) | Critical | 340157 , 360147 , 360148 |
| CVE-2026-58192 | Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin | appium/storage-plugin | 10.0 (v3.1) | Critical | 340007 , 344360 |
| CVE-2026-41042 | Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution | gravitino | 9.1 (v3.1) | Critical | 344370 |
| CVE-2026-6854 | My Calendar < 3.7.9 - Unauthenticated SQL Injection | My Calendar – Accessible Event Manager | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2026-58191 | Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting | appium | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-60092 | AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-58657 | Grav - Stored CSS Injection via Markdown Image resize() Action | Grav | 4.8 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49471 | Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE | serena | 8.3 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55592 | Dashy <= 4.3.6 - Reflected XSS via Workspace | dashy | 3.9 (v3.1) | Low | 340112 , 346755 , 350148 |
| CVE-2024-14037 | Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob | Red Sea Cloud eHR | 9.3 (v4.0) | Critical | 351000 |
| CVE-2026-58455 | Dockwatch <= 0.6.567 - OS Command Injection | dockwatch | 9.2 (v4.0) | Critical | 344361 , 344363 |
| CVE-2026-59095 | LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl | lobehub | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-58467 | Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion | cockpit | 8.2 (v4.0) | High | 347009 |
| CVE-2025-71385 | Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint | netdata | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11387 | SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation | sms-alert | 9.8 (v3.1) | Critical | 377360 |
| CVE-2026-34100 | Guardian Language-System SQL Injection via id Parameter in media.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34101 | Guardian Language-System SQL Injection via id Parameter in text_file.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34102 | Guardian Language-System SQL Injection via id Parameter in job_info_get.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34103 | Guardian Language-System SQL Injection via id Parameter in subtitles.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34104 | Guardian Language-System SQL Injection via name Parameter in designer.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34105 | Guardian Language-System SQL Injection via id Parameter in translate_text.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13731 | WPBot <= 8.4.9 - Cross-Site Scripting | chatbot | 7.2 (v3.1) | High | 346755 |
| CVE-2026-58138 | Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution | conductor | 9.3 (v4.0) | Critical | 337209 , 337211 , 344366 , 380026 , 393655 |
| CVE-2026-58372 | SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys | seaweedfs | 7.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-56782 | Gorse < 0.5.10 - Unauthenticated Database Dump | gorse | 9.3 (v4.0) | Critical | 301007 |
| CVE-2026-50229 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilter | kestra | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-53576 | Kestra <= 1.3.20 - Remote Code Execution | kestra | 10.0 (v3.1) | Critical | 391213 |
| CVE-2025-10268 | Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path Tr | Printcart Web to Print Product Designer for WooCommerce | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-71334 | Flowise - Path Traversal | flowise | 9.3 (v4.0) | Critical | 340007 |
| CVE-2025-71336 | Flowise - Unsandboxed Remote Code Execution via Custom MCP | flowise | 9.3 (v4.0) | Critical | 334168 , 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-54836 | YMC Filter - SQL Injection | YMC Filter | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2025-71324 | Flowise - Path Traversal | flowise | 8.7 (v4.0) | High | 340007 |
| CVE-2026-53753 | Crawl4AI <= 0.8.6 - Remote Code Execution | crawl4ai | 10.0 (v3.1) | Critical | 350147 , 360151 , 380026 , 393655 |
| CVE-2026-28496 | FOSSBilling - Server-Side Template Injection | FOSSBilling | 9.4 (v4.0) | Critical | 340130 , 340155 , 341155 |
| CVE-2026-54157 | LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery | lobe-chat | 9.0 (v3.1) | Critical | 392301 |
| CVE-2026-54293 | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read | nltk | 7.5 (v3.1) | High | 347009 |
| CVE-2026-6858 | Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS | Transbank Webpay | 7.1 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56397 | SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README | SiYuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8713 | Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion | fusion-builder | 9.1 (v3.1) | Critical | 344360 |
| CVE-2017-20260 | Joomla! Component Price Alert 3.0.2 SQL Injection | price alert | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20261 | Joomla! Component Bargain Product VM3 1.0 SQL Injection | bargain product vm3 | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20263 | Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location | focalpoint | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20266 | Joomla SP Movie Database 1.3 SQL Injection via searchword | standard pro movie database | 8.8 (v4.0) | High | 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20267 | Joomla! Component Calendar Planner 1.0.1 SQL Injection | calendar planner | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20268 | Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection | zap calendar lite | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20269 | Joomla! Component KissGallery 1.0.0 SQL Injection | kissgallery | 8.8 (v4.0) | High | 340145 , 380122 |
| CVE-2017-20271 | Joomla StreetGuessr Game 1.1.8 SQL Injection via catid | streetguessr game | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20272 | Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id | ultimate property listing | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20273 | Joomla Event Registration Pro Calendar 4.1.3 SQL Injection | event registration pro calendar | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20274 | Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath | learning management system king | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20275 | Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter | bridge | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20276 | Joomla! Component SIMGenealogy 2.1.5 SQL Injection | simgenealogy | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20277 | Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author | joomla joomrecipe | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20278 | Joomla JoomRecipe 1.0.3 SQL Injection via category parameter | joomrecipe | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20279 | Joomla Payage 2.05 SQL Injection via aid Parameter | joomla payage | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20280 | Joomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter | myportfolio | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20281 | Joomla! Component Extra Search 2.2.8 SQL Injection | extra search | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20282 | Joomla! Component jCart for OpenCart 2.0 SQL Injection | jcart for opencart | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25748 | Joomla JHotelReservation 6.0.7 SQL Injection via search-hotels | jhotelreservation | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25750 | Joomla J-MultipleHotelReservation 6.0.7 SQL Injection | multiplehotelreservation | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25751 | Joomla J-ClassifiedsManager 3.0.5 SQL Injection | classifiedsmanager | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25752 | Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection | j-businessdirectory | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25756 | Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard | vaccount | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25749 | Joomla J-CruisePortal 6.0.4 SQL Injection via cruises | j-cruiseportal | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25761 | Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id | joomcrm | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25760 | Joomla! Component Easy Shop 1.2.3 Local File Inclusion | easy shop | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55746 | Cotonti stored XSS via PFS folder title | Cotonti | 7.0 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54386 | marimo < 0.23.9 XSS via file Query Parameter in assets.py | marimo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48017 | DbGate: Remote Code Execution via functionName injection in loadReader endpoint | dbgate | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9278 | Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure | Form Builder CP | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8385 | WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure | wp-google-maps | 5.3 (v3.1) | Medium | 344365 |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | python-utcp | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12211 | Intelbras iNVU 7016 FT Web syslog path traversal | iNVU 7016 FT | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-11442 | Allegra exportReport Directory Traversal Information Disclosure Vulnerability | Allegra | 6.5 (v3.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-6428 | Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter | Koha | 5.6 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Store Locator WordPress | 3.5 (v3.1) | Low | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-9062 | Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal | Store Locator WordPress | 3.4 (v3.1) | Low | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-35273 | Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE | peoplesoft enterprise peopletools | 9.8 (v3.1) | Critical | 331032 |
| CVE-2026-42647 | JoomSport <= 5.7.7 - SQL Injection | joomsport-sports-league-results-management | 9.3 (v3.1) | Critical | 341245 , 344366 , 380122 |
| CVE-2026-8071 | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass | Anti-Spam by CleanTalk. Spam protection | 8.8 (v3.1) | High | 331702 , 333140 , 333141 , 344370 , 346755 |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics | openemr | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-3326 | XStore Theme < 9.7.3 - SQL Injection | Xstore | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46491 | SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditi | simplesamlphp-module-casserver | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-3018 | WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection | Newsletters | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 |
| CVE-2026-44716 | Pipecat: Path Traversal in Pipecat Runner /files Endpoint — Arbitrary File Read via %2F-Encoded Separator | pipecat | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-49069 | WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) | WPZOOM Portfolio | 7.1 (v3.1) | High | 300026 |
| CVE-2026-9060 | Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style | Store Locator WordPress | 3.5 (v3.1) | Low | 346755 |
| CVE-2017-20251 | WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API | Woody Code Snippets | 9.3 (v4.0) | Critical | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2016-20062 | Simply Poll 1.4.1 Plugin for WordPress SQL Injection | Simply Poll | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2017-20243 | WordPress Car Park Booking Plugin SQL Injection via space_id | Car Park Booking System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20247 | WordPress Plugin PICA Photo Gallery 1.0 SQL Injection | PICA Photo Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20249 | WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection | Apptha Slider Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-36723 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | 8.8 (v3.1) | High | 340007 , 344360 , 390109 , 390709 |
| CVE-2026-8365 | Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy | Blocksy | 8.8 (v3.1) | High | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2017-20248 | WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download | Apptha Slider Gallery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-20250 | WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download | Mac Photo Gallery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-46746 | sinec ins OS Command Injection Vulnerability | sinec ins | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50636 | LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection | LimeSurvey | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-36783 | Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-36796 | Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-7542 | Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure | Slider Revolution | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-8977 | WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' | WP GDPR Cookie Consent | 6.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-11603 | Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter | Product Filter Widget for Elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-36725 | FastapiAdmin v2.2.0 Cross-Site Scripting Vulnerability | FastapiAdmin v2.2.0 | 6.1 (v3.1) | Medium | 333140 |
| CVE-2026-36722 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | 5.4 (v3.1) | Medium | 351000 |
| CVE-2026-25860 | OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler | OpenClinic GA | 5.3 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-36726 | bookcars v8.3 Path Traversal Vulnerability | bookcars v8.3 | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47106 | Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API | Banner Self-Service | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-46442 | Flowise < 3.1.2 - node-custom-function Unauthorized RCE | flowise | 9.4 (v4.0) | Critical | 345240 |
| CVE-2024-58348 | WordPress Background Image Cropper 1.2 Remote Code Execution | Background Image Cropper | 9.3 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54350 | WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated | Augmented Reality | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 , 393781 |
| CVE-2026-25559 | OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25855 | OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25856 | OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9506 | Path Traversal Vulnerability in Bagisto | Bagisto | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-46484 | Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user | headplane | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40519 | Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins() | nginx-proxy-manager | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-11474 | Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload | student-management-system | 5.5 (v4.0) | Medium | 351000 , 393655 |
| CVE-2026-11482 | SourceCodester Class and Exam Timetabling System archive5.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11483 | SourceCodester Class and Exam Timetabling System archive4.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11484 | SourceCodester Class and Exam Timetabling System archive3.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11485 | SourceCodester Class and Exam Timetabling System archive2.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11486 | SourceCodester Class and Exam Timetabling System archive1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11488 | code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection | Simple Flight Ticket Booking System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11489 | code-projects Online Music Site AdminDeleteAlbum.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11490 | code-projects Online Music Site Search.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11501 | SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11582 | CodeAstro Student Attendance Management System index.php sql injection | Student Attendance Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11569 | Quay: quay: stored xss via filedrop svg upload | Red Hat Quay 3 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-47983 | WordPress Plugin Stripe Payments 2.0.39 Stored XSS via currency_code | Accept Stripe Payments | 5.1 (v4.0) | Medium | 340095 , 346755 |
| CVE-2026-11467 | jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal | jshERP | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-11475 | Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection | student-management-system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11476 | Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization | student-management-system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11477 | hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect | hsweb-framework | 2.1 (v4.0) | Low | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-11495 | CodeAstro Ingredients Stock Management System add_stock.php sql injection | Ingredients Stock Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11506 | CodeAstro Leave Management System search_staff_for_deletion.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11507 | CodeAstro Leave Management System delete_leave_type.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11508 | CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11510 | CodeAstro Leave Management System add_leave.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11513 | itsourcecode Hospital Management System adminaccount.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11514 | itsourcecode Hospital Management System addpatient.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11518 | SourceCodester Inventory System User Management users.php cross site scripting | Inventory System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2026-11529 | designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection | mysql-mcp-server | 2.1 (v4.0) | Low | 340016 , 380122 |
| CVE-2026-11558 | CodeAstro Payroll System home_salary.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11559 | CodeAstro Payroll System view_account.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11583 | CodeAstro Student Attendance Management System createClass.php sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11584 | CodeAstro Student Attendance Management System createClass.php edit sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11585 | CodeAstro Student Attendance Management System createClassArms.php sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11502 | JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect | JeecgBoot | 1.3 (v4.0) | Low | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-11450 | GL.iNet GL-MT3000 Path Normalization dlopen command injection | GL-MT3000 | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-11456 | Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection | CRM | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9290 | WP User Manager – User Profile Builder & Membership - Local File Inclusion | wp-user-manager | 7.5 (v3.1) | High | 320017 |
| CVE-2026-7537 | MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Par | MDJM Event Management | 7.2 (v3.1) | High | 351000 |
| CVE-2026-9829 | Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Par | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-9281 | Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Se | Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | 6.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-11435 | Jinher OA nextselectplan.aspx sql injection | OA | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11408 | vertex-app vertex Log Viewer Endpoint LogMod.js os command injection | vertex | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-11412 | Jinher OA GetFormSn.aspx sql injection | OA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11434 | FluentCMS Blocks Plugin blocks cross site scripting | FluentCMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-48907 | Joomla! JCE extension < 2.9.99.5 unauthenticated RCE | jce | 10.0 (v4.0) | Critical | 333360 , 383871 |
| CVE-2026-49777 | WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE | Product Slider Pro for WooCommerce | 10.0 (v3.1) | Critical | 301006 |
| CVE-2026-10580 | Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover | Hippoo Mobile App for WooCommerce | 9.8 (v3.1) | Critical | 320008 , 330919 |
| CVE-2026-11419 | Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write | on-prem enterprise server | 9.4 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-11423 | Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation | Altium Enterprise Server | 9.4 (v4.0) | Critical | 344360 , 390709 |
| CVE-2026-46397 | haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 | haxcms-php | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-50230 | Lyrion Music Server <= 9.2.0 - Cross-Site Scripting | Lyrion Music Server | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390716 |
| CVE-2026-43986 | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | Tautulli | 9.9 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10880 | Unauthenticated SQL Injection in Osnexus Quantastor | QuantaStor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8037 | Progress ADC LoadMaster - Command Injection | connection manager for objectscale | 9.8 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35906 | An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability | - | 9.6 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2019-25727 | WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download | Ad Manager WD | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-25728 | Care2x 2.7 Hospital Information System SQL Injection via ck_config | Care2x | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25730 | Listing Hub CMS 1.0 SQL Injection via pages.php id | Listing Hub CMS | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25732 | PHP EI-Tube Script 3 SQL Injection via search parameter | EI-Tube | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25745 | WordPress Plugin Google Review Slider 6.1 SQL Injection via tid | Google Review Slider | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69755 | Neterbit NW-431F Router vNW-431F-20241014-IR03 Arbitrary Code Execution Vulnerability | - | 8.2 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-11111 | chrome Security Vulnerability | ExampleProduct | 8.1 (v3.1) | High | 340016 , 340162 |
| CVE-2026-10737 | SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure v | SP Project & Document Manager | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-10870 | Shibby Tomato Web UI rc start_dhcpc os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10871 | Shibby Tomato Web UI rc start_6rd_tunnel os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10873 | Shibby Tomato Web UI rstats rstats_path os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42538 | IRIS has an Insecure File Upload | iris-web | 6.3 (v3.1) | Medium | 351000 |
| CVE-2026-40605 | Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API | Tautulli | 5.7 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-25731 | Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact | Zuz Music | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2019-25739 | GigToDo Freelance Marketplace Script 1.3 Persistent XSS | GigToDo | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-42329 | Iris has an Open Redirect issue | iris-web | 4.7 (v3.1) | Medium | 344365 |
| CVE-2026-10806 | mjperpinosa stumasy add_post.php unrestricted upload | stumasy | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-10807 | mjperpinosa stumasy change_profile_image.php unrestricted upload | stumasy | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-10808 | itsourcecode Fees Management System manage_student.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10809 | itsourcecode Fees Management System manage_user.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10810 | itsourcecode Fees Management System navbar.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-10811 | itsourcecode Fees Management System receipt.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10874 | projectworlds Online Art Gallery Shop Project adminHome.php sql injection | Online Art Gallery Shop Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10875 | projectworlds Online Art Gallery Shop Project adminHome.ph sql injection | Online Art Gallery Shop Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-26379 | koha Server-Side Request Forgery Vulnerability | koha | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10694 | SourceCodester Online Food Ordering System index.php include file inclusion | Online Food Ordering System | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10704 | SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection | Pizzafy E-Commerce System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-26378 | koha Arbitrary Code Execution Vulnerability | koha | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42840 | ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals | ERPNext | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-43924 | FOSSBilling has an open redirect via administrator-configured redirect targets | FOSSBilling | 4.8 (v4.0) | Medium | 344365 |
| CVE-2026-10690 | wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery | DesktopCommanderMCP | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49143 | BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler | browserstack-runner | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5073 | WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection | armember | 7.5 (v3.1) | High | 320011 |
| CVE-2026-35718 | fd8136 firmware Path Traversal Vulnerability | fd8136 firmware | 6.5 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-49120 | Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint | medplum | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10620 | code-projects Student Admission System index.php sql injection | Student Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41412 | alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script | alf.io | 4.9 (v3.1) | Medium | 344360 |
| CVE-2026-10100 | Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting | Simple Custom Login Page | 4.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10301 | itsourcecode Fees Management System index.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-10302 | itsourcecode Fees Management System manage_fee.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10558 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2026-10559 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10568 | itsourcecode Fees Management System manage_payment.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10662 | ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery | blender-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10567 | 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting | CordysCRM | 2.0 (v4.0) | Low | 333140 , 333141 |
| CVE-2026-10583 | nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery | GoClaw | 2.0 (v4.0) | Low | 334168 , 390719 |
| CVE-2026-10514 | 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting | CordysCRM | 1.9 (v4.0) | Low | 333140 |
| CVE-2026-10529 | westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting | CicadasCMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2026-44825 | Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials | solr | 9.8 (v3.1) | Critical | 330925 |
| CVE-2018-25428 | Paroiciel 11.20 SQL Injection via tRecIdListe Parameter | Paroiciel | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25433 | Joomla JE Photo Gallery 1.1 SQL Injection via categoryid | JE Photo Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25434 | WP AutoSuggest 0.24 SQL Injection via autosuggest.php | WP AutoSuggest | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-43624 | F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project() | F5-TTS | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-45505 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia addNetworkConnector Discovery Wrapper Bypass | activemq | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42588 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector | activemq | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25429 | Paroiciel 11.20 SQL Injection via zProIdPro Parameter | Paroiciel | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25430 | Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter | Paroiciel | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25431 | No-Cms 1.0 SQL Injection via order_by Parameter | No-CMS | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42253 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties | activemq | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-10214 | zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection | chatgpt-on-wechat | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-10249 | itsourcecode Online Blood Bank Management System viewrequest.php sql injection | Online Blood Bank Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10250 | itsourcecode Online Blood Bank Management System campsdetails.php sql injection | Online Blood Bank Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10251 | itsourcecode Online House Rental System ajax.php login sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-10252 | itsourcecode Online House Rental System manage_tenant.php sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10253 | itsourcecode Online House Rental System manage_payment.php sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10260 | CodeAstro Online Job Portal delete-jobs.php sql injection | Online Job Portal | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10261 | CodeAstro Online Job Portal application_status.php sql injection | Online Job Portal | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10262 | code-projects Real State Services Login loginuser.php sql injection | Real State Services | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10263 | SourceCodester Computer Repair Shop Management System manage_product.php sql injection | Computer Repair Shop Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10280 | horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery | mcpilot | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10287 | SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery | SEO Meta Tag Extractor | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-49138 | Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following | nanobot | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48559 | Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags | lms | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10202 | OFCMS JSON Query SystemDictController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10203 | OFCMS JSON Query SystemParamController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10204 | OFCMS JSON Query SysUserController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10209 | code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection | Online Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10213 | AstrBotDevs AstrBot API Endpoint delete path traversal | AstrBot | 2.1 (v4.0) | Low | 340007 , 344360 |
| CVE-2026-10239 | JeecgBoot edit WordUtil.addImage server-side request forgery | JeecgBoot | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10240 | JeecgBoot test server-side request forgery | the file /airag/airagModel/test | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10241 | jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet | The server processes these URLs | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10256 | itsourcecode Content Management System save_comment.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10258 | itsourcecode Content Management System add_sub_topic.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10265 | itsourcecode Content Management System edit_topic.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10274 | indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery | aem-mcp-server | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10276 | hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery | Jenkins-server-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10278 | ishayoyo excel-mcp read_file/write_file index.ts path traversal | excel-mcp | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-10279 | hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection | wezterm-mcp | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10286 | CodeAstro Payroll System home_employee.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10289 | code-projects Hotel and Tourism Reservation System tour.php cross site scripting | Hotel and Tourism Reservation System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10296 | itsourcecode Fees Management System ajax.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-10297 | itsourcecode Fees Management System manage_course.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10228 | raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting | student management system by php | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49489 | OpenCATS - SQL Injection in DataGrid sortDirection Parameter | OpenCATS | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10178 | code-projects Online Music Site AdminEditAlbum.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10186 | code-projects Online Hospital Management System patient.php sql injection | Online Hospital Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10170 | code-projects Visitor Management System phone_0.php sql injection | Visitor Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10172 | Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload | Multi-Store Inventory Management System | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10193 | OFCMS ComnController ComnController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10155 | Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection | Multi-Store Inventory Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10171 | code-projects Online Music Site AdminUpdateAlbum.php sql injection | Online Music Site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25412 | Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php | deltasql | 9.3 (v4.0) | Critical | 351000 |
| CVE-2018-25411 | MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php | MGB OpenSource Guestbook | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25413 | AiOPMSD Final 1.0.0 SQL Injection via search.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25414 | AiOPMSD Final 1.0.0 SQL Injection via actor.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25416 | AiOPMSD Final 1.0.0 SQL Injection via country.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25417 | AiOPMSD Final 1.0.0 SQL Injection via quality.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25418 | AiOPMSD Final 1.0.0 SQL Injection via year.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25419 | AiOPMSD Final 1.0.0 SQL Injection via genre.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25420 | AiOPMSD Final 1.0.0 SQL Injection via watch.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25422 | MOGG web simulator Script All Version SQL Injection via play.php | MOGG web simulator Script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25424 | Gate Pass Management System 2.1 SQL Injection via login-exec.php | Gate Pass Management System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25425 | Yot CMS 3.3.1 SQL Injection via aid and cid Parameters | Yot CMS | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25409 | SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php | SIM-PKH | 8.7 (v4.0) | High | 351000 |
| CVE-2018-25410 | SIM-PKH 2.4.1 SQL Injection via media.php id Parameter | SIM-PKH | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25421 | Open STA Manager 2.3 Arbitrary File Download via Path Traversal | Open STA Manager | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10112 | sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting | STUDENT-MANAGEMENT-SYSTEM | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-45629 | Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-45632 | Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45668 | Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) | Trilium | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-45630 | Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement | dokploy | 9.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25385 | E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai | Registrasi Pencak Silat | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25386 | HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php | HaPe PKH | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25394 | Kados R10 GreenBee SQL Injection via update_release.php | Kados R10 GreenBee | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25395 | Kados R10 GreenBee SQL Injection via update_feature.php | Kados R10 GreenBee | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-45578 | WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | avideo | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45662 | Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) | dokploy | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10108 | xiaomusic 0.5.7 Path Traversal via GET /music endpoint | xiaomusic | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | haxcms-nodejs | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-44238 | FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | freepbx | 8.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46372 | SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl | SillyTavern | 8.5 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44285 | FastGPT: SSRF Protection Bypass via externalFile in Dataset Preview API | FastGPT | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-47179 | Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane | arcane | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard Module | freepbx | 7.6 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-25392 | MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter | MaxOn ERP | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25393 | Navigate CMS 2.8.5 Path Traversal via navigate_download.php | Navigate CMS | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10107 | MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint | MoviePilot | 7.0 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44652 | SillyTavern: SSRF vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45731 | WWBN AVideo: Authenticated Arbitrary File Read in view/update.php | avideo | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-46337 | WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in view/img/image404Raw.php | avideo | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39229 | Bolt CMS through 3.7.0 SQL Injection Vulnerability | - | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-44287 | FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassable | FastGPT | 6.3 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45626 | Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter | arcane | 6.3 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-36324 | SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45580 | WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | avideo | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write | groupoffice | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10052 | Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints | Red Hat Quay 3 | 4.1 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44881 | Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update | portainer | 8.5 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-45344 | LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances | LinkAce | 8.1 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45087 | Dalfox Found-Action Deserialization RCE | dalfox | 10.0 (v3.1) | Critical | 330791 , 340152 |
| CVE-2026-8054 | dotCMS Core Publish Audit API - Unauthenticated SQL Injection | dotcms | 10.0 (v4.0) | Critical | 340145 , 340156 , 344366 |
| CVE-2026-44886 | Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection | Pi.Alert | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-6565 | Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via | Style Kits for Elementor | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-3001 | Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting | gutenverse | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2026-9606 | itsourcecode Courier Management System manage_user.php sql injection | Courier Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9607 | itsourcecode Courier Management System parcel_list.php sql injection | Courier Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9608 | QianFox FoxCMS Administrator Backend edit cross site scripting | FoxCMS | 1.9 (v4.0) | Low | 340095 , 346755 |
| CVE-2026-44450 | Lumiverse: RCE via MCP stdio argument injection | Lumiverse | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-48687 | fastnetmon Command Injection Vulnerability | fastnetmon | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-43982 | Algernon: Path traversal file write via savein() | algernon | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44669 | Faction: Stored XSS in Assessment Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42425 | OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery | OpenKM Community Edition | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42785 | OpenKM 6.3.12 Remote Code Execution via Administrative Scripting | OpenKM Community Edition | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-45298 | Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) | dozzle | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44706 | Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values | chatwoot | 8.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48126 | Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir | algernon | 8.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48695 | fastnetmon Command Injection Vulnerability | fastnetmon | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45082 | Karakeep has a SSRF Protection Bypass via Redirect Handling | karakeep | 7.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-41917 | OpenKM 6.3.12 Local File Inclusion via Admin Scripting | OpenKM Community Edition | 6.9 (v4.0) | Medium | 344360 , 347009 |
| CVE-2026-48710 | Starlette - Improper Validation of Unsafe Equivalence in Input | starlette | 6.5 (v3.1) | Medium | 320009 |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy | MaxKB | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-9525 | itsourcecode Electronic Judging System edit_judge.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9526 | itsourcecode Electronic Judging System edit_team.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9528 | itsourcecode Electronic Judging System delete_judge.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9573 | itsourcecode Student Transcript Processing System index.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9574 | itsourcecode Student Transcript Processing System trans.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9575 | itsourcecode Student Transcript Processing System index.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9584 | code-projects Project Management System Login chk.php sql injection | Project Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9524 | xianrendzw EasyReport REST Endpoint execute sql injection | EasyReport | 5.3 (v4.0) | Medium | 340017 , 340145 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch | MaxKB | 5.1 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-36239 | PbootCMS v.3.2.11 Cross-site Scripting Vulnerability | PbootCMS v.3.2.11 | 4.3 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-43936 | e107: Server-Side Request Forgery (SSRF) in the remote file fetcher | e107 | 4.3 (v3.1) | Medium | 337109 , 337110 , 341737 , 341738 , 344360 , 398021 , 398022 |
| CVE-2026-9515 | Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9518 | hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting | CodeIgniter-StudentManagementSystem | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9531 | Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9532 | Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9533 | Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9534 | Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9542 | CodeAstro Leave Management System add_staff.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9405 | Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9406 | Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9407 | Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9408 | Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9432 | Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9433 | Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9434 | Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9435 | Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9436 | Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9454 | Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9455 | Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9456 | Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9457 | Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9458 | Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9475 | Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-9476 | Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9477 | Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9478 | Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25362 | Twitter-Clone 1 SQL Injection via follow.php | PHP-Twitter-Clone | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25364 | Twitter-Clone 1 SQL Injection via search.php | PHP-Twitter-Clone | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25371 | mooSocial Store Plugin 2.6 SQL Injection via product parameter | mooSocial Store Plugin | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25372 | MedDream PACS Server Premium 6.7.1.1 SQL Injection via email | PACS Server Premium | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2018-25374 | Softneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal | MedDream PACS Server Premium | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9469 | yashpokharna2555 StudentManagementSystem success.php sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9470 | yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9474 | yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9424 | Edimax EW-7438RPn Content-Type formWlanMP os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9450 | code-projects Employee Management System psubmit.php sql injection | Employee Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9451 | code-projects Employee Management System applyleaveprocess.php sql injection | Employee Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9473 | c-rick jimeng-mcp api.ts generateVideo path traversal | jimeng-mcp | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-9511 | Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9512 | Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9514 | Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9464 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery | yudao-cloud | 2.0 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-9384 | Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9385 | Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-9386 | Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9387 | Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9388 | Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9404 | Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9355 | SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9356 | SourceCodester Hospitals Patient Records Management System manage_history.php sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9364 | projectworlds Online Art Gallery Shop adminHome.php sql injection | Online Art Gallery Shop | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9372 | ItzCrazyKns Vane Model Provider API route.ts server-side request forgery | Vane | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-9383 | itsourcecode Electronic Judging System login.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9347 | Edimax EW-7438RPn webs formWizSurvey os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25357 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | dolibarr erp/crm | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 |
| CVE-2018-25340 | Smartshop 1 SQL Injection via category.php | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25341 | Smartshop 1 SQL Injection via product.php id Parameter | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25342 | Smartshop 1 SQL Injection via search.php | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25348 | Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail | Ek Rishta | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25351 | Joomla! Component EkRishta 2.10 SQL Injection via username | EkRishta | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25346 | WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php | Form Maker | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2018-25352 | WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id | Ultimate Form Builder Lite | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9302 | 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection | vps-inventory-monitoring | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9342 | SourceCodester Hospitals Patient Records Management System view_history.php sql injection | Hospitals Patient Records Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9343 | Edimax EW-7438RPn webs formWpsStart os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls | typebot.io | 10.0 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41075 | RT: SQL injection via entry_aggregator parameter in JSON search | rt | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-28445 | Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview | typebot.io | 8.7 (v3.1) | High | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-41147 | NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class | nukeviet | 8.7 (v3.1) | High | 333140 |
| CVE-2026-39965 | TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks | typebot.io | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-45145 | Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40598 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | mantisbt | 6.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36227 | Easy Chat Server 3.1 Arbitrary Code Execution Vulnerability | Easy Chat Server 3.1 | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-40295 | Devise: Open Redirect via Unvalidated request.referrer in Timeoutable Session Timeout Handler | devise | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7798 | FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 5.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 340464 , 340465 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48231 | Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48232 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48233 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48234 | Open ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48236 | Open ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48237 | Open ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48238 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48239 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48240 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-4093 | Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) | taxonomy term reference tree widget | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 |
| CVE-2026-48214 | Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48215 | Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48218 | Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48219 | Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48220 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48221 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48222 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48223 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48224 | Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48225 | Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48226 | Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7890 | Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block | concrete cms | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-8139 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName | concrete cms | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9082 | Drupal Core PostgreSQL EntityQuery SQL Injection | drupal | 9.8 (v3.1) | Critical | 340087 , 340145 , 340156 , 341245 |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | xwiki-commons | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-7467 | Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation | expand-maker | 8.8 (v3.1) | High | 377360 |
| CVE-2026-39352 | Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal | frappe | 8.7 (v4.0) | High | 340007 , 340029 , 344360 , 344370 , 390709 |
| CVE-2026-9133 | Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read | RabbitMQ AWS | 8.3 (v4.0) | High | 344360 |
| CVE-2026-3985 | Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uu | Creative Mail – Easier WordPress & WooCommerce Email Marketing | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-7460 | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | mailcow-dockerized | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 , 350147 , 350148 |
| CVE-2026-35593 | Trilium Notes has Local File Inclusion via upload modified file API endpoint | Trilium | 6.8 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-39311 | Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments | Trilium | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 341099 , 342259 , 344363 |
| CVE-2026-8685 | Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter | Infility Global | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-26028 | CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS | cryptpad | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5776 | Email Encoder < 2.4.7 - Unauthenticated Stored XSS | Email Encoder | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 |
| CVE-2026-8626 | SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter | SponsorMe | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-39960 | MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values | mantisbt | 5.4 (v3.1) | Medium | 333140 , 341256 |
| CVE-2026-6394 | Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter | Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | 5.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35016 | Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34234 | CtrlPanel <= 1.1.1 - Remote Code Execution | ctrlpanel | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-30118 | scalar/astro v0.1.13 was discovered to Server-Side Request Forgery Vulnerability | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-37281 | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-4885 | Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload | Piotnet Addons For Elementor Pro | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-46725 | TYPO3 ceselector Extension - Insecure Deserialization | ceselector | 9.2 (v4.0) | Critical | 360153 |
| CVE-2026-31069 | BillaBear (all versions prior to Jan 2026) SQL Injection Vulnerability | BillaBear (all versions prior to Jan 2026) | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34216 | CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php | panel | 6.6 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34246 | CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output | panel | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2026-29962 | HSC MailInspector - Local File Inclusion | mailinspector | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | facturascripts | 7.2 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2025-65954 | SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout | simplesamlphp-module-casserver | 6.1 (v3.1) | Medium | 344365 |
| CVE-2020-37242 | WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx | Ultimate Maps | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-37243 | WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS | Pricing Table | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-37244 | WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx | Membership | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-37235 | WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component | Theme Wibar | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-37236 | NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel | NewsLister | 5.1 (v4.0) | Medium | 333141 , 340087 , 340095 , 340099 , 340247 , 340248 , 341099 , 341266 , 342259 |
| CVE-2026-23695 | Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template | Cockpit | 5.1 (v4.0) | Medium | 333140 , 342259 |
| CVE-2026-42596 | Gotenberg < 8.31.0 - Server-Side Request Forgery | gotenberg | 9.4 (v3.1) | Critical | 344362 , 398004 |
| CVE-2026-42281 | MagicMirror <= 2.35.0 - Server-Side Request Forgery | magicmirror | 9.2 (v4.0) | Critical | 398001 |
| CVE-2026-43644 | podinfo 6.11.2 Reflected XSS via /echo Endpoint | podinfo | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-42578 | Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation | netty | 2.9 (v4.0) | Low | 390719 |
| CVE-2026-44262 | Scramble Laravel - Remote Code Execution | scramble | 9.4 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2026-44343 | WGDashboard < 4.3.2 - Unauthenticated File Read | wgdashboard | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-2614 | MLflow <= 3.9.0 - Arbitrary File Read | mlflow | 7.5 (v3.1) | High | 398008 |
| CVE-2026-6433 | FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution | custom-css-js-php | 7.3 (v3.1) | High | 340016 , 340017 , 360147 , 360148 |
| CVE-2026-6093 | Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping | corteza | 6.0 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42188 | Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL | geyser | 4.3 (v3.1) | Medium | 337109 , 337110 , 398021 , 398022 |
| CVE-2026-8264 | Tenda AC6 httpd WifiApScan formWifiApScan os command injection | ac6 firmware | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8259 | Tenda AC6 httpd telnet os command injection | ac6 firmware | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8265 | Tenda AC6 httpd getLogFile get_log_file os command injection | ac6 firmware | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2021-47940 | WordPress Download From Files 1.48 Arbitrary File Upload | Download From Files | 9.3 (v4.0) | Critical | 351000 |
| CVE-2021-47928 | Opencart TMD Vendor System 3.x Blind SQL Injection via product route | Extension TMD Vendor System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-47930 | Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated | Balbooa Joomla Forms Builder | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-47938 | ImpressCMS 1.4.2 Remote Code Execution via Autotasks | ImpressCMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2021-47939 | Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation | Evolution CMS | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2021-47943 | TextPattern CMS 4.8.7 Remote Code Execution via File Upload | TextPattern CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2022-50944 | Aero CMS 0.0.1 PHP Code Injection via posts.php | Aero CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50954 | WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion | cab-fare-calculator | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-50956 | WordPress Plugin amministrazione-aperta 3.7.3 Local File Read | amministrazione-aperta | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-47931 | Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication | Exponent CMS | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-47947 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php | Projectsend | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50948 | Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting | Motopress Hotel Booking Lite | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50958 | WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php | Jetpack | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50959 | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php | Contact Form Builder | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50960 | WordPress International Sms Contact Form 7 Integration 1.2 XSS | International Sms For Contact Form | 5.1 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2022-50961 | WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS | IP2Location Country Blocker | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50970 | WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter | WordPress Plugin AAWP | 5.1 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-8227 | Wavlink NU516U1 adm.cgi wzdapMesh os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8228 | Wavlink NU516U1 wireless.cgi advance os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8229 | Wavlink NU516U1 wireless.cgi WifiBasic os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8230 | Wavlink NU516U1 login.cgi sys_login1 os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8231 | CodeAstro Online Catering Ordering System deleteorder.php sql injection | Online Catering Ordering System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-44313 | LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function | linkwarden | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42455 | LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) | linkwarden | 8.8 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-42605 | AzuraCast: Path Traversal in currentDirectory Parameter Enables Remote Code Execution via Media Upload | azuracast | 8.8 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-8188 | Wavlink NU516U1 adm.cgi change_wifi_password os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8189 | Wavlink NU516U1 adm.cgi wzdrepeater os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8190 | Wavlink NU516U1 adm.cgi wan os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8191 | Wavlink NU516U1 adm.cgi wifi_region os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-8192 | Wavlink NU516U1 adm.cgi wzdap os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42454 | Termix: OS Command Injection in Docker Container Management Endpoints | Termix | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-42208 | BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner | litellm | 9.3 (v4.0) | Critical | 340156 |
| CVE-2024-51092 | LibreNMS Authenticated RCE (CVE-2024-51092) | librenms | 9.1 (v3.1) | Critical | 340007 , 344361 , 344363 |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42271 | BerriAI LiteLLM Proxy MCP Test Endpoint Command Execution | litellm | 8.7 (v4.0) | High | 330791 , 340152 |
| CVE-2026-42345 | FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, a | FastGPT | 7.7 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-42344 | OpenCMS - XML external entity (XXE) | opencms | 7.3 (v3.1) | High | 330791 , 340152 , 344372 |
| CVE-2024-33288 | Prison Management System - SQL Injection Authentication Bypass | prison management system | 7.3 (v3.1) | High | 341245 |
| CVE-2024-45257 | BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257) | - | 7.3 (v3.1) | High | 344360 , 344363 |
| CVE-2024-46507 | Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE | yeti | 7.3 (v3.1) | High | 340130 , 360151 |
| CVE-2025-67888 | Control Web Panel /admin/index.php Unauthenticated RCE | - | 7.3 (v3.1) | High | 393655 |
| CVE-2026-42339 | New API: SSRF Filter Bypass via 0.0.0.0 | new api | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42344 | FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints | FastGPT | 6.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44284 | FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution | FastGPT | 6.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2023-42343 | OpenCMS - Cross-Site Scripting | opencms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2024-33724 | SOPlanning 1.52.00 Cross Site Scripting | soplanning | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42350 | Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter | kargo | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-44286 | FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation | FastGPT | 2.3 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-40281 | Gotenberg <= 8.30.1 - Remote Code Execution | gotenberg | 9.1 (v3.1) | Critical | 393655 |
| CVE-2026-38428 | kestra SQL Injection Vulnerability | kestra | 9.8 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-38431 | erpnext Code Injection Vulnerability | erpnext | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-33324 | SQLBot prompt injection allows arbitrary SQL execution and remote code execution | sqlbot | 9.4 (v4.0) | Critical | 340014 , 340016 , 340017 , 340023 , 340029 , 340157 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-40329 | SQL Injection vulnerability via sortBy in beanFeed | MasaCMS | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-40330 | Masa CMS SQL injection via sortDirection parameter in beanFeed | MasaCMS | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7412 | Eclipse BaSyx SSRF Vulnerability | Eclipse BaSyx | 8.6 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-40075 | OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet | openmrs | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40280 | Gotenberg <= 8.30.1 - Server Side Request Forgery | gotenberg | 7.8 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 344362 , 398021 , 398022 |
| CVE-2026-39383 | Gotenberg unauthenticated blind SSRF via unfiltered webhook URL | gotenberg | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2025-61669 | jupyter_server next parameter open redirect can redirect users to external domains | jupyter server | 6.3 (v4.0) | Medium | 344365 |
| CVE-2026-38432 | erpnext Cross-Site Scripting Vulnerability | erpnext | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38947 | FluentCMS 1.2.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-42796 | Arelle < 2.39.10 - Remote Code Execution | arelle | 9.2 (v4.0) | Critical | 340162 , 340163 |
| CVE-2026-7700 | langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection | langflow | 2.1 (v4.0) | Low | 390716 , 390719 |
| CVE-2026-4060 | Geo Mashup <= 1.13.18 - SQL Injection | Geo Mashup | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2026-6229 | Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter | Royal Addons for Elementor – Addons and Templates Kit for Elementor | 7.2 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-71284 | Synway SMG Gateway Management Software OS Command Injection via radius_address | smg gateway management software | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-41940 | cPanel & WHM - Authentication Bypass via Session-File CRLF Injection | cpanel | 9.3 (v4.0) | Critical | 377364 |
| CVE-2026-27760 | OpenCATS Installer PHP Code Injection | OpenCATS | 9.2 (v4.0) | Critical | 340128 , 341245 , 344363 , 344370 , 346755 , 360152 , 360153 , 380018 , 390801 |
| CVE-2026-7202 | Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7203 | Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7204 | Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41363 | OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter | openclaw | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-7205 | duartium papers-mcp-server main.py search_papers path traversal | papers-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7206 | dubydu sqlite-mcp entry.py extract_to_json sql injection | sqlite-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7212 | edvardlindelof notes-mcp notes_mcp.py path traversal | notes-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7214 | eghuzefa engineer-your-data server.py file_inf path traversal | engineer-your-data | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7216 | donchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal | processing-claude-mcp-bridge | 5.5 (v4.0) | Medium | 344360 , 390709 |
| CVE-2026-7217 | Deepractice PromptX Document File index.ts read_pdf absolute path traversal | PromptX | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7220 | jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection | FastlyMCP | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery | CloudBase-MCP | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7223 | BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery | HyperChat | 5.5 (v4.0) | Medium | 334168 , 390719 |
| CVE-2026-7314 | eiceblue spire-doc-mcp-server base.py get_doc_path path traversal | spire-doc-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7315 | eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal | spire-pdf-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7319 | elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal | execution-system-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 |
| CVE-2026-7196 | CodeAstro Online Classroom guestdetails sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7222 | code-projects Coaching Management System Complaint Form complaint.php cross site scripting | Coaching Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery | nextchat | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7194 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection | Pharmacy Sales and Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-7064 | AgentDeskAI browser-tools-mcp browser-connector.ts os command injection | browser-tools-mcp | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-40466 | Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass | activemq | 8.8 (v3.1) | High | 330925 , 340162 , 340163 |
| CVE-2026-41473 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints | cyberpanel | 8.8 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41472 | CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard | cyberpanel | 5.3 (v4.0) | Medium | 333140 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41679 | Paperclip AI RCE using a chain of six API calls (CVE-2026-41679). | paperclipai | 10.0 (v3.1) | Critical | 330791 , 340152 |
| CVE-2026-41179 | RClone RC - Command Injection | rclone | 9.2 (v4.0) | Critical | 340014 , 344370 |
| CVE-2026-41264 | Flowise CSV Agent Prompt Injection RCE | flowise | 9.2 (v4.0) | Critical | 330791 , 340011 , 340152 |
| CVE-2026-34415 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34413 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34414 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-41459 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-41029 | SQL injection in Zeon Academy Pro by Zeon Global Tech | Zeon Academy Pro | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-40887 | Vendure Core - SQL Injection | vendure | 9.1 (v3.1) | Critical | 340156 , 340157 , 341245 , 344361 , 344363 , 360147 , 360148 |
| CVE-2026-41456 | Bludit CMS <= 3.20.0 - Cross-Site Scripting | bludit | 5.1 (v4.0) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2026-5718 | Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution | drag-and-drop-multiple-file-upload-contact-form-7 | 8.1 (v3.1) | High | 382238 |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-40105 | XWiki - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39808 | Fortinet FortiSandbox - Command Injection | fortisandbox | 9.8 (v3.1) | Critical | 344363 |
| CVE-2026-24893 | openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion | openitcockpit | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35031 | Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain | jellyfin | 8.8 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35196 | Chamilo LMS has OS Command Injection via export_all_certificates action | chamilo lms | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | 8.6 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35032 | Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner | jellyfin | 8.6 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action | chamilo lms | 7.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-39387 | BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter | boidcms | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33714 | Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) | chamilo lms | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34212 | Docmost page content has stored XSS via unsanitized attachment URLs | docmost | 5.4 (v3.1) | Medium | 333140 |
| CVE-2026-34161 | Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution | chamilo lms | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-4810 | Google ADK-Python - Unauthenticated Builder Endpoint | adk-python | 9.3 (v4.0) | Critical | 390726 , 392647 |
| CVE-2026-33534 | EspoCRM <= 9.3.3 - Server-Side Request Forgery | espocrm | 4.3 (v3.1) | Medium | 398003 |
| CVE-2019-25710 | Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter | dolibarr erp/crm | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14545 | YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation | YML for Yandex Market | 6.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 382238 , 390501 , 393655 |
| CVE-2025-66447 | Chamilo LMS has validation-less redirect on login page | chamilo lms | 4.7 (v3.1) | Medium | 344365 |
| CVE-2023-54359 | WordPress adivaha Travel Plugin 2.3 SQL Injection via pid | WordPress adivaha Travel Plugin | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5814 | PHPGurukul Online Course Registration check_availability.php sql injection | Online Course Registration | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5824 | code-projects Simple Laundry System userchecklogin.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5827 | code-projects Simple IT Discussion Forum question-function.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340147 , 340148 , 340156 , 341256 , 342259 , 346755 |
| CVE-2026-5829 | code-projects Simple IT Discussion Forum content.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2026-5832 | atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery | api-lab-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2023-54358 | WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile | WordPress adivaha Travel Plugin | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-54361 | Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword | Joomla iProperty Real Estate | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-54362 | Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword | Cart | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5823 | itsourcecode Construction Management System borrowed_tool_report.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5834 | code-projects Online Shoe Store admin_running.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-5835 | code-projects Online Shoe Store admin_football.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-5836 | code-projects Online Shoe Store admin_product.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-2942 | ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess | ProSolution WP Client | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-31040 | stata-mcp Code Injection Vulnerability | stata-mcp | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-3296 | Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder | 9.8 (v3.1) | Critical | 300007 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-3535 | DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter | DSGVO Google Web Fonts GDPR | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-39394 | CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controller | ci4ms | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 |
| CVE-2026-3396 | WCAPF WooCommerce Ajax Product Filter - SQL Injection | WCAPF – Ajax Product Filter for WooCommerce | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2026-39844 | NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization | nicegui | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-5802 | idachev mcp-javadc HTTP os command injection | mcp-javadc | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5805 | code-projects Easy Blog Site contact_us.php sql injection | Easy Blog Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5813 | PHPGurukul Online Course Registration check_availability.php sql injection | Online Course Registration | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35455 | immich has Stored XSS via OCR Text in 360° Panorama Viewer | immich | 5.4 (v3.1) | Medium | 333140 , 333141 , 340147 , 341256 , 346755 |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39390 | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | ci4ms | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39392 | CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization | ci4ms | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-4406 | Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter | Gravity Forms | 4.7 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-5803 | bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery | openai-realtime-ui | 2.1 (v4.0) | Low | 337109 , 340162 , 347009 , 390722 |
| CVE-2026-5806 | code-projects Easy Blog Site update.php cross site scripting | Easy Blog Site | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-0740 | Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload | ninja forms file uploads | 9.8 (v3.1) | Critical | 382238 |
| CVE-2026-23696 | Windmill < 1.603.3 - SQL Injection | windmill | 9.4 (v4.0) | Critical | 341245 |
| CVE-2026-39342 | ChurchCRM has a SQL injection searchwhat parameter via QueryView.php | churchcrm | 9.4 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34197 | Apache ActiveMQ - Remote Code Execution | activemq | 8.8 (v3.1) | High | 330925 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | vite | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39364 | Vite Dev Server - Directory Traversal | vite | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39341 | SQL injection in ChurchCRM.0 | churchcrm | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39361 | OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url | openobserve | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39369 | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | avideo | 7.6 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-39847 | Emmett has a path traversal in internal assets handler | emmett | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39343 | ChurchCRM has a SQL Injection in Event Type Editor (Admin) | churchcrm | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39370 | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr | avideo | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5739 | PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection | PowerJob | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39368 | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | avideo | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34371 | LibreChat Affected by Arbitrary File Write via execute_code Artifact Filename Traversal | librechat | 6.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-39365 | Vite has a Path Traversal in Optimized Deps .map Handling | vite | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5692 | Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5736 | PowerJob detailPlus Endpoint InstanceController.java sql injection | PowerJob | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5741 | suvarchal docker-mcp-server HTTP index.ts pull_image os command injection | docker-mcp-server | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39380 | Open Source Point of Sale has Stored XSS in Stock Location (Configuration) | open source point of sale | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5719 | itsourcecode Construction Management System borrowedtool.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340145 , 340156 , 341145 , 380122 , 390572 |
| CVE-2026-34976 | Dgraph <=v25.3.0 - Admin Mutation Missing Authorization | dgraph | 10.0 (v3.1) | Critical | 398008 |
| CVE-2026-35471 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs | goshs | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-35395 | WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter | wegia | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35470 | OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals | openstamanager | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35029 | LiteLLM - Arbitrary File Read | litellm | 8.7 (v4.0) | High | 344360 , 390709 |
| CVE-2026-35184 | EcclesiaCRM has a Critical SQL Injection | ecclesiacrm | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34885 | WordPress Media Library Assistant <= 3.34 - SQL Injection | Media LIbrary Assistant | 8.5 (v3.1) | High | 377360 |
| CVE-2026-35174 | Chyrp Lite has a Path Traversal to Remote Code Execution | chyrp lite | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-35404 | Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter | openedx | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-5631 | assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection | gpt-researcher | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5634 | projectworlds Car Rental Project Parameter book_car.php sql injection | Car Rental Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5672 | code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5677 | Totolink A7100RU cstecgi.cgi CsteSystem os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5678 | Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5688 | Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5689 | Totolink A7100RU cstecgi.cgi setNtpCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5690 | Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5691 | Totolink A7100RU cstecgi.cgi setFirewallType os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-5606 | PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection | Online Shopping Portal Project | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35396 | WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35398 | WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35472 | WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35473 | WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35474 | WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect'] | wegia | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-35475 | WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect'] | wegia | 5.1 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-35411 | Directus is an Open Redirect in Admin 2FA Setup Page | directus | 4.3 (v3.1) | Medium | 344365 |
| CVE-2026-5607 | imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery | mcp-browser-agent | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5620 | itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5635 | PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5636 | PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5675 | itsourcecode Construction Management System Parameter borrowed_tool.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5681 | itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection | sanitize or validate this input | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5621 | ChrisChinchilla Vale-MCP HTTP index.ts os command injection | Vale-MCP | 1.9 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2019-25687 | Pegasus CMS 1.0 Remote Code Execution via extra_fields.php | pegasus cms | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2019-25662 | ResourceSpace 8.6 SQL Injection via watched_searches.php | resourcespace | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25668 | News Website Script 2.0.5 SQL Injection via index.php | news website script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25669 | qdPM 9.1 SQL Injection via search_by_extrafields Parameter | qdpm | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25675 | eDirectory All Versions SQL Injection Authentication Bypass | edirectory | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25678 | C4G BLIS 3.4 SQL Injection via users_select.php | computing for good's basic laboratory information system | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25680 | Advance Gift Shop Pro Script 2.0.3 SQL Injection via search | advance gift shop pro script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25684 | OpenDocMan 1.3.4 SQL Injection via where Parameter | opendocman | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25694 | Kados R10 GreenBee SQL Injection via user2reset | kados | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25671 | VA MAX 8.3.4 Remote Code Execution via changeip.php | VA MAX | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2019-25673 | UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload | Laravel File Manager | 8.7 (v4.0) | High | 351000 |
| CVE-2019-25664 | SuiteCRM 7.10.7 SQL Injection via record Parameter | suitecrm | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5551 | itsourcecode Free Hotel Reservation System Parameter login.php sql injection | Free Hotel Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5554 | code-projects Concert Ticket Reservation System Parameter process_search.php sql injection | Concert Ticket Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5555 | code-projects Concert Ticket Reservation System Parameter login.php sql injection | Concert Ticket Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5564 | code-projects Simple Laundry System Parameter searchguest.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5565 | code-projects Simple Laundry System Parameter delmemberinfo.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5573 | Technostrobe HI-LED-WR120-G2 fs unrestricted upload | hi-led-wr120-g2 firmware | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-5575 | SourceCodester/jkev Record Management System Login index.php sql injection | Record Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5577 | Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection | cross browser fingerprinting | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5538 | QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery | OnlineJudge | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5547 | Tenda AC10 httpd formAddMacfilterRule os command injection | ac10 firmware | 5.3 (v4.0) | Medium | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5537 | halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection | CourseSEL | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5543 | PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection | User Registration & Login and User Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5552 | PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5553 | itsourcecode Online Cellphone System Parameter available.php sql injection | Online Cellphone System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5558 | PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection | PHPGurukul Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5560 | PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5578 | CodeAstro Online Classroom Parameter addassessment.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5579 | CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5580 | CodeAstro Online Classroom Parameter addvideos.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5583 | PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5576 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload | Record Management System | 2.0 (v4.0) | Low | 340156 , 341245 , 351000 , 390501 |
| CVE-2026-35616 | FortiClient EMS - Authentication Bypass | forticlient ems | 9.8 (v3.1) | Critical | 392301 |
| CVE-2016-20052 | Snews CMS 1.7 Unrestricted File Upload via snews_files | snews | 9.3 (v4.0) | Critical | 351000 |
| CVE-2025-15064 | Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 6.4 (v3.1) | Medium | 346755 |
| CVE-2026-0552 | Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shor | Simple Shopping Cart | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-0626 | WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-0738 | Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2018-25248 | MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php | mybb downloads | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-31818 | Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | budibase | 9.9 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34612 | Kestra: Remote Code Execution via SQL Injection | kestra | 9.0 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59710 | biztalk360 Arbitrary Code Execution Vulnerability | biztalk360 | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-27634 | Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter | piwigo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-28797 | RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Compone | ragflow | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34228 | Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write | emlog | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-35214 | Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write | budibase | 8.7 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-59711 | biztalk360 Path Traversal Vulnerability | biztalk360 | 8.3 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34936 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | praisonai | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-27834 | Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter | piwigo | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-27885 | Piwigo: SQL Injection in Activity.getList | piwigo | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34607 | Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE | emlog | 7.2 (v3.1) | High | 344360 , 347009 |
| CVE-2026-22664 | prompts.chat SSRF via Fal.ai Media Status Polling | prompts.chat | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-59709 | biztalk360 Path Traversal Vulnerability | biztalk360 | 6.8 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34787 | Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter | emlog | 6.5 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-34788 | Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters | emlog | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34229 | Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass | emlog | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-22662 | prompts.chat Blind SSRF via media-generate | prompts.chat | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26477 | dokuwiki Denial of Service Vulnerability | dokuwiki | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5470 | mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request for | Google-Research-MCP | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-34745 | Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public | fireshare | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-34524 | SillyTavern: Path traversal in /api/chats/export and /api/chats/delete allows arbitrary file read/delete within user | sillytavern | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-34735 | Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in FileController | wiki | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34792 | Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34793 | Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34794 | Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34795 | Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34796 | Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34797 | Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | postiz | 8.6 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34931 | hoppscotch: Improper loopback redirect_uri validation in device-login flow | hoppscotch | 8.5 (v4.0) | High | 344365 |
| CVE-2026-34932 | hoppscotch: Stored XSS via mock server responses on backend origin | hoppscotch | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34576 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | postiz | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34725 | dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration | dbgate | 8.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34522 | SillyTavern: Path traversal in /api/chats/import allows arbitrary file write outside intended chat directory | sillytavern | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2026-34847 | hoppscotch: Open redirect via /enter?redirect= | hoppscotch | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-5346 | huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery | hm editor | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5368 | projectworlds Car Rental Project Parameter login.php sql injection | car rental project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34590 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | postiz | 5.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34848 | hoppscotch: Stored XSS in team member overflow tooltip via display name | hoppscotch | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34523 | SillyTavern: Path traversal allows file existence oracle | sillytavern | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34798 | Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34799 | Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34800 | Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34801 | Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34802 | Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34805 | Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34806 | Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34807 | Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34808 | Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34809 | Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34810 | Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34811 | Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34812 | Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34813 | Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34814 | Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34815 | Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34817 | Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34819 | Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34821 | Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5351 | Trendnet TEW-657BRM setup.cgi add_wps_client os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5352 | Trendnet TEW-657BRM setup.cgi edit os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5353 | Trendnet TEW-657BRM setup.cgi ping_test os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5354 | Trendnet TEW-657BRM setup.cgi vpn_connect os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5355 | Trendnet TEW-657BRM setup.cgi vpn_drop os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-29014 | MetInfo CMS <= 8.1 - Remote Code Execution | metinfo | 9.3 (v4.0) | Critical | 340121 , 344363 , 360152 , 380026 , 390635 , 393655 |
| CVE-2026-34156 | NocoBase - VM Sandbox Escape to Remote Code Execution | nocobase | 9.9 (v3.1) | Critical | 344370 , 345240 , 360151 |
| CVE-2026-3300 | Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection | Everest Forms Pro | 9.8 (v3.1) | Critical | 300021 |
| CVE-2026-34243 | wenxian: Command Injection in GitHub Actions Workflow via issue_comment.body | wenxian | 9.8 (v3.1) | Critical | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-34449 | SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection | siyuan | 9.6 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 393655 |
| CVE-2026-34361 | HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft | hl7 fhir core | 9.3 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34367 | InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.7 (v3.1) | High | 337109 , 337110 , 340147 , 340162 , 340163 , 340165 , 344360 , 344370 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34605 | SiYuan Note - Cross-Site Scripting | siyuan | 8.6 (v4.0) | High | 300013 |
| CVE-2026-34365 | InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34366 | InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34163 | Server-Side Request Forgery via MCP Tools Endpoint in FastGPT | fastgpt | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-4267 | Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI | Query Monitor | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-34740 | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | avideo | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34396 | AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | avideo | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34442 | FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout | freescout | 6.1 (v3.1) | Medium | 340165 , 344365 |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34360 | HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing | hl7 fhir core | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-30520 | loan management system SQL Injection Vulnerability | loan management system | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-32113 | Discourse: Open redirect via sso_destination_url cookie in enter | discourse | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-5206 | code-projects Simple Gym Management System Payment sql injection | Simple Gym Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-4257 | Supsystic Contact Form Wordpress Plugin SSTI RCE | Contact Form by Supsystic | 9.8 (v3.1) | Critical | 393655 |
| CVE-2026-31831 | Tautulli <= 2.16.1 - Path Traversal | tautulli | 8.7 (v4.0) | High | 346019 |
| CVE-2026-0560 | LolLMS < 2.2.0 - Server-Side Request Forgery | lollms | 7.5 (v3.1) | High | 360151 |
| CVE-2026-5027 | Langflow <= 1.8.4 - Path Traversal to RCE via File Upload | langflow | 8.8 (v3.1) | High | 300008 |
| CVE-2026-23921 | Blind, read-only SQL injection in Zabbix API via sortfield parameter | zabbix | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-33497 | Langflow < 1.7.0 - Path Traversal | langflow | 8.7 (v4.0) | High | 300006 |
| CVE-2026-22739 | Spring Cloud Config Server - Path Traversal | spring cloud config | 8.6 (v3.1) | High | 346019 |
| CVE-2026-23482 | Blinko < 1.8.4 - Path Traversal | blinko | 8.2 (v4.0) | High | 347009 |
| CVE-2026-23483 | Blinko <= 1.8.3 - Path Traversal via /plugins | blinko | 6.9 (v4.0) | Medium | 347009 |
| CVE-2019-25578 | phpTransformer 2016.9 SQL Injection via GeneratePDF.php | phptransformer | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25580 | ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php | owndms | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-3335 | Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload | Canto | 5.3 (v3.1) | Medium | 300007 |
| CVE-2026-3584 | WordPress Kali Forms <= 2.4.9 - Remote Code Execution | kali-forms | 9.8 (v3.1) | Critical | 300223 |
| CVE-2026-32985 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import | xerte online toolkits | 9.3 (v4.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2026-33226 | Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview | budibase | 8.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33236 | NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite | nltk | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-23536 | Feast Feature Server <=0.58.0 - Arbitrary File Read | feast | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-22557 | UniFi Network Application - Path Traversal | UniFi Network Application | 10.0 (v3.1) | Critical | 340007 |
| CVE-2025-71260 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE | footprints | 8.7 (v4.0) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2025-71257 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass | footprints itsm | 6.9 (v4.0) | Medium | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-32306 | OneUptime ClickHouse SQL Injection via Aggregate Query Parameters | oneuptime | 9.9 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-3891 | WordPress Unauthenticated RCE via Pix for WooCommerce plugin | Pix for WooCommerce | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2026-32308 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") | oneuptime | 7.6 (v3.1) | High | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2026-29066 | TinaCMS - Path Traversal | tinacms | 6.2 (v3.1) | Medium | 347009 , 390709 |
| CVE-2026-31844 | Authenticated SQL Injection in Koha displayby parameter of suggestion.pl | koha | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-2413 | Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection | Ally – Web Accessibility & Usability | 7.5 (v3.1) | High | 380026 , 380122 |
| CVE-2026-30958 | OneUptime < 10.0.21 - Path Traversal | oneuptime | 8.6 (v3.1) | High | 347009 |
| CVE-2026-31807 | SiYuan <= v3.5.9 - SVG Animate Element XSS | siyuan | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-31809 | SiYuan <= v3.5.9 - Cross Site Scripting | siyuan | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-1776 | Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read | camaleon cms | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-40639 | SQL injection in Eventobot | eventobot | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-40638 | Reflected Cross-Site Scripting (XSS) in Eventobot | eventobot | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-28501 | AVideo Unauthenticated SQL Injection Credential Dump | avideo | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2018-25163 | BitZoom 1.0 SQL Injection via rollno Parameter | BitZoom | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25171 | EdTv 2 SQL Injection via id Parameter | EdTv | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25196 | ServerZilla 1.0 SQL Injection via email Parameter | ServerZilla | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2018-25197 | PlayJoom 0.10.1 SQL Injection via catid Parameter | PlayJoom | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-29059 | Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal | windmill | 6.9 (v4.0) | Medium | 347009 |
| CVE-2026-29183 | SiYuan Note - Cross-Site Scripting | siyuan | 6.1 (v3.1) | Medium | 300013 , 340147 , 341266 , 347198 |
| CVE-2025-69411 | ionCube Tester Plus <= 1.3 - Local File Inclusion | ionCube tester plus | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-20079 | Cisco Secure Firewall Management Center Authentication Bypass RCE | Cisco Secure Firewall Management Center (FMC) | 10.0 (v3.1) | Critical | 340029 , 344361 , 344364 , 344366 , 344370 |
| CVE-2025-66024 | XWiki Blog Application home page vulnerable to Stored XSS via Post Title | blog application | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-1492 | WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 9.8 (v3.1) | Critical | 300020 |
| CVE-2026-27971 | Qwik - Unauthenticated RCE via server$ Deserialization | qwik | 9.2 (v4.0) | Critical | 391213 |
| CVE-2026-3395 | MaxSite CMS <=109.1 - Remote Code Execution | maxsite cms | 5.5 (v4.0) | Medium | 344364 , 344370 |
| CVE-2026-28515 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical | 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 344362 |
| CVE-2026-28516 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical | 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 344362 |
| CVE-2026-28517 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical | 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 344362 |
| CVE-2026-28414 | Gradio - Absolute Path Traversal | gradio | 7.5 (v3.1) | High | 390716 |
| CVE-2026-28409 | WeGIA <= 3.6.4 - Remote Code Execution | wegia | 7.2 (v3.1) | High | 344363 , 390700 , 393655 |
| CVE-2026-27966 | Langflow RCE | langflow | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2026-1557 | WP Responsive Images <= 1.0 - Arbitrary File Read | WP Responsive Images | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2026-2416 | Geo Mashup <= 1.13.17 - SQL Injection | Geo Mashup | 7.5 (v3.1) | High | 380122 |
| CVE-2026-0926 | Prodigy Commerce <= 3.3.0 - Local File Inclusion | Prodigy Commerce | 9.8 (v3.1) | Critical | 344360 |
| CVE-2025-71243 | SPIP Saisies Plugin Unauthenticated RCE | saisies | 9.3 (v4.0) | Critical | 340087 , 340095 , 340128 , 340149 , 344370 , 346755 , 350147 , 380018 , 390801 |
| CVE-2026-1581 | wpForo Forum <= 2.4.14 - SQL Injection | wpForo Forum | 7.5 (v3.1) | High | 341245 , 380122 |
| CVE-2026-0561 | Shield Security <= 21.0.8 - Unauthenticated Reflected XSS | shield-security | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2025-70149 | membership management system SQL Injection Vulnerability | membership management system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-70150 | membership management system Missing Authorization Vulnerability | membership management system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-70152 | scholars tracking system SQL Injection Vulnerability | scholars tracking system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical | 340087 , 340095 , 340128 , 344360 , 344370 , 346755 , 347009 , 380018 , 390801 , 390904 |
| CVE-2026-27175 | MajorDoMo Remote Command Injection via cycle_execs Race Condition | majordomo | 9.2 (v4.0) | Critical | 393655 |
| CVE-2025-70151 | scholars tracking system Arbitrary Code Execution Vulnerability | scholars tracking system | 8.8 (v3.1) | High | 351000 |
| CVE-2025-14340 | Payara Server - Cross-Site Scripting | Payara Server | 7.3 (v4.0) | High | 341266 , 346755 |
| CVE-2026-1296 | Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect | Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin | 6.1 (v3.1) | Medium | 377360 |
| CVE-2026-27176 | MajorDoMo - Cross-Site Scripting | majordomo | 5.1 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 , 390501 |
| CVE-2026-26216 | Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter | crawl4ai | 10.0 (v4.0) | Critical | 344370 |
| CVE-2026-26217 | Crawl4AI < 0.8.0 - Local File Inclusion | crawl4ai | 9.2 (v4.0) | Critical | 344360 |
| CVE-2020-37214 | Voyager 1.3.0 - Directory Traversal | Voyager | 8.7 (v4.0) | High | 344360 , 347009 |
| CVE-2026-25895 | FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write | fuxa | 9.5 (v4.0) | Critical | 340007 |
| CVE-2020-37123 | Pinger 1.0 - Remote Code Execution | Pinger | 9.3 (v4.0) | Critical | 344363 |
| CVE-2026-25512 | Group-Office < 26.0.5 - Remote Code Execution | group office | 9.4 (v4.0) | Critical | 344363 |
| CVE-2026-0743 | WP Content Permission <= 1.2 - Cross-Site Scripting | WP Content Permission | 4.4 (v3.1) | Medium | 346755 , 377360 , 390585 |
| CVE-2026-25616 | Blesta <= 5.13.1 - Cross-Site Scripting | blesta | 6.1 (v3.1) | Medium | 340112 , 346755 , 350148 |
| CVE-2026-1207 | Django RasterField - SQL Injection | django | 5.4 (v3.1) | Medium | 341245 |
| CVE-2026-22778 | vLLM Multimodal Heap-Address Information Leak Scanner | vllm | 9.8 (v3.1) | Critical | 330791 , 340152 , 344362 |
| CVE-2025-40536 | SolarWinds Web Help Desk unauthenticated RCE | web help desk | 9.8 (v3.1) | Critical | 344370 |
| CVE-2025-40551 | SolarWinds Web Help Desk unauthenticated RCE | web help desk | 9.8 (v3.1) | Critical | 344370 |
| CVE-2025-40552 | SolarWinds Web Help Desk - Authentication Bypass | web help desk | 9.8 (v3.1) | Critical | 392301 |
| CVE-2026-0702 | VidShop for WooCommerce <= 1.1.4 - SQL Injection | VidShop – Shoppable Videos for WooCommerce | 7.5 (v3.1) | High | 341245 |
| CVE-2026-24479 | HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE | hustoj | 9.3 (v4.0) | Critical | 320464 , 320465 , 330791 , 340006 , 340007 , 340152 , 344360 , 390719 |
| CVE-2020-36939 | Cassandra Web File Read Vulnerability | Cassandra Web | 8.7 (v4.0) | High | 347009 |
| CVE-2026-24128 | XWiki Platform Distribution Flavor Main - Cross-Site Scripting | xwiki-platform-distribution-flavor-main | 6.5 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2026-0768 | Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code | langflow | 9.8 (v3.0) | Critical | 340095 |
| CVE-2026-0770 | Langflow < 1.3.0 - Remote Code Execution via validate_code() exec() | langflow | 9.8 (v3.0) | Critical | 344360 , 344370 |
| CVE-2026-24138 | FOG vulnerable to unauthenticated SSRF via /fog/service/getversion.php | fogproject | 7.5 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-22219 | Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element | chainlit | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-23744 | MCPJam Inspector Connect API Command Execution | inspector | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-47795 | GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting | geowebserver | 8.7 (v4.0) | High | 340007 , 340147 , 340148 , 341266 , 342259 , 344365 , 350148 , 390716 |
| CVE-2026-0594 | WordPress List Site Contributors < 1.1.8 - Reflected XSS | List Site Contributors | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-22200 | osTicket Arbitrary File Read via PHP Filter Chains in mPDF | osticket | 8.7 (v4.0) | High | 340077 , 340147 , 340148 , 344360 |
| CVE-2025-68493 | Apache Struts XWork - XML External Entity Injection | struts | 8.1 (v3.1) | High | 344370 , 344372 |
| CVE-2025-66744 | Yonyou YonBIP - Path Traversal | - | 7.5 (v3.1) | High | 340007 |
| CVE-2026-21875 | ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection | clipbucket | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2026-22244 | OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE | openmetadata | 8.5 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-21892 | Parsl Monitoring Visualization Vulnerable to SQL Injection | parsl | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-22242 | CoreShop Vulnerable to SQL Injection via Admin Reports | coreshop | 4.9 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69222 | LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions | librechat | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-14804 | Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion | Frontend File Manager Plugin | 7.7 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-13801 | Yoco Payments <= 3.8.8 - Path Traversal | Yoco Payments | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13418 | Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting | Responsive Pricing Table | 6.4 (v3.1) | Medium | 346755 , 377360 |
| CVE-2025-61782 | Open Redirect in OpenCTI's SAML Authentication Flow | opencti | 6.1 (v3.1) | Medium | 340165 , 344365 |
| CVE-2025-13652 | WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection | CBX Bookmark & Favorite | 6.5 (v3.1) | Medium | 340016 , 377360 , 380122 |
| CVE-2025-9318 | Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via is_linking Query Parameter | quiz and survey master | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-68455 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | craft cms | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-15450 | sfturing hosp_order orderHos findOrderHosNum sql injection | hosp order | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15451 | xnx3 wangmarket System Variables variableSave.do cross site scripting | wangmarket | 1.9 (v4.0) | Low | 320013 , 333140 , 333141 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-15452 | xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting | wangmarket | 1.9 (v4.0) | Low | 320013 , 333140 , 333141 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-15454 | zhanglun lettura RSS ContentRender.tsx cross site scripting | lettura | 1.3 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-14998 | Branda WordPress plugin - Privilege Escalation | Branda – White Label & Branding, Free Login Page Customizer | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-15420 | Yonyou KSOA agent_work_report.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15421 | Yonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15424 | Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15425 | Yonyou KSOA HTTP GET Parameter del_user.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15432 | yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal | carrental | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-15434 | Yonyou KSOA PrintZPYG.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15435 | Yonyou KSOA work_update.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2025-15436 | Yonyou KSOA work_edit.jsp sql injection | ksoa | 5.5 (v4.0) | Medium | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2025-15423 | EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload | empirecms | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-68619 | Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package | signal k server | 7.3 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2025-15414 | go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery | sonic | 2.0 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-15416 | xnx3 wangmarket Add Global Variable save.do cross site scripting | wangmarket | 1.9 (v4.0) | Low | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-10145 | Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh | gargoyle | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-68700 | RAGFlow Remote Code Execution Vulnerability | ragflow | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-15394 | iCMS POST Parameter ConfigAdmincp.php save code injection | icms | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-14312 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter | Advance WP Query Search Filter | 6.1 (v3.1) | Medium | 346755 |
| CVE-2025-14313 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax | Advance WP Query Search Filter | 6.1 (v3.1) | Medium | 346755 |
| CVE-2025-15243 | code-projects Simple Stock System login.php sql injection | simple stock system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15210 | code-projects Refugee Food Management System editrefugee.php sql injection | refugee food management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15211 | code-projects Refugee Food Management System refugee.php sql injection | refugee food management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15212 | code-projects Refugee Food Management System regfood.php sql injection | refugee food management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15220 | SohuTV CacheCloud LoginController.java init cross site scripting | cachecloud | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15219 | SohuTV CacheCloud MachineManageController.java doPodList cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15221 | SohuTV CacheCloud AppDataMigrateController.java index cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15241 | CloudPanel Community Edition HTTP Header users redirect | Community Edition | 2.0 (v4.0) | Low | 344365 |
| CVE-2025-15214 | Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting | park ticketing system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-52691 | SmarterTools SmarterMail GUID File Upload Vulnerability | smartermail | 10.0 (v3.1) | Critical | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2025-13417 | Plugin Organizer < 10.2.4 - Subscriber+ SQLi | Plugin Organizer | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-68951 | phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw | phpmyfaq | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15165 | itsourcecode Online Cake Ordering System updatecustomer.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15166 | itsourcecode Online Cake Ordering System updatesupplier.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15167 | itsourcecode Online Cake Ordering System detailtransac.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15168 | itsourcecode Student Management System statistical.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15181 | code-projects Refugee Food Management System pagenateRefugeesList.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15182 | code-projects Refugee Food Management System served.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15183 | code-projects Refugee Food Management System viewtakenfd.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15184 | code-projects Refugee Food Management System refugeesreport2.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15185 | code-projects Refugee Food Management System refugeesreport.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15186 | code-projects Refugee Food Management System addusers.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15195 | code-projects Assessment Management add-module.php sql injection | assessment management | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15196 | code-projects Assessment Management login.php sql injection | assessment management | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15198 | code-projects College Notes Uploading System login.php sql injection | college notes uploading system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15206 | Campcodes Supplier Management System add_area.php sql injection | supplier management system | 5.5 (v4.0) | Medium | 340017 , 341245 , 380122 |
| CVE-2025-15207 | Campcodes Supplier Management System view_products.php sql injection | supplier management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15208 | code-projects Refugee Food Management System editrefugee.php sql injection | refugee food management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69206 | Hemmelig has SSRF Filter bypass in Secret Request functionality | hemmelig | 4.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-15205 | code-projects Student File Management System download.php sql injection | student file management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15209 | code-projects Refugee Food Management System editfood.php sql injection | refugee food management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15171 | SohuTV CacheCloud ServerController.java index cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15172 | SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15173 | SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15174 | SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15175 | SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15197 | code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload | news-buzz | 2.0 (v4.0) | Low | 351000 |
| CVE-2025-15201 | SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting | cachecloud | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15188 | Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting | online beauty parlor management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |
| CVE-2025-15200 | SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting | cachecloud | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15202 | SohuTV CacheCloud TaskController.java taskQueueList cross site scripting | cachecloud | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15203 | SohuTV CacheCloud ResourceController.java index cross site scripting | cachecloud | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15127 | FantasticLBP Hotels_Server Room.php sql injection | hotels server | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15140 | saiftheboss7 onlinemcqexam quesadd.php sql injection | onlinemcqexam | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15142 | 9786 phpok3w show.php sql injection | phpok3w | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15152 | h-moses moga-mall PmsProductController.java addProduct unrestricted upload | moga-mall | 5.3 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-15129 | ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection | Lin-CMS-TP5 | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-15144 | dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting | xunruicms | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15130 | shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection | SyCms | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2025-15134 | yourmaileyes MOOC Submission MainController.java subreview cross site scripting | MOOC | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15138 | prasathmani TinyFileManager tinyfilemanager.php path traversal | tiny file manager | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-15148 | CmsEasy Backend Template Management template_admin.php savetemp_action code injection | cmseasy | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-15145 | SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting | cachecloud | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-15146 | SohuTV CacheCloud UserManageController.java doUserList cross site scripting | cachecloud | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15149 | rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting | ecms | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 342259 |
| CVE-2025-66203 | StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection | streamvault | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-68927 | Improper Neutralization of HTML Tags in a Web Page in libredesk | libredesk | 7.3 (v4.0) | High | 333140 , 333141 |
| CVE-2025-15109 | jackq XCMS upload.php unrestricted upload | XCMS | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-15110 | jackq XCMS Backend ProductImageController.class.php upload unrestricted upload | xcms | 2.0 (v4.0) | Low | 351000 |
| CVE-2025-15093 | sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting | flycms | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15094 | sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting | flycms | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15098 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery | yudao-cloud | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-15074 | itsourcecode Online Frozen Foods Ordering System customer_details.php sql injection | online frozen foods ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15075 | itsourcecode Student Management System student_p.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15077 | itsourcecode Student Management System form137.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15078 | itsourcecode Student Management System list_report.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15088 | ketr JEPaaS loadPostil postilService.loadPostils sql injection | JEPaaS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-68916 | netman 208 Path Traversal Vulnerability | netman 208 | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25246 | BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure | N100 H.264 VGA IP Camera | 7.1 (v4.0) | High | 330925 , 344360 , 347009 , 390709 |
| CVE-2025-60935 | blitz Open Redirect Vulnerability | blitz | 6.1 (v3.1) | Medium | 344365 |
| CVE-2025-15073 | itsourcecode Online Frozen Foods Ordering System contact_us.php sql injection | online frozen foods ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-68914 | netman 208 SQL Injection Vulnerability | netman 208 | 5.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-68915 | netman 208 Cross-Site Scripting Vulnerability | netman 208 | 4.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-34433 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | AVideo | 9.3 (v4.0) | Critical | 340128 , 380018 , 390801 |
| CVE-2025-68613 | n8n Workflow Expression Remote Code Execution | n8n | 8.8 (v3.1) | High | 330791 , 340128 , 340130 , 340152 , 344361 , 344363 , 344364 , 345240 , 380018 , 380026 , 390801 |
| CVE-2025-67442 | eve-ng Path Traversal Vulnerability | eve-ng | 7.6 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-14151 | SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting | SlimStat Analytics | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14962 | code-projects Simple Stock System chatuser.php cross site scripting | simple stock system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14437 | WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File | hummingbird-performance | 7.5 (v3.1) | High | 390716 |
| CVE-2025-62521 | ChurchCRM Unauthenticated RCE via Setup Page | churchcrm | 9.8 (v3.1) | Critical | 340087 , 340095 , 344370 , 360152 |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | 7.2 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904 |
| CVE-2025-14701 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller | crafty controller | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2025-34441 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium | 340128 , 380018 , 390801 |
| CVE-2025-34442 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium | 340128 , 380018 , 390801 |
| CVE-2025-67744 | Mermaid XSS vulnerability leads to Remote Code Execution | deepchat | 9.6 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-66449 | ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution | convertx | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-13439 | Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio | Fancy Product Designer | 5.9 (v3.1) | Medium | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390722 |
| CVE-2025-65590 | nopcommerce Cross-Site Scripting Vulnerability | nopcommerce | 5.4 (v3.1) | Medium | 333140 , 333141 |
| CVE-2023-53899 | PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection | podcast generator | 5.1 (v4.0) | Medium | 337109 , 337110 , 398021 , 398022 |
| CVE-2025-14731 | CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine | ctcms | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-34179 | NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure | Manager | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-34181 | NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE | Manager | 8.7 (v4.0) | High | 344360 , 390709 |
| CVE-2025-12684 | URL Shortify < 1.11.3 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-13355 | URL Shortify < 1.11.4 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-14387 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-14710 | FantasticLBP Hotels Server OrderList.php sql injection | hotels server | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14711 | FantasticLBP Hotels Server hotelList.php sql injection | hotels server | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11363 | Royal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File Upload | Royal Addons for Elementor | 5.3 (v3.1) | Medium | 351000 |
| CVE-2025-14694 | ketr JEPaaS readAllPostil sql injection | JEPaaS | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-14729 | CTCMS Content Management System Backend App Configuration Ct_App.php save code injection | ctcms | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-14730 | CTCMS Content Management System Backend System Configuration Ct_Config.php code injection | ctcms | 2.0 (v4.0) | Low | 340014 , 340029 , 340095 , 340128 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 380018 , 390801 , 393655 |
| CVE-2025-14638 | itsourcecode Online Pet Shop Management System update_cnp.php sql injection | online pet shop management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14639 | itsourcecode Student Management System uprec.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14643 | code-projects Simple Attendance Record System check.php sql injection | simple attendance record system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14644 | itsourcecode Student Management System update_subject.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14649 | itsourcecode Online Cake Ordering System supplier.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14650 | itsourcecode Online Cake Ordering System product.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14652 | itsourcecode Online Cake Ordering System admindetail.php sql injection | online cake ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14653 | itsourcecode Student Management System addrecord.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14661 | itsourcecode Student Managemen System advisers.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14664 | Campcodes Supplier Management System view_unit.php sql injection | supplier management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14666 | itsourcecode COVID Tracking System page sql injection | covid tracking system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14667 | itsourcecode COVID Tracking System page sql injection | covid tracking system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14668 | campcodes Advanced Online Examination System loginExe.php sql injection | advanced online examination system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14587 | itsourcecode Online Pet Shop Management System available.php sql injection | online pet shop management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14588 | itsourcecode Student Management System update_program.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14590 | code-projects Prison Management System search1.php sql injection | prison management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14637 | itsourcecode Online Pet Shop Management System addcnp.php sql injection | online pet shop management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14477 | 404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter | 404 Solution | 4.9 (v3.1) | Medium | 340017 , 340156 |
| CVE-2025-14589 | code-projects Prison Management System search.php sql injection | prison management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14344 | Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion | Multi Uploader for Gravity Forms | 9.8 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2025-12835 | WooMulti <= 1.7 - Subscriber+ Arbitrary File Deletion | WooMulti | 7.3 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-13891 | Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing | Modula Image Gallery – Photo Grid & Video Gallery | 6.5 (v3.1) | Medium | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-14565 | kidaze CourseSelectionSystem login1.php sql injection | courseselectionsystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14566 | kidaze CourseSelectionSystem reg.php sql injection | courseselectionsystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14570 | projectworlds Advanced Library Management System view_admin.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14571 | projectworlds Advanced Library Management System borrow_book.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14578 | itsourcecode Student Management System update_account.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14583 | campcodes Online Student Enrollment System register.php unrestricted upload | online student enrollment system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-14584 | itsourcecode COVID Tracking System Admin Login login.php sql injection | covid tracking system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14585 | itsourcecode COVID Tracking System page sql injection | covid tracking system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12655 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write | Hippoo Mobile App for WooCommerce | 5.3 (v3.1) | Medium | 351000 |
| CVE-2025-10583 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forge | WP Fastest Cache Premium | 3.5 (v3.1) | Low | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-14568 | haxxorsid Stock-Management-System User.php sql injection | Stock-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14582 | campcodes Online Student Enrollment System index.php unrestricted upload | online student enrollment system | 2.0 (v4.0) | Low | 351000 |
| CVE-2024-58290 | Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint | Xhibiter NFT Marketplace | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14514 | Campcodes Supplier Management System add_distributor.php sql injection | supplier management system | 5.5 (v4.0) | Medium | 340017 , 341245 , 380122 |
| CVE-2025-14515 | Campcodes Supplier Management System add_unit.php sql injection | supplier management system | 5.5 (v4.0) | Medium | 340017 , 341245 , 380122 |
| CVE-2025-14527 | projectworlds Advanced Library Management System view_book.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14528 | D-Link DIR-803 - Authentication Bypass | dir-803 firmware | 5.5 (v4.0) | Medium | 390722 |
| CVE-2025-14529 | Campcodes Retro Basketball Shoes Online Store admin_running.php sql injection | retro basketball shoes online store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14536 | code-projects Class and Exam Timetable Management Login index.php sql injection | class and exam timetable management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14537 | code-projects Class and Exam Timetable Management preview7.php sql injection | class and exam timetable management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-58292 | XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates | XMB Forum | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-58296 | CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php | CE Phoenix | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-34504 | KodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint | kodexplorer | 5.3 (v4.0) | Medium | 344365 |
| CVE-2025-66452 | LibreChat's lack of JSON parsing error handling can lead to XSS | librechat | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67713 | Miniflux 2 has an Open Redirect via protocol-relative redirect_url | miniflux | 5.3 (v4.0) | Medium | 344365 |
| CVE-2025-14520 | baowzh hfly delfile path traversal | hfly | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2025-14521 | baowzh hfly download path traversal | hfly | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2025-14522 | baowzh hfly upload_json.php unrestricted upload | hfly | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-14530 | SourceCodester Real Estate Property Listing App property.php unrestricted upload | real estate property listing app | 2.0 (v4.0) | Low | 351000 |
| CVE-2025-14538 | yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting | warehouseManager 仓库管理系统 | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-65950 | WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter | wbce cms | 9.4 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-66474 | XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection | xwiki-rendering | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2025-13339 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read | Hippoo Mobile App for WooCommerce | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13072 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-13073 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-66472 | XWiki DeleteApplication - Cross-Site Scripting | xwiki | 6.5 (v4.0) | Medium | 346755 |
| CVE-2025-66039 | FreePBX firmware file upload | freepbx | 9.3 (v4.0) | Critical | 340006 , 340145 , 340156 , 344360 , 390719 |
| CVE-2025-10655 | Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data | helpdesk | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13071 | Custom Admin Menu <= 1.0.0 - Reflected XSS | Custom Admin Menu | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 |
| CVE-2025-14285 | code-projects Employee Profile Management System edit_personnel.php sql injection | employee profile management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-34425 | MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx | mailenable | 5.3 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 341099 , 341256 , 341266 , 346755 |
| CVE-2025-14209 | Campcodes School File Management System update_query.php sql injection | school file management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14210 | projectworlds Advanced Library Management System delete_member.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14211 | projectworlds Advanced Library Management System delete_book.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14212 | projectworlds Advanced Library Management System member_search.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14215 | code-projects Currency Exchange System edit.php sql injection | currency exchange system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14216 | code-projects Currency Exchange System viewserial.php sql injection | currency exchange system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14217 | code-projects Currency Exchange System edittrns.php sql injection | currency exchange system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14218 | code-projects Currency Exchange System editotheraccount.php sql injection | currency exchange system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14223 | code-projects Simple Leave Manager request.php sql injection | simple leave manager | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14226 | itsourcecode Student Management System edit_user.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14248 | code-projects Simple Shopping Cart adminlogin.php sql injection | simple shopping cart | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14249 | code-projects Online Ordering System user_school.php sql injection | online ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14250 | code-projects Online Ordering System user_contact.php sql injection | online ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14251 | code-projects Online Ordering System Admin Login admin sql injection | online ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14256 | itsourcecode Student Management System newcurriculm.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14257 | itsourcecode Student Management System newrecord.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14258 | itsourcecode Student Management System newsubject.php sql injection | student management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14276 | Ilevia EVE X1 Server leaf_search.php command injection | EVE X1 Server | 2.9 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2025-14214 | itsourcecode Student Information System section_edit1.php sql injection | student management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14222 | code-projects Employee Profile Management System print_personnel_report.php sql injection | employee profile management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14227 | Philipinho Simple-PHP-Blog edit.php sql injection | simple-php-blog | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14230 | code-projects Daily Time Recording System add_payroll.php sql injection | daily time recording system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14246 | code-projects Simple Shopping Cart settings.php sql injection | simple shopping cart | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14247 | code-projects Simple Shopping Cart additems.php sql injection | simple shopping cart | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14259 | Jihai Jshop MiniProgram Mall System api.html sql injection | Jshop MiniProgram Mall System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14219 | Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload | retro basketball shoes online store | 2.0 (v4.0) | Low | 351000 |
| CVE-2025-14182 | Sobey Media Convergence System upload path traversal | media convergence system | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-14193 | code-projects Employee Profile Management System view_personnel.php sql injection | employee profile management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14195 | code-projects Employee Profile Management System add_file_query.php unrestricted upload | employee profile management system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-14194 | code-projects Employee Profile Management System view_personnel.php cross site scripting | employee profile management system | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-65879 | warehouse management system Path Traversal Vulnerability | warehouse management system | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-65878 | warehouse management system Path Traversal Vulnerability | warehouse management system | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34257 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined | wise-deviceon server | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14116 | xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery | Yuxi-Know | 2.0 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-66516 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | 9.8 (v3.1) | Critical | 330791 , 340152 , 344360 , 344372 , 390719 , 391213 |
| CVE-2024-58276 | Obi08-Enrollment System 1.0 login.php SQL Injection | Obi08/Enrollment System | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-14006 | dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting | xunruicms | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-14007 | dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting | xunruicms | 1.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | react | 10.0 (v3.1) | Critical | 331702 , 340095 , 344370 , 345240 , 380026 , 393655 |
| CVE-2024-32641 | Masa CMS Vulnerable to Pre-Auth RCE via JSON API | masacms | 9.8 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13486 | Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution | Advanced Custom Fields: Extended | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-66478 | Unauthenticated RCE in React Server Components (React2Shell) | - | N/A | N/A | 340095 , 345240 , 380026 |
| CVE-2025-41013 | SQL injection vulnerability in TCMAN GIM | gim | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-66460 | Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables | lookyloo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13875 | Yohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversal | oci-helper | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-51683 | mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE | mjobtime | 9.8 (v3.1) | Critical | 340155 , 341155 , 341245 |
| CVE-2025-66295 | Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corrupti | grav | 8.8 (v3.1) | High | 344360 |
| CVE-2025-66294 | Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE | grav | 8.7 (v4.0) | High | 393655 |
| CVE-2025-66301 | Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE | grav | 8.6 (v4.0) | High | 393655 |
| CVE-2025-66300 | Grav is vulnerable to Arbitrary File Read | grav | 8.5 (v3.1) | High | 344360 |
| CVE-2025-66302 | Grav vulnerable to Path Traversal allowing server files backup | grav | 6.8 (v3.1) | Medium | 344360 |
| CVE-2025-66311 | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint /admin/pages/[page] in Multiples parameters | grav-plugin-admin | 6.2 (v4.0) | Medium | 333140 , 333141 |
| CVE-2025-66312 | Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint /admin/accounts/groups/[group] parameter `d | grav-plugin-admin | 6.2 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-13810 | jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal | webstack-guns | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13814 | moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery | mogublog | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-13809 | orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery | orion ops | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-13811 | jsnjfz WebStack-Guns PageFactory.java sql injection | webstack-guns | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13815 | moxi159753 Mogu Blog v2 pictures unrestricted upload | mogublog | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-13816 | moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal | mogublog | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-13782 | taosir WTCMS SlideController SlideController.class.php delete sql injection | wtcms | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13786 | taosir WTCMS index.php fetch code injection | wtcms | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390768 , 393655 |
| CVE-2025-13792 | Qualitor getResumo.php eval code injection | the file /html/st/stdeslocamento/request/getResumo.php | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13789 | ZenTao model.php makeRequest server-side request forgery | zentao | 2.1 (v4.0) | Low | 337109 , 337110 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-62593 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack | ray | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-58360 | GeoServer WMS GetMap XXE Arbitrary File Read | geoserver | 9.8 (v3.1) | Critical | 330791 , 340152 , 344372 , 391213 |
| CVE-2024-14015 | Studiocart <= 2.9.0 - Cross-Site Scripting | WordPress eCommerce Plugin | 7.1 (v3.1) | High | 341266 |
| CVE-2025-12629 | Broken Link Manager <= 0.6.5 - Reflected XSS | Broken Link Manager | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-10144 | Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection | Perfect Brands for WooCommerce | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13585 | itsourcecode COVID Tracking System login.php sql injection | covid tracking system | 5.5 (v4.0) | Medium | 340145 , 340156 , 341145 , 380122 , 390572 |
| CVE-2025-12972 | fluent bit Path Traversal Vulnerability | fluent bit | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-12569 | WP Front User Submit < 5.0.0 - Open Redirect | Guest posting / Frontend Posting / Front Editor | 4.7 (v3.1) | Medium | 344365 |
| CVE-2025-13573 | projectworlds can pass malicious payloads add_book.php unrestricted upload | advanced library management system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-13579 | code-projects Library System return.php sql injection | library system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13580 | code-projects Library System mail.php sql injection | library system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13581 | itsourcecode Student Information System schedule_edit1.php sql injection | student information system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13586 | SourceCodester Online Student Clearance System changepassword.php sql injection | online student clearance system | 2.0 (v4.0) | Low | 340017 , 380122 |
| CVE-2025-13561 | SourceCodester Company Website CMS index.php sql injection | company website cms | 5.5 (v4.0) | Medium | 340017 , 340145 , 340156 , 340457 , 360147 , 360148 , 370016 , 380026 , 380122 , 390572 |
| CVE-2025-13572 | projectworlds Advanced Library Management System delete_admin.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13569 | itsourcecode COVID Tracking System page sql injection | covid tracking system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13570 | itsourcecode COVID Tracking System page sql injection | covid tracking system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13322 | WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter | WP AUDIO GALLERY | 8.1 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-13138 | WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection | WP Directory Kit | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2025-12135 | WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting | WPBookit | 7.2 (v3.1) | High | 346755 |
| CVE-2025-13135 | HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | HotelRunner Booking Widget | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11368 | LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure | learnpress | 5.3 (v3.1) | Medium | 344365 |
| CVE-2025-58034 | Fortinet FortiWeb unauthenticated RCE | fortiweb | 7.2 (v3.1) | High | 340006 , 340007 , 344360 , 344361 , 344363 , 344364 , 344370 , 390709 , 390719 , 390904 |
| CVE-2024-44659 | online shopping portal SQL Injection Vulnerability | online shopping portal | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-62519 | phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | phpmyfaq | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13257 | itsourcecode Inventory Management System index.php sql injection | inventory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13261 | lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal | lsfusion platform | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13262 | lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal | lsfusion platform | 5.5 (v4.0) | Medium | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13266 | wwwlike vlife VLifeApi SysFileApi.java create path traversal | vlife | 5.5 (v4.0) | Medium | 344360 , 390709 |
| CVE-2025-13271 | Campcodes School Fees Payment Management System ajax.php sql injection | school fees payment management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-13272 | Campcodes School Fees Payment Management System manage_course.php sql injection | school fees payment management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13280 | CodeAstro Simple Inventory System Login index.php sql injection | simple inventory system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13285 | itsourcecode Online Voting System login.php sql injection | online voting system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13297 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13298 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13299 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13300 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13301 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13253 | projectworlds Advanced Library Management System add_librarian.php sql injection | advanced library management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13254 | projectworlds Advanced Library Management System add_member.php sql injection | advanced library management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13255 | projectworlds Advanced Library Management System book_search.php sql injection | advanced library management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13256 | projectworlds Advanced Library Management System borrow.php sql injection | advanced library management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13259 | Campcodes Supplier Management System edit_unit.php sql injection | supplier management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13260 | Campcodes Supplier Management System edit_product.php sql injection | supplier management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13263 | SourceCodester Online Magazine Management System categories.php sql injection | online magazine management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13264 | SourceCodester Online Magazine Management System view_magazine.php sql injection | online magazine management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13267 | SourceCodester Dental Clinic Appointment Reservation System success.php sql injection | dental clinic appointment reservation system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13269 | Campcodes School Fees Payment Management System ajax.php sql injection | school fees payment management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13270 | Campcodes School Fees Payment Management System ajax.php sql injection | school fees payment management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13273 | Campcodes School Fees Payment Management System ajax.php sql injection | school fees payment management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13274 | Campcodes School Fees Payment Management System ajax.php sql injection | school fees payment management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13278 | projectworlds Advanced Library Management System borrowed_book_search.php sql injection | advanced library management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13286 | itsourcecode Online Voting System ajax.php sql injection | online voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13287 | itsourcecode Online Voting System index.php sql injection | online voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13289 | 1000projects Design & Development of Student Database Management System SubjectDetails.php sql injection | design & development of student database management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13290 | code-projects Simple Food Ordering System saveorder.php sql injection | simple food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13303 | code-projects Courier Management System search-edit.php sql injection | courier management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13302 | code-projects Courier Management System add-new-officer.php sql injection | courier management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13247 | PHPGurukul Tourism Management System user-bookings.php sql injection | tourism management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13201 | code-projects Simple Cafe Ordering System login.php sql injection | simple cafe ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340155 , 340156 , 340157 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13203 | code-projects Simple Cafe Ordering System addmem.php sql injection | simple cafe ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12494 | Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Imag | Modula Image Gallery – Photo Grid & Video Gallery | 4.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-13208 | FantasticLBP Hotels Server hotelList.php sql injection | Hotels Server | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference | oa git free | 2.1 (v4.0) | Low | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 380018 |
| CVE-2025-13210 | itsourcecode Inventory Management System index.php sql injection | inventory management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-64446 | Fortinet FortiWeb unauthenticated RCE | fortiweb | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344361 , 344363 , 344364 , 344370 , 390709 , 390719 , 390904 |
| CVE-2025-10686 | Creta Testimonial Showcase < 1.2.4 - Editor+ Local File Inclusion | Creta Testimonial Showcase | 7.2 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-13169 | code-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection | simple online hotel reservation system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13172 | CodeAstro Gym Management System view-member-report.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | WeRSS we-mp-rss | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-13181 | pojoin h3blog add cross site scripting | h3blog | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13182 | pojoin h3blog addtitle cross site scripting | h3blog | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-13121 | cameasy Liketea API Endpoint StoreController.php list sql injection | Liketea | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-40681 | Cross-Site Scripting (XSS) in xCally Omnichannel | Omnichannel | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 |
| CVE-2025-64716 | Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode | anubis | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-4463 | Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download | BEMS API | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2023-7327 | Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read | Ozeki SMS Gateway | 8.7 (v4.0) | High | 390716 |
| CVE-2025-11700 | N-able N-Central Authentication Bypass and XXE Scanner | n-central | 8.4 (v4.0) | High | 330791 , 340152 , 344372 |
| CVE-2025-9316 | N-able N-Central Authentication Bypass and XXE Scanner | N-central | 6.9 (v4.0) | Medium | 330791 , 340152 , 344372 |
| CVE-2025-11307 | WP Google Maps < 9.0.48 - Cross-Site Scripting | wp-google-maps | 8.8 (v3.1) | High | 346755 |
| CVE-2025-12928 | code-projects Online Job Search Engine login.php sql injection | online job search engine | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12929 | SourceCodester Survey Application System LoginRegistration.php update_user sql injection | survey application system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12938 | projectworlds Online Admission System process_login.php sql injection | online admission system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62780 | ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API | changedetection | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2025-41107 | Stored XSS in Smart School | smart school | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12922 | OpenClinica Community Edition CRF Data Import ImportCRFData path traversal | openclinica | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-12926 | SourceCodester Farm Management System review.php sql injection | farm management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12930 | SourceCodester Food Ordering System view-ticket.php sql injection | food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12931 | SourceCodester Food Ordering System edit-orders.php sql injection | food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12933 | SourceCodester Baby Care System updatewelcome.php sql injection | baby care system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12939 | SourceCodester Interview Management System addCandidate.php sql injection | interview management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12923 | liweiyi ChestnutCMS download resourceDownload path traversal | chestnutcms | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-12932 | SourceCodester Baby Care System admin.php sql injection | baby care system | 2.0 (v4.0) | Low | 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11452 | Asgaros Forum < 3.2.0 - SQL Injection | Asgaros Forum | 7.5 (v3.1) | High | 344366 , 380026 , 380122 |
| CVE-2025-12399 | Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload | Alex Reservations: Smart Restaurant Booking | 7.2 (v3.1) | High | 351000 |
| CVE-2025-12913 | code-projects Responsive Hotel Site roomdel.php sql injection | responsive hotel site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12914 | aaPanel BaoTa Backend database sql injection | BaoTa | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-64328 | FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection | freepbx | 8.6 (v4.0) | High | 344364 |
| CVE-2025-12862 | projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload | online notes sharing platform | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-12853 | SourceCodester Best House Rental Management System admin_class.php delete_house sql injection | best house rental management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-12855 | code-projects Responsive Hotel Site newsletterdel.php sql injection | responsive hotel site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12856 | code-projects Responsive Hotel Site reservation.php sql injection | responsive hotel site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-12857 | code-projects Responsive Hotel Site roombook.php sql injection | responsive hotel site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12873 | Campcodes School File Management update_user.php sql injection | school file management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-64114 | ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin | clipbucket | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11749 | WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 9.8 (v3.1) | Critical | 330791 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2025-11833 | Post SMTP <= 3.6.0 - Email Log Disclosure | post smtp mailer | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-52664 | revive adserver SQL Injection Vulnerability | revive adserver | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-10897 | WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read | WooCommerce Designer Pro | 8.6 (v3.1) | High | 344360 |
| CVE-2025-8385 | Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read | Zombify | 6.8 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-13992 | Nagios XI < 2024R1.1 XSS via Missing Page / 404 | nagios xi | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12546 | LogicalDOC Community Edition API Key creation UI cross site scripting | logicaldoc | 2.0 (v4.0) | Low | 333140 , 333141 |
| CVE-2025-5343 | Stored XSS | manageengine exchange reporter plus | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2025-64115 | Movary unvalidated Referer header allows open redirect and phishing | movary | 5.1 (v4.0) | Medium | 344365 |
| CVE-2025-64116 | Movary vulnerable to an open redirect | movary | 5.1 (v4.0) | Medium | 344365 |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitra | Anti-Malware Security and Brute-Force Firewall | 6.5 (v3.1) | Medium | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-34311 | IPFire < v2.29 Command Injection via Proxy Report Creation | ipfire | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390716 , 393655 |
| CVE-2025-34312 | IPFire < v2.29 Command Injection via URL Filter Blacklist | ipfire | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-12336 | Campcodes Retro Basketball Shoes Online Store admin_index.php sql injection | retro basketball shoes online store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12337 | Campcodes Retro Basketball Shoes Online Store admin_feature.php sql injection | retro basketball shoes online store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12338 | Campcodes Retro Basketball Shoes Online Store admin_product.ph sql injection | retro basketball shoes online store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12339 | Campcodes Retro Basketball Shoes Online Store admin_football.php sql injection | retro basketball shoes online store | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12378 | code-projects Simple Food Ordering System addproduct.php unrestricted upload | simple food ordering system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-62800 | FastMCP vulnerable to reflected XSS in client's callback page | fastmcp | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-34315 | IPFire < v2.29 Stored XSS via Remote Syslog Server Address | ipfire | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 390716 |
| CVE-2025-34316 | IPFire < v2.29 Stored XSS via Mail Server Settings | ipfire | 5.1 (v4.0) | Medium | 346755 |
| CVE-2025-34318 | IPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi) | IPFire | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12346 | MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload | maxsite cms | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-12347 | MaxSite CMS save-file-ajax.php unrestricted upload | maxsite cms | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-12332 | SourceCodester Student Grades Management System admin.php delete_user cross site scripting | student grades management system | 1.9 (v4.0) | Low | 340095 , 346755 |
| CVE-2025-34292 | BeWelcome/Rox PHP Object Injection RCE | Rox | 9.4 (v4.0) | Critical | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2025-41009 | SQL injection on the virtual campus platform of Diseño de Recursos Educativos | virtual campus platform | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-27222 | TRUfusion Enterprise <= 7.10.4.0 - Path Traversal | trufusion enterprise | 8.6 (v3.1) | High | 340007 , 344360 |
| CVE-2025-12055 | MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal | MIP 2 | 7.5 (v3.1) | High | 344365 |
| CVE-2025-11682 | Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform | Customer Engagement & Loyalty Platform | 7.1 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12208 | SourceCodester Best House Rental Management System admin_class.php login2 sql injection | best house rental management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-12215 | projectworlds Online Shopping System login_submit.php sql injection | online shopping system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12237 | projectworlds Advanced Library Management System index.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12253 | AMTT Hotel Broadband Operation System get_expiredtime.php sql injection | hibos | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12257 | SourceCodester Online Student Result System view_result.php sql injection | online student result system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12292 | SourceCodester Point of Sales index.php sql injection | point of sales | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12293 | SourceCodester Point of Sales category.php sql injection | point of sales | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12301 | code-projects Simple Food Ordering System editproduct.php unrestricted upload | simple food ordering system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-12306 | code-projects Nero Social Networking Site acceptoffres.php sql injection | nero social networking site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12307 | code-projects Nero Social Networking Site addfriend.php sql injection | nero social networking site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12308 | code-projects Nero Social Networking Site deletemessage.php sql injection | nero social networking site | 5.5 (v4.0) | Medium | 340145 , 340156 , 380122 |
| CVE-2025-12325 | SourceCodester Best Salon Management System forgot-password.php sql injection | best salon management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12326 | shawon100 RUET OJ POST Request process.php sql injection | ruet oj | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-53533 | Pi-hole Reflected XSS in 404-Error Page | web interface | 5.1 (v4.0) | Medium | 346755 , 347198 |
| CVE-2025-12203 | givanz Vvveb Code Editor functions.php sanitizeFileName path traversal | vvveb | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2025-12238 | code-projects Automated Voting System user.php sql injection | automated voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12242 | CodeAstro Gym Management System check-attendance.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12244 | code-projects Simple E-Banking System register.php cross site scripting | simple e-banking system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2025-12252 | code-projects Online Event Judging System action.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340156 |
| CVE-2025-12254 | code-projects Online Event Judging System add_judge.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12255 | code-projects Online Event Judging System add_contestant.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12256 | code-projects Online Event Judging System edit_contestant.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12261 | CodeAstro Gym Management System remove-announcement.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12262 | code-projects Online Event Judging System edit_criteria.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12263 | code-projects Online Event Judging System edit_judge.php sql injection | online event judging system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12266 | Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection | Central Authentication Service | 2.1 (v4.0) | Low | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-12289 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12290 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12298 | code-projects Simple Food Ordering System editcategory.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12299 | code-projects Simple Food Ordering System addproduct.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12300 | code-projects Simple Food Ordering System addcategory.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12302 | code-projects Simple Food Ordering System editproduct.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12327 | shawon100 RUET OJ description.php sql injection | ruet oj | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12328 | shawon100 RUET OJ contestproblem.php sql injection | ruet oj | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12329 | shawon100 RUET OJ details.php sql injection | ruet oj | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12224 | Iqbolshoh php-business-website contact.php cross site scripting | php-business-website | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12226 | SourceCodester Best House Rental Management System admin_class.php save_house sql injection | best house rental management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-12227 | projectworlds Gate Pass Management System add-pass.php cross site scripting | gate pass management system | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12287 | Bdtask Wholesale Inventory Control and Inventory Management System edit_profile sql injection | wholesale | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12294 | SourceCodester Point of Sales delete_category.php sql injection | point of sales | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12314 | code-projects Food Ordering System deleteitem.php sql injection | food ordering system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12315 | code-projects Food Ordering System menu.php sql injection | food ordering system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-32785 | Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) | web interface | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12228 | projectworlds Expense Management System Users Page create cross site scripting | expense management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12229 | projectworlds Expense Management System Roles Page create cross site scripting | expense management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12230 | projectworlds Expense Management System Currency create cross site scripting | expense management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12231 | projectworlds Expense Management System Expense Categories create cross site scripting | expense management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12303 | PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12311 | PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12312 | PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-55757 | Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla | Virtuemart component for Joomla | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12034 | Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting | Fast Velocity Minify | 4.4 (v3.1) | Medium | 346755 |
| CVE-2025-62716 | Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter | plane | 8.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-12136 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via sca | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | 6.8 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-9978 | Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS | Jeg Kit for Elementor | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10874 | Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 5.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-10723 | PixelYourSite < 11.1.2 - Admin+ LFI | PixelYourSite | 2.7 (v3.1) | Low | 344360 , 347009 |
| CVE-2025-40643 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | energy crm | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62606 | my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter | mylittleforum | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-58274 | CSMP iSecure Center OS Command Injection Vulnerability | CSMP iSecure Center | 8.3 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-62613 | VDO.Ninja - DOM-Based Cross-Site Scripting | vdo.ninja | 6.9 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2025-62597 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql' | wegia | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62598 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action' | wegia | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62695 | Stored XSS through system messages | Mediawiki - WikiLambda Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62595 | Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic | koa | 6.1 (v3.1) | Medium | 344365 |
| CVE-2025-41028 | SQL injection in Epsilon RH | Epsilon RH | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62429 | ClipBucket v5 executes arbitrary PHP code | clipbucket | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-62693 | Stored XSS through system messages in LastModified | Mediawiki - LastModified Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62698 | Stored XSS through system messages in ExternalGuidance | Mediawiki - ExternalGuidance | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62700 | Stored XSS through a system message in MultiBoilerplate | Mediawiki - MultiBoilerplate Extensionmaste | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62657 | Stored XSS through system messages in PageForms | MediaWiki PageForms extension | 5.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-11536 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | Element Pack – Widgets, Templates & Addons for Elementor | 5.0 (v3.1) | Medium | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-11941 | e107 CMS Avatar image.php path traversal | e107 | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11946 | LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting | logicaldoc | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62430 | ClipBucket v5 stored XSS via video/photo fields | clipbucket | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62505 | SSRF in lobehub/lobe-chat with native web fetch module | lobe-chat | 3.0 (v3.1) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-11908 | Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload | streamax crocus | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11909 | Shenzhen Ruiming Technology Streamax Crocus RepairRecord.do queryLast sql injection | streamax crocus | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11910 | Shenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injection | streamax crocus | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11911 | Shenzhen Ruiming Technology Streamax Crocus DeviceFault.do Query sql injection | streamax crocus | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11912 | Shenzhen Ruiming Technology Streamax Crocus DeviceState.do Query sql injection | streamax crocus | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11913 | Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversal | streamax crocus | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11914 | Shenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversal | streamax crocus | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-62653 | Stored XSS through system messages in PollNY | MediaWiki PollNY extension | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-41018 | SQL injection vulnerability in Sergestec's Exito | exito | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41019 | SQL injection vulnerability in Sergestec's Exito | SISTICK | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10706 | Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation | ClassifiedPro - reCommerce WordPress Theme | 8.8 (v3.1) | High | 340014 , 340023 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360029 , 390904 |
| CVE-2025-41021 | Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito | exito | 5.1 (v4.0) | Medium | 333141 , 340095 , 340247 , 340248 , 342259 , 346755 , 350148 |
| CVE-2023-7305 | SmartBI RMIServlet Unrestricted File Upload RCE | SmartBI | 9.2 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2024-13991 | Huijietong Cloud Video Platform fileDownload Arbitrary File Read | Cloud Video Platform | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-10730 | Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection | Wp tabber widget | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10139 | WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | WP BookWidgets | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59287 | Windows Server Update Service - Insecure Deserialization | Windows Server update service | 9.8 (v3.1) | Critical | 392647 |
| CVE-2025-61675 | FreePBX endpoint SQLi to RCE | endpoint | 8.6 (v4.0) | High | 340145 , 340156 |
| CVE-2025-61678 | FreePBX firmware file upload | endpointman | 8.6 (v4.0) | High | 340006 , 344360 , 351000 , 390719 |
| CVE-2025-62172 | Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name | core | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-5946 | Centreon authenticated command injection leading to RCE via broker engine "reload" parameter | centreon web | 7.2 (v3.1) | High | 390501 , 390709 |
| CVE-2025-11736 | itsourcecode Online Examination System index.php sql injection | online examination system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62360 | WeGIA SQL Injection via 'id_dependente' param at endpoint /html/funcionario/dependente_documento.php | wegia | 9.4 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62177 | WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint /html/funcionario/dependente_listar.php | wegia | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62179 | WeGIA SQL Injection via 'cpf' param at endpoint /html/funcionario/cadastro_funcionario_pessoa_existente.php | wegia | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11183 | Cross-Site Scripting Vulnerability in QWC2 | QWC2 | 6.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-11184 | Cross-Site Scripting Vulnerability in QWC2 Registration GUI | qwc-registration-gui | 6.9 (v4.0) | Medium | 333140 , 333141 |
| CVE-2025-62358 | WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter | wegia | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-11656 | ProjectsAndPrograms School Management System editNotes.php unrestricted upload | school management system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-11657 | ProjectsAndPrograms School Management System createNotice.php unrestricted upload | school management system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-11658 | ProjectsAndPrograms School Management System changeSllyabus.php unrestricted upload | school management system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-11659 | ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload | school management system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-11660 | ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload | school management system | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-11662 | SourceCodester Best Salon Management System booking.php sql injection | best salon management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62178 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame | wegia | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-62359 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet | wegia | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62361 | WeGIA Open Redirect Vulnerability in control.php endpoint nextPage parameter (metodo=listarTodos nomeClasse=Almoxari | wegia | 4.8 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2025-11667 | code-projects Automated Voting System add_candidate_modal.php. sql injection | automated voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11663 | Campcodes Online Beauty Parlor Management System manage-services.php sql injection | online beauty parlor management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11664 | Campcodes Online Beauty Parlor Management System search-appointment.php sql injection | online beauty parlor management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11668 | code-projects Automated Voting System update_user.php sql injection | automated voting system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-11629 | RainyGao DocSys getUserList.do getUserList sql injection | docsys | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11630 | RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal | docsys | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11631 | RainyGao DocSys deleteDoc.do path traversal | docsys | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-6439 | WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion | WooCommerce Designer Pro | 9.8 (v3.1) | Critical | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-11596 | code-projects E-Commerce Website delete_order_details.php sql injection | e-commerce website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11599 | Campcodes Online Apartment Visitor Management System forgot-password.php sql injection | online apartment visitor management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11601 | SourceCodester Online Student Result System login.php sql injection | online student result system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11604 | projectworlds Online Ordering Food System all-orders.php sql injection | online food ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11608 | code-projects E-Banking System POST Parameter register.php sql injection | simple e-banking system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11614 | SourceCodester Best Salon Management System edit-appointment.php sql injection | best salon management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11615 | SourceCodester Best Salon Management System add_invoice.php sql injection | best salon management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11590 | CodeAstro Gym Management System equipment-entry.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11591 | CodeAstro Gym Management System delete-member.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11592 | CodeAstro Gym Management System edit-equipmentform.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11593 | CodeAstro Gym Management System delete-equipment.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11597 | code-projects E-Commerce Website product_add_qty.php sql injection | e-commerce website | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-11600 | code-projects Simple Food Ordering System editcategory.php sql injection | simple food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11603 | code-projects Simple Food Ordering System editproduct.php sql injection | simple food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11607 | harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal | moneyprinterturbo | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-11610 | SourceCodester Simple Inventory System brand.php sql injection | simple inventory system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11611 | SourceCodester Simple Inventory System user.php sql injection | simple inventory system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11612 | code-projects Simple Food Ordering System addproduct.php sql injection | simple food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11613 | code-projects Simple Food Ordering System addcategory.php sql injection | simple food ordering system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11595 | Campcodes Online Apartment Visitor Management System admin-profile.php sql injection | online apartment visitor management system | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11189 | kiwire Cross-Site Scripting Vulnerability | kiwire | 7.3 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-11582 | code-projects Online Job Search Engine registration.php sql injection | online job search engine | 5.5 (v4.0) | Medium | 340017 , 340156 , 341245 , 380122 |
| CVE-2025-11583 | code-projects Online Job Search Engine postjob.php sql injection | online job search engine | 5.5 (v4.0) | Medium | 340017 , 341245 , 380122 |
| CVE-2025-11584 | code-projects Online Job Search Engine searchjob.php sql injection | online job search engine | 5.5 (v4.0) | Medium | 340017 , 341245 , 380122 |
| CVE-2025-11585 | code-projects Project Monitoring System useredit.php sql injection | project monitoring system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11190 | kiwire Security Vulnerability | kiwire | 5.4 (v3.1) | Medium | 344365 |
| CVE-2025-40640 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | energy crm | 5.1 (v4.0) | Medium | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2025-11589 | CodeAstro Gym Management System user-payment.php sql injection | gym management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11539 | Arbitrary Code Execution in Grafana Image Renderer Plugin | grafana-image-renderer | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-11371 | Gladinet CentreStack/Triofox Path Traversal | centrestack | 7.5 (v3.1) | High | 340007 , 344360 , 344365 , 347009 , 347019 , 390709 |
| CVE-2025-34248 | D-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion | Nuclias Connect | 7.2 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2025-35053 | Newforma Info Exchange (NIX) arbitrary file read and delete | project center | 6.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11556 | code-projects Simple Leave Manager user.php sql injection | simple leave manager | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-35056 | Newforma Info Exchange (NIX) limited file read | project center | 5.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11512 | code-projects Voting System voters_add.php cross site scripting | voting system | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11514 | code-projects Online Complaint Site index.php sql injection | online complaint site | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11516 | code-projects Online Complaint Site complaint-details.php sql injection | online complaint site | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11530 | code-projects Online Complaint Site state.php sql injection | online complaint site | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11552 | code-projects Online Complaint Site category.php sql injection | online complaint site | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-61913 | Flowise is vulnerable to arbitrary file read, arbitrary file write | flowise | 9.9 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2025-10351 | SQL injection vulnerability in Melis Platform | Melis Platform | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10635 | Find Me On <= 2.0.9.1 - Subscriber+ SQL Injection | Find Me On | 7.7 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-11420 | code-projects E-Commerce Website edit_order_details.php sql injection | e-commerce website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11422 | Campcodes Advanced Online Voting Management System login.php sql injection | advanced online voting system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11424 | code-projects Web-Based Inventory and POS System login.php sql injection | web-based inventory and pos system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11430 | SourceCodester Simple E-Commerce Bookstore cart.php sql injection | simple e-commerce bookstore | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11434 | itsourcecode Student Transcript Processing System login.php sql injection | student transcript processing system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11471 | SourceCodester Hotel and Lodge Management System edit_customer.php sql injection | hotel and lodge management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11472 | SourceCodester Hotel and Lodge Management System edit_room.php sql injection | hotel and lodge management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11473 | SourceCodester Hotel and Lodge Management System edit_curr.php sql injection | hotel and lodge management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11475 | projectworlds Advanced Library Management System view_member.php sql injection | advanced library management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11477 | SourceCodester Wedding Reservation Management System global.php sql injection | wedding reservation management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11479 | SourceCodester Wedding Reservation Management System function.php insertReservation sql injection | wedding reservation management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11480 | SourceCodester Simple E-Commerce Bookstore register.php sql injection | simple e-commerce bookstore | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11503 | PHPGurukul Beauty Parlour Management System manage-services.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11505 | PHPGurukul Beauty Parlour Management System new-appointment.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11506 | PHPGurukul Beauty Parlour Management System search-appointment.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11507 | PHPGurukul Beauty Parlour Management System search-invoices.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-61996 | OPEXUS FOIAXpress stored XSS via annual report template | foiaxpress | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11417 | Campcodes Advanced Online Voting Management System voters_add.php unrestricted upload | advanced online voting system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11426 | projectworlds Advanced Library Management System edit_book.php unrestricted upload | advanced library management system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11431 | code-projects Web-Based Inventory and POS System transaction.php sql injection | web-based inventory and pos system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11469 | SourceCodester Hotel and Lodge Management System save_customer.php sql injection | hotel and lodge management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11474 | SourceCodester Hotel and Lodge Management System edit_booking.php sql injection | hotel and lodge management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11478 | SourceCodester Farm Management System myCart.php sql injection | farm management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11481 | varunsardana004 Blood-Bank-And-Donation-Management-System donate_blood.php sql injection | blood bank and donation management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11487 | SourceCodester Farm Management System uploadProduct.php sql injection | farm management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11490 | wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection | desktopcommandermcp | 2.1 (v4.0) | Low | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2025-11509 | code-projects E-Commerce Website product_add.php sql injection | e-commerce website | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-11511 | code-projects E-Commerce Website supplier_add.php sql injection | e-commerce website | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11421 | code-projects Voting System candidates_edit.php cross site scripting | voting system | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11433 | itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting | leave management system | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11508 | code-projects Voting System voters_add.php unrestricted upload | voting system | 2.0 (v4.0) | Low | 351000 |
| CVE-2025-11425 | projectworlds Advanced Library Management System edit_admin.php cross site scripting | advanced library management system | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11485 | SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting | student grades management system | 1.9 (v4.0) | Low | 340095 , 346755 |
| CVE-2025-61784 | LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities | llama-factory | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-10162 | WordPress OrderConvo < 14 - Path Traversal | Admin and Customer Messages After Order for WooCommerce: OrderConvo | 7.5 (v3.1) | High | 336461 , 344360 |
| CVE-2025-11396 | code-projects Simple Food Ordering System product.php sql injection | simple food ordering system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11397 | SourceCodester Hotel and Lodge Management System login.php sql injection | hotel and lodge management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11415 | PHPGurukul Beauty Parlour Management System customer-list.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11416 | PHPGurukul Beauty Parlour Management System invoices.php sql injection | beauty parlour management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-40649 | Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC | Negotiator | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2025-11353 | code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11354 | code-projects Online Hotel Reservation System addslideexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11357 | code-projects Simple Banking System createuser.php sql injection | simple banking system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11358 | code-projects Simple Banking System removeuser.php sql injection | simple banking system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11359 | code-projects Simple Banking System transfermoney.php sql injection | simple banking system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11398 | SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload | hotel and lodge management system | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-11399 | SourceCodester Hotel and Lodge Management System save_room.php sql injection | hotel and lodge management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11401 | SourceCodester Hotel and Lodge Management System save_curr.php sql injection | hotel and lodge management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11404 | SourceCodester Hotel and Lodge Management System save_tax.php sql injection | hotel and lodge management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11409 | Campcodes Advanced Online Voting Management System index.php sql injection | advanced online voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11410 | Campcodes Advanced Online Voting Management System voters_add.php sql injection | advanced online voting system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-52472 | XWiki - HQL Injection | xwiki | 9.3 (v4.0) | Critical | 340087 , 340095 , 340156 , 340157 , 340159 , 360147 , 360148 |
| CVE-2025-61224 | DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting | dokuwiki | 6.5 (v3.1) | Medium | 333141 , 344370 |
| CVE-2025-61882 | Oracle E-Business Suite CVE-2025-61882 RCE | concurrent processing | 9.8 (v3.1) | Critical | 340007 , 340029 , 341256 , 342259 , 344360 , 344370 , 390709 , 391213 |
| CVE-2025-9952 | Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting | Trinity Audio – Text to Speech AI audio player to convert content into audio | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9561 | AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallax | AP Background | 8.8 (v3.1) | High | 351000 |
| CVE-2025-60787 | Remote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787) | motioneye | 7.2 (v3.1) | High | 330791 , 340152 , 393655 |
| CVE-2025-9130 | Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode | Unify | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9206 | Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | Meks Easy Maps | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2025-7825 | Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation | Schema Plugin For Divi, Gutenberg & Shortcodes | 6.3 (v3.1) | Medium | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2025-61603 | WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API descricao Parameter | wegia | 9.4 (v4.0) | Critical | 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2025-61605 | WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint | wegia | 9.4 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-59741 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-61666 | Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion | traccar | 8.7 (v4.0) | High | 344365 , 347019 |
| CVE-2025-40990 | Stored XSS in Creativeitem Ekushey CRM | ekushey project manager crm | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-59759 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59773 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59774 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-61606 | WeGIA: Open Redirect Vulnerability in control.php endpoint | wegia | 4.8 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2025-11138 | mirweiye wenkucms common.php createPathOne os command injection | wenkucms | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-11109 | Campcodes Computer Sales and Inventory System us_edit.php sql injection | computer sales and inventory system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11061 | Campcodes Online Learning Management System edit_student.php sql injection | online learning management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11069 | westboy CicadasCMS Add Department save cross site scripting | cicadascms | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-11037 | code-projects E-Commerce Website admin_index_search.php sql injection | e-commerce website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9985 | Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File | Featured Image from URL (FIFU) | 5.3 (v3.1) | Medium | 390716 |
| CVE-2025-11041 | itsourcecode Open Source Job Portal index.php sql injection | open source job portal | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-36851 | Rob–W cors-anywhere Misconfigured CORS Proxy Allows SSRF | Rob–W / cors-anywhere | 9.5 (v4.0) | Critical | 390719 , 398021 , 398022 , 398023 |
| CVE-2025-10940 | Total.js CMS Layout admin layouts_save cross site scripting | total.js | 1.9 (v4.0) | Low | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-56819 | Datart v1.0.0-rc.3 - Remote Code Execution | datart | 9.8 (v3.1) | Critical | 337209 , 337211 , 340095 |
| CVE-2025-48868 | Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive | horilla | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-43779 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-10839 | SourceCodester Pet Grooming Management Software inv-print.php sql injection | pet grooming management software | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10845 | Portabilis i-Educar view sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10846 | Portabilis i-Educar edit sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-59528 | Flowise - Remote Code Execution | flowise | 10.0 (v3.1) | Critical | 345240 , 380026 |
| CVE-2025-59527 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | flowise | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-10796 | code-projects Hostel Management System login.php sql injection | hostel management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10798 | code-projects Hostel Management System index.php sql injection | hostel management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10808 | Campcodes Farm Management System uploadProduct.php sql injection | farm management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-52367 | PivotX Remote Code Execution | pivotx | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350148 , 390585 , 390801 |
| CVE-2025-48703 | CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution | webpanel | 9.0 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-10709 | Four-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversal | water conservancy informatization | 5.5 (v4.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2025-55911 | ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF) | clipbucket | 6.5 (v3.1) | Medium | 340162 , 344370 , 398001 |
| CVE-2025-10493 | Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie | Chained Quiz | 5.3 (v3.1) | Medium | 390726 , 392647 |
| CVE-2025-9216 | StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authent | StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | 8.8 (v3.1) | High | 351000 |
| CVE-2025-59341 | esm.sh <= v136 - Local File Inclusion | esm.sh | 7.7 (v4.0) | High | 347009 |
| CVE-2025-10597 | kidaze CourseSelectionSystem COUNT2.php sql injection | courseselectionsystem | 6.9 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10596 | SourceCodester Online Exam Form Submission index.php sql injection | online exam form submission | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10598 | SourceCodester Pet Grooming Management Software search_product.php sql injection | pet grooming management software | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10599 | itsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injection | web-based internet laboratory management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10600 | SourceCodester Online Exam Form Submission register.php unrestricted upload | online exam form submission | 5.5 (v4.0) | Medium | 351000 |
| CVE-2025-10601 | SourceCodester Online Exam Form Submission index.php sql injection | online exam form submission | 5.5 (v4.0) | Medium | 340017 , 340145 , 340156 , 340457 , 341245 , 360147 , 360148 , 370016 , 380026 , 380122 , 390572 |
| CVE-2025-10621 | SourceCodester Hotel Reservation System editroomimage.php sql injection | hotel reservation system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10623 | SourceCodester Hotel Reservation System deleteuser.php sql injection | hotel reservation system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10624 | PHPGurukul User Management System login.php sql injection | user management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-59342 | esm.sh <= v136 - Arbitrary File Write via Path Traversal | esm.sh | 5.5 (v4.0) | Medium | 340162 , 340163 |
| CVE-2025-10590 | Portabilis i-Educar educar_usuario_det.php cross site scripting | i-educar | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10592 | itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection | online public access catalog | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10593 | SourceCodester Online Student File Management System update_student.php sql injection | online student file management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10594 | SourceCodester Online Student File Management System delete_student.php sql injection | online student file management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10595 | SourceCodester Online Student File Management System delete_user.php sql injection | online student file management system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10602 | SourceCodester Online Exam Form Submission delete_s1.php sql injection | online exam form submission | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10605 | Portabilis i-Educar agenda_preferencias.php cross site scripting | i-educar | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10613 | itsourcecode Student Information System leveledit1.php sql injection | student information system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10614 | itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting | e-logbook with health monitoring system for covid-19 | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10625 | SourceCodester Online Exam Form Submission dashboard.php sql injection | online exam form submission | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10584 | Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10591 | Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-57631 | tduck Arbitrary Code Execution Vulnerability | tduck | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2009-20006 | osCommerce 2.2 Arbitrary PHP Code Execution | osCommerce | 9.3 (v4.0) | Critical | 320464 , 320465 , 340014 , 340023 , 340029 , 340128 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360152 , 380018 , 390756 , 390801 , 393655 |
| CVE-2025-10564 | Campcodes Grocery Sales and Inventory System ajax.php sql injection | grocery sales and inventory system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-10479 | SourceCodester Online Student File Management System index.php sql injection | online student file management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10420 | SourceCodester Student Grading System form137.php sql injection | student grading system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10387 | codesiddhant Jasmin Ransomware handshake.php sql injection | jasmin ransomware | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-8280 | Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI'] | contact form 7 recaptcha | 5.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-40690 | SQL injection in PHPGurukul Online Fire Reporting System | online fire reporting system | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-40693 | Cross Site Scripting in PHPGurukul Online Fire Reporting System | online fire reporting system | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-54123 | Hoverfly <= 1.11.3 - Remote Code Execution | hoverfly | 9.8 (v3.1) | Critical | 344360 |
| CVE-2025-59049 | Mockoon < 9.2.0 - Path Traversal | mockoon | 7.5 (v3.1) | High | 347009 |
| CVE-2025-40725 | Reflected Cross-Site Scripting (XSS) in Azon Dominator | Azon Dominator PHP script | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2025-10210 | ChanCMS <= 3.3.0 - SQL Injection | chancms | 2.1 (v4.0) | Low | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-10232 | 299ko FileManagerAPIController.php delete path traversal | the file plugin/filemanager/controllers/FileManagerAPIController.php | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-10233 | kalcaddle kodbox editor.class.php fileSave path traversal | kodbox | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-54236 | Magento SessionReaper | commerce | 9.1 (v3.1) | Critical | 330791 , 334168 , 340152 , 340195 , 340196 , 360152 , 380019 , 383023 , 390700 , 390801 |
| CVE-2025-54249 | Adobe Experience Manager ≤ 6.5.23.0 – SSRF | experience manager | 6.5 (v3.1) | Medium | 390726 , 392647 |
| CVE-2025-10079 | PHPGurukul Small CRM get-quote.php sql injection | small crm | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10090 | Jinher OA - SQL Injection | jinher oa | 5.5 (v4.0) | Medium | 344366 , 361149 |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | jinher oa | 5.5 (v4.0) | Medium | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2025-10097 | SimStudioAI sim route.ts code injection | sim | 5.3 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-40642 | Reflected Cross-Site Scripting (XSS) in WebWork | WebWork PHP script | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10067 | itsourcecode POS Point of Sale System empty_table.php cross site scripting | point of sale system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-10063 | itsourcecode POS Point of Sale System deferred_table.php cross site scripting | point of sale system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-9990 | WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion | WordPress Helpdesk Integration | 8.1 (v3.1) | High | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-10012 | Portabilis i-Educar educar_historico_escolar_lst.php sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41036 | Stored Cross-Site Scripting vulnerability in appRain CMF | apprain | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2025-41044 | Stored Cross-Site Scripting vulnerability in appRain CMF | apprain | 5.1 (v4.0) | Medium | 333140 , 333141 , 342259 |
| CVE-2025-55748 | XWiki Platform - Path Traversal | xwiki | 9.3 (v4.0) | Critical | 340007 |
| CVE-2025-9925 | projectworlds Travel Management System detail.php sql injection | travel management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9765 | itsourcecode Sports Management System tournament_details.php sql injection | sports management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9766 | itsourcecode Sports Management System facilitator.php sql injection | sports management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9767 | itsourcecode Sports Management System sporttype.php sql injection | sports management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9755 | Khanakag-17 Library Management System index.php cross site scripting | library management system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-9800 | SimStudioAI sim HTML File route.ts import unrestricted upload | sim | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-9744 | Loan Management System 1.0 - SQL Injection | online loan management system | 5.5 (v4.0) | Medium | 340156 , 341145 |
| CVE-2009-20010 | Dogfood CRM spell.php RCE | Dogfood CRM | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2005-10004 | Cacti graph_view.php Remote Command Execution | cacti | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390722 , 393655 |
| CVE-2024-13342 | Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload | booster for woocommerce | 9.8 (v3.1) | Critical | 351000 |
| CVE-2025-9606 | Portabilis i-Educar agenda_preferencias.php sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-57819 | FreePBX ajax.php unauthenticated SQLi to RCE | freepbx | 10.0 (v4.0) | Critical | 340156 , 340157 , 341245 , 344365 , 344370 , 360147 , 360148 |
| CVE-2025-51969 | online shopping system advanced SQL Injection Vulnerability | online shopping system advanced | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9592 | itsourcecode Apartment Management System bill_info.php sql injection | apartment management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9593 | itsourcecode Apartment Management System unit_status_info.php sql injection | apartment management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9594 | itsourcecode Apartment Management System complain_info.php sql injection | apartment management system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9591 | ZrLog Theme Configuration Form config cross site scripting | ZrLog | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 |
| CVE-2024-13981 | LiveBos UploadFile.do Arbitrary File Upload | LiveBOS | 10.0 (v4.0) | Critical | 351000 |
| CVE-2024-13984 | Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload | TianQing Management Center | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-34163 | Dongsheng Logistics Software Unauthenticated Arbitrary File Upload | Dongsheng Logistics Software | 10.0 (v4.0) | Critical | 351000 |
| CVE-2025-34162 | Bian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParams | Bian Que Feijiu Intelligent Emergency and Quality Control System | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9531 | Portabilis i-Educar Agenda agenda.php sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-55526 | n8n workflow collection Path Traversal Vulnerability | n8n workflow collection | 9.1 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2010-20109 | Barracuda Multiple Product "locale" Directory Traversal | Spam & Virus Firewall | 8.7 (v4.0) | High | 340007 , 390613 , 390614 |
| CVE-2025-55523 | Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download | agent-zero | 3.5 (v3.1) | Low | 344360 , 347009 , 390709 |
| CVE-2010-20059 | FreeNAS exec_raw.php Arbitrary Command Execution | FreeNAS | 9.3 (v4.0) | Critical | 350147 , 390722 , 390904 |
| CVE-2011-10026 | Spreecommerce Arbitrary Command Execution | spree | 9.3 (v4.0) | Critical | 340128 , 380018 , 390801 |
| CVE-2025-54726 | WordPress JS Archive List <= 6.1.5 - SQL Injection | JS Archive List | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2009-10005 | ContentKeeper Web Appliance mimencode File Access | Web Appliance | 8.7 (v4.0) | High | 344360 , 347009 |
| CVE-2012-10061 | Sockso Music Host Server 1.5 Directory Traversal | Music Host Server | 8.7 (v4.0) | High | 390716 |
| CVE-2025-57790 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 8.7 (v4.0) | High | 340006 , 390719 |
| CVE-2025-54988 | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | tika | 8.4 (v3.1) | High | 330791 , 340152 , 344360 , 344372 , 390719 , 391213 |
| CVE-2025-48157 | WordPress Formality Plugin <= 1.5.9 - Local File Inclusion | Formality | 8.1 (v3.1) | High | 344360 , 347009 , 382238 , 390709 |
| CVE-2025-57788 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 6.9 (v4.0) | Medium | 340006 , 390719 |
| CVE-2025-57791 | Commvault Command-Line Argument Injection to Traversal Remote Code Execution | commvault | 6.9 (v4.0) | Medium | 340006 , 390719 |
| CVE-2025-51990 | XWiki – Stored Cross-Site Scripting (XSS) | xwiki | 4.8 (v3.1) | Medium | 342259 |
| CVE-2025-9236 | Portabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injection | i-educar | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41242 | Spring Framework - Path Traversal | Spring Framework | 5.9 (v3.1) | Medium | 347009 |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | 9.8 (v3.1) | Critical | 330791 , 340128 , 340152 , 344370 , 360152 , 380018 , 382238 , 390801 |
| CVE-2011-10011 | WeBid converter.php Remote PHP Code Injection | WeBid | 10.0 (v4.0) | Critical | 390614 |
| CVE-2011-10013 | Traq admincp/common.php Remote Code Execution | Issue Tracking System | 10.0 (v4.0) | Critical | 340011 , 340095 , 344363 , 346755 |
| CVE-2011-10017 | Snortreport nmap.php/nbtscan.php Remote Command Execution | Snort Report | 10.0 (v4.0) | Critical | 340128 , 344363 , 380018 , 390801 , 393655 |
| CVE-2011-10019 | Spreecommerce 0.60.1 Arbitrary Command Execution | spree | 10.0 (v4.0) | Critical | 340128 , 380018 , 390801 |
| CVE-2012-10054 | Umbraco CMS Remote Command Execution | umbraco cms | 9.3 (v4.0) | Critical | 344360 , 344364 |
| CVE-2011-10009 | S40 0.4.2 CMS Directory Traversal Vulnerability | S40 CMS | 8.7 (v4.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2025-55169 | WeGIA - Directory Traversal | wegia | 10.0 (v4.0) | Critical | 340007 , 344360 |
| CVE-2025-52970 | Fortinet FortiWeb - Authentication Bypass to Admin Privilege | fortiweb | 8.1 (v3.1) | High | 340157 , 360147 , 360148 |
| CVE-2012-10038 | Auxilium RateMyPet Arbitrary File Upload Vulnerability | RateMyPet | 9.3 (v4.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2025-25231 | Omnissa Workspace ONE UEM - Path Traversal | workspace one uem console | 7.5 (v3.1) | High | 340007 |
| CVE-2012-10044 | MobileCartly 1.0 Arbitrary File Creation Vulnerability | MobileCartly | 10.0 (v4.0) | Critical | 340087 , 340128 , 380018 , 390801 |
| CVE-2012-10036 | Project Pier Arbitrary File Upload Vulnerability | ProjectPier | 9.3 (v4.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2012-10042 | Sflog! CMS 1.0 Arbitrary File Upload Vulnerability | Sflog! CMS | 8.7 (v4.0) | High | 330791 , 334168 , 340133 , 340152 |
| CVE-2025-4576 | Liferay Portal & DXP - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34152 | Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via time Parameter | M300 Wi-Fi Repeater | 9.4 (v4.0) | Critical | 344364 , 393655 |
| CVE-2025-50286 | Grav CMS Admin Direct Install Authenticated Plugin Upload RCE | grav | 8.1 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2025-32430 | XWiki Platform - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2012-10026 | WordPress Asset-Manager PHP File Upload Vulnerability | asset-manager | 10.0 (v4.0) | Critical | 330791 , 334168 , 340152 , 382238 |
| CVE-2013-10069 | D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution | dir-600 firmware | 10.0 (v4.0) | Critical | 340029 , 344363 , 390501 , 390904 |
| CVE-2012-10027 | WordPress WP-Property PHP File Upload Vulnerability | WordPress Plugin | 9.3 (v4.0) | Critical | 330791 , 340152 |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | 9.3 (v4.0) | Critical | 340007 , 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2025-2611 | ICTBroadcast - Command Injection | ICTBroadcast | 9.3 (v4.0) | Critical | 344361 , 393655 |
| CVE-2012-10034 | ClanSphere 2011.3 Local File Inclusion Vulnerability | clansphere | 8.7 (v4.0) | High | 340006 , 344360 |
| CVE-2012-10028 | Netwin SurgeFTP Remote Command Execution | SurgeFTP | 8.6 (v4.0) | High | 340014 , 340029 |
| CVE-2025-8538 | Portabilis i-Educar novo cross site scripting | i-educar | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-8539 | Portabilis i-Educar public_distrito_cad.php cross site scripting | i-educar | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | 9.3 (v4.0) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2025-6204 | DELMIA Apriso - Command Injection | delmia apriso | 8.0 (v3.1) | High | 340095 , 341245 , 344361 , 344365 , 344366 , 347019 , 390724 |
| CVE-2025-54782 | NestJS DevTools Integration - Remote Code Execution | devtools-integration | 9.4 (v4.0) | Critical | 345240 |
| CVE-2013-10060 | Netgear DGN2200B pppoe.cgi Remote Command Execution | dgn2200b firmware | 9.4 (v4.0) | Critical | 340014 , 340029 , 340193 , 344361 , 344363 , 344364 , 344366 |
| CVE-2013-10048 | D-Link Devices Unauthenticated Remote Command Execution | dir-300 firmware | 9.3 (v4.0) | Critical | 390501 |
| CVE-2013-10049 | Raidsonic NAS Devices Unauthenticated Remote Command Execution | IB-NAS5220 | 9.3 (v4.0) | Critical | 344360 , 344363 , 344370 , 350147 |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical | 340011 , 340087 , 340095 , 344363 , 346755 , 360152 , 390801 |
| CVE-2013-10055 | Havalite CMS Arbitary File Upload Vulnerability | Havalite CMS | 9.3 (v4.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2013-10058 | Linksys WRT160nv2 apply.cgi Remote Command Injection | WRT160nv2 | 8.6 (v4.0) | High | 330925 , 344361 , 344363 |
| CVE-2013-10061 | Netgear DGN1000B setup.cgi Remote Command Execution | dgn1000b firmware | 8.6 (v4.0) | High | 340014 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2013-10062 | Linksys E1500 Directory Traversal Vulnerability | E1500 | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-51501 | Microweber CMS2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-51502 | Microweber CMS 2.0 - Reflected XSS in Admin Page Creation | microweber | 6.1 (v3.1) | Medium | 333140 , 341266 |
| CVE-2014-125123 | Kloxo SQL Injection and Remote Code Execution | Kloxo | 10.0 (v4.0) | Critical | 334168 , 340145 , 340156 , 341145 , 341245 |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | 9.3 (v4.0) | Critical | 330791 , 334168 , 340128 , 340152 , 347019 , 360152 , 380018 , 390801 |
| CVE-2014-125125 | A10 Networks AX Loadbalancer Directory Traversal | AX Series Loadbalancer | 8.8 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2013-10039 | GestioIP Remote Command Execution | IPAM | 8.7 (v4.0) | High | 344361 , 393655 |
| CVE-2025-54589 | Copyparty <=1.18.6 - Cross-Site Scripting | copyparty | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-44136 | MapTiler Tileserver-php v2.0 - Unauthenticated XSS | tileserver php | 9.8 (v3.1) | Critical | 341256 , 342259 , 346755 , 350148 |
| CVE-2025-44137 | MapTiler Tileserver-php v2.0 - Unauthenticated File Read | tileserver php | 8.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-8266 | ChanCMS <= 3.1. - Remote Code Execution | chancms | 2.1 (v4.0) | Low | 345240 , 380026 |
| CVE-2025-54597 | Heimdall Application Dashboard < 2.7.3 - Reflected XSS | heimdall | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 , 350147 , 350148 |
| CVE-2014-125115 | Pandora FMS Default Credential / SQLi Remote Code Execution | Pandora FMS | 10.0 (v4.0) | Critical | 331028 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390700 |
| CVE-2015-10143 | WordPress Platform Theme File Upload Vulnerability | platform theme | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2014-125118 | eScan Web Management Console Command Injection | eScan Web Management Console | 9.4 (v4.0) | Critical | 344363 , 344364 , 344366 , 393655 |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | 9.3 (v4.0) | Critical | 340095 , 340128 , 344370 , 346755 , 360152 , 390801 |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | 8.7 (v4.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 390700 , 390801 |
| CVE-2015-10141 | xdebug Unauthenticated OS Command Execution | Xdebug | 9.3 (v4.0) | Critical | 340011 , 356331 |
| CVE-2016-15044 | Kaltura Remote PHP Code Execution | Video Platform | 9.3 (v4.0) | Critical | 340128 , 340195 , 380018 , 390801 |
| CVE-2017-20198 | DC/OS Marathon UI Docker Exploit | DC/OS Marathon | 9.3 (v4.0) | Critical | 330791 , 340152 , 344363 , 344364 , 344366 , 344370 , 350147 , 390904 |
| CVE-2018-25114 | osCommerce 2.3.4.1 - Remote Code Execution | Online Merchant | 9.3 (v4.0) | Critical | 340023 , 340095 , 344360 , 344370 |
| CVE-2010-10012 | Httpdasm Directory Traversal | httpdasm | 8.7 (v4.0) | High | 340006 , 347019 , 390709 , 390716 |
| CVE-2018-25113 | Dicoogle PACS Web Server Directory Traversal | PACS Web Server | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-6174 | WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected) | Qwizcards | online quizzes and flashcards | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2015-10137 | Wordpress N-Media Website Contact Form Upload Vulnerability | website contact form with file upload | 9.8 (v3.1) | Critical | 382238 |
| CVE-2025-34141 | ETQ Reliance - Reflected XSS via SQLConverterServlet | reliance | 5.1 (v4.0) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 |
| CVE-2025-53770 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint server | 9.8 (v3.1) | Critical | 330906 , 344361 , 344363 , 350147 |
| CVE-2025-53771 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint server | 6.5 (v3.1) | Medium | 330906 , 344361 , 344363 , 350147 |
| CVE-2015-10135 | WordPress WPshop eCommerce Arbitrary File Upload Vulnerability | wpshop 2 | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 382238 |
| CVE-2015-10138 | Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload | work the flow file upload | 9.8 (v3.1) | Critical | 351000 |
| CVE-2016-15043 | WordPress WP Mobile Detector 3.5 Shell Upload | wp mobile detector | 9.8 (v3.1) | Critical | 340128 , 340162 , 340163 , 344370 , 360152 , 380018 , 390801 , 391740 |
| CVE-2015-10134 | WordPress Simple Backup File Read Vulnerability | simple backup | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 , 393758 |
| CVE-2015-10136 | WordPress GI-Media Library Plugin Directory Traversal Vulnerability | gi-media-library | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2015-10133 | WordPress Subscribe Comments File Read Vulnerability | subscribe to comments | 7.2 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-25257 | Fortinet FortiWeb - SQL Injection | fortiweb | 9.8 (v3.1) | Critical | 340156 |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | 9.3 (v4.0) | Critical | 340095 , 340128 , 360152 , 380018 , 380026 , 390801 |
| CVE-2025-34125 | D-Link Cookie Command Execution | DSP-W110A1 | 9.3 (v4.0) | Critical | 330791 , 334168 , 340152 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2025-34118 | Linknat Vos Manager Traversal | VOS Manager | 8.7 (v4.0) | High | 347009 |
| CVE-2025-34126 | RIPS Scanner Directory Traversal | RIPS Scanner | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | 9.4 (v4.0) | Critical | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2025-34111 | Tiki Wiki Unauthenticated File Upload Vulnerability | tikiwiki cms/groupware | 9.3 (v4.0) | Critical | 330791 , 340006 , 340152 , 390719 , 393781 |
| CVE-2025-34115 | OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php | OP5 Monitor | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-34108 | Disk Pulse Enterprise Login Buffer Overflow | Disk Pulse Enterprise | 8.6 (v4.0) | High | 344365 |
| CVE-2025-53833 | LaRecipe < 2.8.1 Remote Code Execution via SSTI | larecipe | 10.0 (v3.1) | Critical | 340087 |
| CVE-2024-26291 | Avid NEXIS Agent - Arbitrary File Read | nexis | 8.7 (v4.0) | High | 344360 , 344365 , 347009 , 390709 |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 382238 , 390700 , 390801 |
| CVE-2020-36849 | WordPress AIT CSV Import Export Unauthenticated Remote Code Execution | csv import / export | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 382238 |
| CVE-2025-6058 | WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload | wpbookit | 9.8 (v3.1) | Critical | 382238 |
| CVE-2025-47812 | Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812) | wing ftp server | 10.0 (v3.1) | Critical | 344362 , 344363 , 380026 , 390614 |
| CVE-2025-34101 | Serviio Media Server checkStreamUrl Command Execution | Media Server | 9.3 (v4.0) | Critical | 330791 , 340152 |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | 8.6 (v4.0) | High | 330791 , 334168 , 340152 , 360152 , 390724 , 390801 |
| CVE-2025-34098 | Riverbed SteelHead VCX File Read | SteelHead VCX | 7.1 (v4.0) | High | 340007 , 344360 , 344370 , 390709 |
| CVE-2025-34085 | WordPress Simple File List <=4.2.2 - Remote Code Execution | - | 9.8 | Critical | 382238 |
| CVE-2025-44177 | White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI) | protop | 8.2 (v3.1) | High | 347009 , 390727 , 392648 |
| CVE-2025-6970 | WordPress Events Manager <= 7.0.3 - SQL Injection | events manager | 7.5 (v3.1) | High | 380122 |
| CVE-2025-49704 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint server | 8.8 (v3.1) | High | 330906 , 344361 , 344363 , 350147 |
| CVE-2025-49706 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint enterprise server | 6.5 (v3.1) | Medium | 330906 , 344361 , 344363 , 350147 |
| CVE-2025-7160 | Zoo Management System 1.0 - SQL Injection | zoo management system | 5.5 (v4.0) | Medium | 340145 , 340156 |
| CVE-2025-6793 | Marvell QConvergeConsole Path Traversal (CVE-2025-6793) | qconvergeconsole | 9.4 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | 7.5 (v4.0) | High | 340007 , 340128 , 344360 , 360152 , 380018 , 390709 , 390801 |
| CVE-2025-5961 | WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload | migration, backup, staging | 7.2 (v3.1) | High | 377360 |
| CVE-2025-34073 | Maltrail Unauthenticated Command Injection | Maltrail | 10.0 (v4.0) | Critical | 340014 , 340029 , 344361 , 344363 , 344370 |
| CVE-2025-34074 | Lucee Authenticated Scheduled Job Code Execution | Lucee | 9.4 (v4.0) | Critical | 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2025-34078 | NSClient++ 0.5.2.35 - Privilege escalation | nsclient++ | 7.3 (v4.0) | High | 344370 |
| CVE-2025-34076 | Microweber CMS v1.2.10 Local File Inclusion (Authenticated) | microweber | 6.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-49029 | WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution | Custom Login And Signup Widget | 9.1 (v3.1) | Critical | 377360 |
| CVE-2025-49493 | Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE) | CloudTest | 5.8 (v3.1) | Medium | 344372 |
| CVE-2025-34045 | WeiPHP 5.0 - Path Traversal | weiphp | 8.7 (v4.0) | High | 340007 , 344360 |
| CVE-2025-20281 | Cisco ISE - Remote Code Execution | identity services engine | 10.0 (v3.1) | Critical | 392301 |
| CVE-2024-51978 | Multiple Brother devices authentication bypass via default administrator password generation | DCP-J928N-W/B | 9.8 (v3.1) | Critical | 390709 |
| CVE-2025-48954 | Discourse OAuth Social Login - Cross-site Scripting | discourse | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 344362 , 346755 , 347198 , 350148 , 390712 |
| CVE-2024-51977 | Multiple Brother devices authentication bypass via default administrator password generation | HL-L8260CDN | 5.3 (v3.1) | Medium | 390709 |
| CVE-2025-34035 | EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution | esr300 firmware | 10.0 (v4.0) | Critical | 341245 |
| CVE-2025-34037 | Linksys E-Series TheMoon Remote Command Injection | E4200 | 10.0 (v4.0) | Critical | 312658 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-34040 | Zhiyuan OA - arbitrary file upload leading | Zhiyuan OA Web Application System | 10.0 (v4.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2021-41691 | openSIS Student Information System 8.0 SQL Injection | opensis | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-34031 | Moodle Jmol Filter 6.1 - Local File Inclusion | jmol | 8.7 (v4.0) | High | 340165 , 344360 , 347009 |
| CVE-2025-34032 | Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting | jmol | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-6403 | Code-Projects School Fees Payment System 1.0 - SQL Injection | school fees payment system | 5.5 (v4.0) | Medium | 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2025-34030 | sar2html <=3.2.2 Plot Parameter - Remote Code Execution | sar2html | 10.0 (v4.0) | Critical | 340014 , 340193 , 344364 , 344366 |
| CVE-2025-49132 | Pterodactyl Panel CVE-2025-49132 Remote Code Execution | panel | 10.0 (v3.1) | Critical | 340007 , 340087 , 340128 , 344360 , 344370 , 347009 , 380018 , 390709 |
| CVE-2025-25034 | SugarCRM REST Unserialize PHP Code Execution | SugarCRM | 9.3 (v4.0) | Critical | 340095 , 340128 , 344370 , 346755 , 360152 , 380018 , 390801 |
| CVE-2025-34023 | Karel IP Phone IP1211 Web Management Panel - Local File Inclusion | Karel IP Phone IP1211 | 8.5 (v4.0) | High | 330925 , 340007 , 344360 , 347009 , 390709 |
| CVE-2025-1562 | Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control | funnelkit automations | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-34510 | Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution | experience commerce | 8.8 (v3.1) | High | 340007 , 344360 , 344364 , 390109 , 390709 , 390724 |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2025-6095 | Jasmin Ransomware Web Server Unauthenticated SQL Injection | jasmin-ransomware | 5.5 (v4.0) | Medium | 340007 , 340016 , 340156 , 344360 , 344370 , 390709 |
| CVE-2025-45985 | Blink Router - Command Injection | bl-wr9000 firmware | 9.8 (v3.1) | Critical | 344363 |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting | Docs (DocumentServer) | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-27817 | Apache Kafka Client - Arbitrary File Read | kafka | 7.5 (v3.1) | High | 344360 |
| CVE-2025-47608 | Abandoned Cart for WooCommerce SQLi Scanner | Recover abandoned cart for WooCommerce | 9.3 (v3.1) | Critical | 340156 |
| CVE-2025-48281 | MyStyle Custom Product Designer <= 3.21.1 - SQL Injection | MyStyle Custom Product Designer | 9.3 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2025-4652 | Broadstreet WordPress plugin - Reflected XSS | broadstreet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 377360 |
| CVE-2025-49619 | Skyvern SSTI Remote Code Execution | Skyvern | 8.5 (v3.1) | High | 340128 , 360151 , 380018 , 393655 |
| CVE-2025-5569 | IdeaCMS <= 1.7 - SQL Injection | ideacms | 5.3 (v4.0) | Medium | 341245 |
| CVE-2025-45854 | JEHC-BPM - Remote Code Execute | jehc-bpm | 10.0 (v3.1) | Critical | 344363 , 390724 |
| CVE-2025-44148 | MailEnable Mail Service < v10 - Cross-Site Scripting | mailenable | 9.8 (v3.1) | Critical | 344363 , 346755 |
| CVE-2025-49002 | DataEase - Remote Code Execution | dataease | 8.2 (v4.0) | High | 340195 |
| CVE-2025-5086 | Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization | delmia apriso | 9.0 (v3.1) | Critical | 331702 , 344380 |
| CVE-2025-49113 | Roundcube Post-Auth RCE via PHP Object Deserialization | webmail | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2025-5287 | Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection | Likes and Dislikes Plugin | 7.5 (v3.1) | High | 380122 |
| CVE-2025-5298 | Campcodes Online Hospital Management System 1.0 - SQL Injection | online hospital management system | 6.9 (v4.0) | Medium | 390726 , 392647 |
| CVE-2025-48827 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 9.8 (v3.1) | Critical | 340128 , 344370 , 380018 , 390801 |
| CVE-2025-48828 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 8.1 (v3.1) | High | 340128 , 344370 , 380018 , 390801 |
| CVE-2025-32814 | NetMRI Unauthenticated SQL Injection via skipjackUsername | netmri | 9.8 (v3.1) | Critical | 340016 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 |
| CVE-2025-32813 | Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request | netmri | 7.2 (v3.1) | High | 393655 |
| CVE-2025-32815 | NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials | netmri | 6.5 (v3.1) | Medium | 344360 , 390709 , 390722 |
| CVE-2025-4524 | WordPress Madara - Local File Inclusion | Madara – Responsive and modern WordPress theme for manga sites | 9.8 (v3.1) | Critical | 340748 , 344360 , 390709 |
| CVE-2025-4008 | MeteoBridge <= 6.1 - Remote Code Execution | meteobridge vm | 8.7 (v4.0) | High | 393655 |
| CVE-2025-46822 | Java-springboot-codebase 1.1 - Arbitrary File Read | Java-springboot-codebase | 7.7 (v4.0) | High | 347009 |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium | 340003 , 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2025-47577 | TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload | ti-woocommerce-wishlist | 10.0 (v3.1) | Critical | 382238 |
| CVE-2024-6159 | Push Notification for Post and BuddyPress <= 1.93 - SQL Injection | push notification for post and buddypress | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-8673 | Z-Downloads < 1.11.7 - Cross-Site Scripting | z-downloads | 9.1 (v3.1) | Critical | 377360 |
| CVE-2024-9765 | EKC Tournament Manager WordPress plugin - Path Traversal | ekc tournament manager | 6.5 (v3.1) | Medium | 344360 , 347009 , 377360 |
| CVE-2024-12724 | WP DeskLite - Reflected XSS | wp desklite | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2024-12732 | AffiliateImporterEb <= 1.0.6 - Reflected XSS | affiliateimportereb | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-12734 | Advance Post Prefix WordPress plugin - Reflected XSS | advance post prefix | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-12873 | Custom Field Manager WordPress - Cross-Site Scripting | custom field manager | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13619 | LifterLMS < 8.0.1 - Cross-Site Scripting | lifterlms | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13727 | MemberSpace WordPress - Cross-Site Scripting | memberspace | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-1303 | Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting | plugin oficial | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2023-6030 | LogDash Activity Log <= 1.1.3 - SQL Injection | logdash activity log | 5.4 (v3.1) | Medium | 340016 , 341245 , 380026 , 380122 |
| CVE-2025-47445 | WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download | eventin | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2025-47783 | Label Studio < 1.18.0 - Reflected XSS | label studio | 7.6 (v4.0) | High | 340147 , 340148 , 342259 , 344370 , 346755 |
| CVE-2025-0133 | PAN-OS - Reflected Cross-Site Scripting | PAN-OS | 2.7 (v4.0) | Low | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2024-46506 | Unauthenticated RCE in NetAlertX | netalertx | 10.0 (v3.1) | Critical | 340029 , 344370 , 392301 , 392648 |
| CVE-2025-4428 | Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution | endpoint manager mobile | 8.8 (v3.1) | High | 337209 , 337210 , 337211 , 340087 , 340095 , 380026 , 393655 |
| CVE-2024-48766 | NetAlertX File Read Vulnerability | netalertx | 8.6 (v3.1) | High | 340007 , 340029 , 344360 , 390709 |
| CVE-2025-4396 | Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection | Relevanssi Premium | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2025-4427 | Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution | endpoint manager mobile | 7.5 (v3.1) | High | 337209 , 337210 , 337211 , 340087 , 340095 , 380026 , 393655 |
| CVE-2025-47204 | Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting | bootstrap multiselect | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-41393 | Ricoh Web Image Monitor - Reflected XSS | Multiple laser printers and MFPs which implement Web Image Monitor | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-47828 | H5P-Nodejs-library Cross-site Scripting Vulnerability | H5P-Nodejs-library | 6.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 |
| CVE-2025-2776 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical | 330791 , 340152 , 344372 |
| CVE-2025-2777 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical | 330791 , 340152 , 344372 |
| CVE-2025-2775 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 7.5 (v3.1) | High | 330791 , 340152 , 344372 |
| CVE-2025-47423 | Personal Weather Station Dashboard 12 - Directory Traversal | Personal Weather Station Dashboard | 5.8 (v3.1) | Medium | 340007 |
| CVE-2025-2011 | WordPress Depicter Plugin SQL Injection (CVE-2025-2011) | Depicter — Popup & Slider Builder | 7.5 (v3.1) | High | 340016 , 340017 , 340156 , 360147 , 360148 |
| CVE-2025-4388 | Liferay Portal - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2024-13322 | Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection | ads pro | 7.5 (v3.1) | High | 380122 |
| CVE-2025-27007 | WordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007) | OttoKit | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-46565 | Vite Dev Server - Information Exposure | vite | 6.0 (v4.0) | Medium | 390709 |
| CVE-2025-32970 | XWiki WYSIWYG API - Open Redirect | xwiki | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2025-46349 | YesWiki Reflected XSS via File Upload | yeswiki | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-46549 | YesWiki <= 4.5.1 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2025-46550 | YesWiki < 4.5.4 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-4078 | Wangshen SecGate 3600 Path Traversal Vulnerability | SecGate 3600 | 5.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-32432 | Craft CMS Image Transform Preauth RCE (CVE-2025-32432) | craft cms | 10.0 (v3.1) | Critical | 330791 , 340011 , 340128 , 340152 , 344365 , 380018 , 390801 |
| CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader - Deserialization | netweaver | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-2558 | WordPress The Wound Theme <= 0.0.1 - Local File Inclusion | the wound | 8.6 (v3.1) | High | 336461 , 340007 , 344360 , 347009 , 381206 , 390709 |
| CVE-2025-32969 | XWiki REST API Query - SQL Injection | xwiki | 9.3 (v4.0) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-13569 | WordPress Front End Users - Reflected XSS | front end users | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2025-28367 | mojoPortal <=2.9.0.1 - Directory Traversal | mojoportal | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-32778 | Web-Check < 2.0.1 Screenshot API - OS Command Injection | web-check | 9.3 (v4.0) | Critical | 344363 , 393655 |
| CVE-2025-2563 | WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563) | user registration & membership | 8.1 (v3.1) | High | 300020 , 340128 , 360152 , 380018 , 390801 |
| CVE-2025-32614 | EventON Lite <= 2.4 - Authenticated Local File Inclusion | flavor | 8.8 (v3.1) | High | 344360 , 377360 , 390709 |
| CVE-2025-2636 | InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion | InstaWP Connect – 1-click WP Staging & Migration | 8.1 (v3.1) | High | 340007 |
| CVE-2025-3102 | WordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007) | OttoKit: All-in-One Automation Platform | 8.1 (v3.1) | High | 330791 , 340152 |
| CVE-2025-32375 | BentoML\ | bentoml | 9.8 (v3.1) | Critical | 391213 |
| CVE-2025-3248 | Langflow AI RCE | langflow | 9.8 (v3.1) | Critical | 330791 , 340095 , 340152 , 344360 , 344370 |
| CVE-2025-27520 | BentoML RCE | bentoml | 9.8 (v3.1) | Critical | 391213 |
| CVE-2025-2075 | Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation | uncanny automator | 8.8 (v3.1) | High | 377360 |
| CVE-2025-32257 | 1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure | 1-click-migration | 5.3 (v3.1) | Medium | 390716 |
| CVE-2025-2945 | pgAdmin Query Tool authenticated RCE (CVE-2025-2945) | pgadmin 4 | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 341245 |
| CVE-2025-31486 | Vite server.fs.deny Bypass - Local File Inclusion | vite | 5.3 (v3.1) | Medium | 347009 , 390709 |
| CVE-2025-29085 | Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component | vipshop Saturn v.3.5.1 and before | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-3096 | Clinic\ | Clinic's Patient Management System | 9.3 (v4.0) | Critical | 330791 , 334168 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2025-31131 | Yeswiki < 4.5.2 - Unauthenticated Path Traversal | yeswiki | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-30004 | Xorcom CompletePBX Authenticated Command Injection via Task Scheduler | completepbx | 8.8 (v3.1) | High | 393655 |
| CVE-2025-30005 | Xorcom CompletePBX Arbitrary File Read and Deletion via systemDataFileName | completepbx | 8.3 (v3.1) | High | 340006 , 340007 , 344360 , 347009 |
| CVE-2025-31125 | Vite Development Server - Path Traversal | vite | 7.5 (v3.1) | High | 347009 , 390709 , 390716 |
| CVE-2025-2292 | Xorcom CompletePBX Authenticated File Disclosure via Backup Download | completepbx | 6.5 (v3.1) | Medium | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Local File Inclusion | Kubio AI Page Builder | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2025-29306 | FoxCMS v.1.2.5 - Remote Code Execution | foxcms | 9.8 (v3.1) | Critical | 344360 , 344370 , 347009 , 393655 |
| CVE-2024-55964 | Appsmith RCE | appsmith | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-30567 | WordPress WP01 - Path Traversal | WP01 | 7.5 (v3.1) | High | 390709 |
| CVE-2025-29635 | D-Link DIR-823X set_prohibiting - Command Injection | dir-823x firmware | 7.2 (v3.1) | High | 340014 , 344364 , 344366 |
| CVE-2025-30208 | Vite - Arbitrary File Read | vite | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2025-2709 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-2710 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-2711 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-2712 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-29927 | Next.js Middleware Authorization Bypass Scanner | next.js | 9.1 (v3.1) | Critical | 345230 |
| CVE-2025-2609 | MagnusBilling Login Logs - Cross-Site Scripting | magnusbilling | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2025-2610 | MagnusBilling Alarm Module - Cross-Site Scripting | magnusbilling | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2025-2505 | WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion | Age Gate | 9.8 (v3.1) | Critical | 340007 |
| CVE-2024-9362 | Polyaxon - Unauthenticated Directory Traversal | polyaxon/polyaxon | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-2539 | File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read | file away | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A | 330791 , 334168 , 340087 , 340095 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-7631 | Openshift-console: openshift console: path traversal | Red Hat OpenShift Container Platform 3.11 | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-24799 | GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi | glpi | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 344370 , 350147 , 380026 , 380122 , 390722 |
| CVE-2025-2473 | Company Visitor Management System 1.0 - SQL Injection | company visitor management system | 6.9 (v4.0) | Medium | 340145 , 340156 , 341145 |
| CVE-2024-12971 | Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin | pandora fms | 8.6 (v4.0) | High | 344364 , 344366 |
| CVE-2025-2221 | WordPress WPCOM Member <= 1.7.6 - SQL Injection | wpcom member | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2025-1661 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion | husky - products filter professional for woocommerce | 9.8 (v3.1) | Critical | 340748 |
| CVE-2024-13853 | WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting | seo-automatic-seo-tools | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-28906 | Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting | Skitter Slideshow | 5.9 (v3.1) | Medium | 346755 , 377360 |
| CVE-2025-24813 | Apache Tomcat Path Equivalence - Remote Code Execution | tomcat | 9.8 (v3.1) | Critical | 392301 |
| CVE-2025-2127 | JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS | jux real estate | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-27506 | NocoDB < 0.258.0 - Reflected XSS in Password Reset | nocodb | 6.1 (v3.1) | Medium | 341266 , 347198 |
| CVE-2025-26319 | FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload | flowise | 9.8 (v3.1) | Critical | 346019 |
| CVE-2024-48248 | NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read | backup & replication director | 8.6 (v3.1) | High | 344360 , 390726 , 392647 |
| CVE-2024-8425 | WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload | woocommerce ultimate gift card | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-9193 | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update | whmcs | 9.8 (v3.1) | Critical | 340087 , 340748 , 344370 , 347006 , 390720 |
| CVE-2025-1743 | Pichome 2.1.0 - Arbitrary File Read | Pichome | 6.9 (v4.0) | Medium | 340162 , 340165 , 344360 , 347009 |
| CVE-2024-10152 | Simple Certain Time to Show Content - Cross-Site Scripting | simple certain time to show content | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-12878 | Lazy Blocks <= 3.8.2 - Cross-Site Scripting | lazy blocks | 7.1 (v3.1) | High | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13624 | WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting | wpmovielibrary | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2024-12737 | WP BASE Booking - Reflected XSS | wp base booking of appointments, services and events | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13628 | WP Pricing Table - Reflected XSS | wp pricing table | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13630 | NewsTicker <= 1.0 - Reflected Cross-Site Scripting | newsticker | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13634 | Post Sync Plugin <= 1.1 - Cross-Site Scripting | post sync | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2025-24893 | XWiki Platform - Remote Code Execution | xwiki | 9.8 (v3.1) | Critical | 340023 , 347009 |
| CVE-2024-55457 | MasterSAM Star Gate v11 - Local File Inclusion | - | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-1023 | ChurchCRM - SQL Injection | churchcrm | 9.3 (v4.0) | Critical | 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2024-13609 | WordPress 1 Click Migration Plugin < 2.3 - Information Exposure | 1 click migration | 5.9 (v3.1) | Medium | 350590 , 390716 |
| CVE-2025-1035 | KLog Server - Path Traversal | KLog Server | 5.7 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-13726 | Themes Coder Ecommerce <= 1.3.4 - SQL Injection | tc-ecommerce | 8.6 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2024-13625 | Tube Video Ads Lite - Reflected XSS | tube video ads lite | 7.1 (v3.1) | High | 341266 |
| CVE-2024-13627 | OWL Carousel Slider - Cross-Site Scripting | owl carousel slider | 4.7 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2025-1302 | JSONPath Plus < 10.3.0 - Remote Code Execution | jsonpath-plus | 8.9 (v4.0) | High | 345240 , 346755 , 360151 , 380026 |
| CVE-2025-25296 | Label Studio < 1.16.0 - Cross-Site Scripting | label studio | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344370 , 346755 , 347198 |
| CVE-2024-10763 | WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion | campress | 9.8 (v3.1) | Critical | 340077 |
| CVE-2024-13543 | Zarinpal Paid Download - Reflected XSS | zarinpal paid download | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13570 | WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting | stray random quotes | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2025-24016 | Wazuh server remote code execution caused by an unsafe deserialization vulnerability. | wazuh | 9.9 (v3.1) | Critical | 330791 , 340006 , 340007 , 340152 , 344360 , 390709 , 390719 |
| CVE-2024-13352 | Legull WordPress - Cross-Site Scripting | legull | 7.1 (v3.1) | High | 341266 , 346755 |
| CVE-2024-13492 | Guten Free Options - Cross Site Scripting | guten free options | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-53586 | WebFileSys 2.31.0 - Directory Path Traversal | - | 5.3 (v3.1) | Medium | 340007 , 390726 , 392647 |
| CVE-2025-24963 | Vitest Browser Mode - Local File Read | vitest | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2024-13330 | JustRows WordPress - Cross-Site Scripting | justrows free | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-13114 | WP Projects Portfolio <= 3.0 - Cross-Site Scripting | wp projects portfolio with client testimonials | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13325 | Glossy WordPress - Reflected XSS | glossy | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-13326 | iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting | ibuildapp | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-13327 | Musicbox WordPress - Reflected XSS | musicbox | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13328 | Giga Messenger WordPress - Cross-Site Scripting | giga messenger | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-13331 | WP Dream Carousel < 1.0.1b - Cross-Site Scripting | wp dream carousel | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2023-52163 | Digiever DS-2105 Pro - Command Injection | ds-2105 pro firmware | 8.8 (v3.1) | High | 390709 |
| CVE-2024-13097 | WP Finance Plugin <= 1.3.6 - Cross-Site Scripting | wp finance | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13098 | WordPress Email Newsletter - Reflected XSS | wordpress email newsletter | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13099 | Widget4Call WordPress - Cross-Site Scripting | widget4call | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-53584 | OpenPanel 0.3.4 - OS Command Injection | openpanel | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 |
| CVE-2024-53537 | OpenPanel 0.3.4 - Directory Traversal | openpanel | 9.1 (v3.1) | Critical | 340007 |
| CVE-2024-52875 | Kerio Control v9.2.5 - CRLF Injection | kerio control | 8.8 (v3.1) | High | 390716 |
| CVE-2024-13112 | WP MediaTagger <= 4.1.1 - Cross-Site Scripting | wp mediatagger | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13219 | Privacy Policy Genius - Cross-Site Scripting | privacy policy genius | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13220 | WordPress Google Map Professional - Cross-Site Scripting | google map professional | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13221 | Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting | fantastic elasticsearch | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13222 | WordPress User Messages <= 1.2.4 - Reflected XSS | user messages | 6.1 (v3.1) | Medium | 341266 , 346755 , 390585 |
| CVE-2024-13224 | SlideDeck 1 Lite Content Slider - Cross-Site Scripting | slidedeck 1 lite content slider | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13225 | ECT Home Page Products - Reflected XSS | ect home page products | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13226 | A5 Custom Login Page - Reflected XSS | a5 custom login page | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-12638 | Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting | bulk me now! | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-12749 | WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting | competition form | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2025-23211 | Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE | recipes | 9.9 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-24367 | Cacti Graph Template authenticated RCE versions prior to 1.2.29 | cacti | 8.7 (v4.0) | High | 340128 , 341256 , 344361 , 344363 , 344364 , 344370 , 360152 , 380018 , 390801 |
| CVE-2024-13055 | Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting | dyn business panel | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2024-13094 | WP Triggers Lite - Cross-Site Scripting | wp triggers lite | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2025-22785 | Course Booking System <= 6.0.6 - SQL Injection | Course Booking System | 9.3 (v3.1) | Critical | 340016 , 380122 |
| CVE-2024-48760 | GestioIP 3.5.7 Remote Command Execution | gestioip | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2024-12008 | W3 Total Cache < 2.8.2 - Log File Exposure | w3 total cache | 7.5 (v3.1) | High | 390716 |
| CVE-2024-50857 | GestioIP - Reflected Cross-Site Scripting | gestioip | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2024-57487 | Car Rental System 1.0 File Upload RCE (Authenticated) | online car rental system | 6.5 (v3.1) | Medium | 330791 , 334168 , 340152 |
| CVE-2024-12847 | Netgear DGN1000 Setup.cgi Unauthenticated RCE | dgn1000 firmware | 9.8 (v3.1) | Critical | 312668 |
| CVE-2024-50603 | Aviatrix Controller - Remote Code Execution | controller | 9.8 (v3.1) | Critical | 340029 , 344360 , 344363 , 344370 , 393655 |
| CVE-2024-12585 | PropertyHive < 2.1.1 - Cross-Site Scripting | propertyhive | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-12849 | Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read | error-log-viewer-wp | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-55218 | IceWarp Server 10.2.1 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2025-22214 | Landray EIS SQL注入漏洞 | - | 4.3 (v3.1) | Medium | 340155 , 341155 , 341245 |
| CVE-2024-56064 | WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE | indeed-wp-superbackup | 10.0 (v3.1) | Critical | 382238 |
| CVE-2024-12987 | DrayTek Vigor - Command Injection | Vigor300B | 6.9 (v4.0) | Medium | 347009 , 393655 |
| CVE-2024-11921 | Give WP Plugin < 3.19.0 - Cross-Site Scripting | givewp | 4.8 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-38819 | Spring Framework Path Traversal in Functional Web Frameworks | spring framework | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2024-11740 | Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution | download manager | 7.3 (v3.1) | High | 344370 |
| CVE-2023-34990 | FortiWLM - Directory Traversal | fortiwlm | 9.8 (v3.1) | Critical | 340007 |
| CVE-2024-12025 | WordPress Collapsing Categories <= 3.0.8 - SQL Injection | Collapsing Categories | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-55956 | Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution | harmony | 9.8 (v3.1) | Critical | 390724 , 391213 |
| CVE-2024-55890 | D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection | dtale | 6.9 (v4.0) | Medium | 344370 |
| CVE-2024-10708 | System Dashboard < 2.8.15 - Admin+ Path Traversal | system dashboard | 4.9 (v3.1) | Medium | 336461 , 344360 , 377360 , 381206 |
| CVE-2024-55550 | Mitel MiCollab - Arbitary File Read | cmg suite | 2.7 (v3.1) | Low | 340007 , 341256 , 344360 , 350147 , 390709 |
| CVE-2024-12209 | WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion | wp-umbrella | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2024-11728 | KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection | kivicare | 7.5 (v3.1) | High | 340016 , 340017 , 340156 , 380122 |
| CVE-2024-53900 | Mongoose < 8.8.3 - Remote Code Execution | mongoose | 9.1 (v3.1) | Critical | 340087 , 340095 , 345240 |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2023-7299 | DataGear resolveSql sql injection | datagear | 5.3 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2024-5721 | Logsign Remote Command Injection | unified secops platform | 8.1 (v3.1) | High | 344364 , 344366 |
| CVE-2024-11320 | Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password | pandora fms | 6.9 (v4.0) | Medium | 344361 , 344363 , 344364 , 344366 |
| CVE-2024-11587 | idcCMS V1.60 - Cross-Site Scripting | idccms | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2024-52762 | Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-52763 | Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 |
| CVE-2024-0012 | Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution | pan-os | 9.3 (v4.0) | Critical | 340023 , 344361 , 344363 , 344370 |
| CVE-2024-11303 | Korenix JetPort 5601v3 - Path Traversal | JetPort 5601 | 8.7 (v4.0) | High | 347009 |
| CVE-2020-26073 | Cisco SD-WAN vManage Software - Local File Inclusion | catalyst sd-wan manager | 7.5 (v3.1) | High | 347009 |
| CVE-2024-9474 | Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution | pan-os | 6.9 (v4.0) | Medium | 340023 , 344361 , 344363 , 344370 |
| CVE-2024-11305 | Altenergy Power Control Software - SQL Injection | energy communication unit firmware | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-8856 | WordPress WP Time Capsule Arbitrary File Upload to RCE | backup and staging by wp time capsule | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 382238 |
| CVE-2024-9935 | PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download | pdf-generator-addon-for-elementor-page-builder | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-10924 | WordPress Really Simple SSL Plugin Authentication Bypass to RCE | really simple security | 9.8 (v3.1) | Critical | 340128 , 360152 , 390801 |
| CVE-2024-10571 | Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion | chartify | 9.8 (v3.1) | Critical | 340748 , 347006 |
| CVE-2024-9186 | Automation By Autonami < 3.3.0 - SQL Injection | wp-marketing-automations | 8.6 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-5082 | Nexus Repository 2 - Remote Code Execution | Nexus Repository | 7.1 (v4.0) | High | 330791 , 340152 |
| CVE-2024-10146 | Simple File List < 6.1.13 - Reflected Cross-Site Scripting | simple file list | 5.4 (v3.1) | Medium | 340087 , 341266 , 346755 , 377360 |
| CVE-2024-51211 | openSIS Classic v9.1 - SQL Injection | opensis | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2024-43425 | Moodle Remote Code Execution (CVE-2024-43425) | moodle | 8.1 (v3.1) | High | 340095 , 360152 |
| CVE-2024-10081 | CodeChecker <= 6.24.1 - Authentication Bypass | codechecker | 10.0 (v3.1) | Critical | 392301 |
| CVE-2024-10914 | D-Link NAS - Command Injection via Name Parameter | dns-320 firmware | 9.2 (v4.0) | Critical | 344363 |
| CVE-2024-10915 | D-Link NAS - Command Injection via Group Parameter | dns-320 firmware | 9.2 (v4.0) | Critical | 344363 |
| CVE-2024-10758 | NEWS-BUZZ News Management System 1.0 - SQL Injection | news-buzz | 6.9 (v4.0) | Medium | 341245 , 344363 , 345493 , 380026 , 380122 |
| CVE-2024-51483 | Changedetection.io <= 0.47.4 - Path Traversal | changedetection | 6.9 (v4.0) | Medium | 340130 |
| CVE-2024-51482 | ZoneMinder v1.37.* <= 1.37.64 - SQL Injection | zoneminder | 9.9 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-48307 | JeecgBoot v3.7.1 - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2024-51378 | CyberPanel Multi CVE Pre-auth RCE | cyberpanel | 9.8 (v3.1) | Critical | 390700 |
| CVE-2024-51567 | CyberPanel Multi CVE Pre-auth RCE | cyberpanel | 9.8 (v3.1) | Critical | 390700 |
| CVE-2024-51568 | CyberPanel Multi CVE Pre-auth RCE | cyberpanel | 9.8 (v3.1) | Critical | 390700 |
| CVE-2024-50334 | Scoold < 1.64.0 - Authentication Bypass | scoold | 8.7 (v4.0) | High | 391213 |
| CVE-2024-39205 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | - | 9.8 (v3.1) | Critical | 340128 , 344363 , 360151 , 380018 , 390801 |
| CVE-2024-50498 | WP Query Console <= 1.0 - Remote Code Execution | wp query console | 9.8 (v3.1) | Critical | 340095 |
| CVE-2024-50623 | Cleo Harmony < 5.8.0.21 - Arbitary File Read | harmony | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-48594 | Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload | prison management system | 8.8 (v3.1) | High | 334168 , 340156 , 390700 |
| CVE-2024-6049 | Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal | vsm LTC Time Sync (vTimeSync) | 7.5 (v3.1) | High | 390716 |
| CVE-2024-8852 | All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure | all-in-one wp migration | 5.3 (v3.1) | Medium | 390716 |
| CVE-2024-8625 | WordPress TS Poll < 2.4.0 - SQL Injection | ts poll | 7.2 (v3.1) | High | 380122 |
| CVE-2024-44000 | Wordpress LiteSpeed Cache plugin cookie theft | litespeed cache | 9.8 (v3.1) | Critical | 360152 , 390716 |
| CVE-2024-9264 | Grafana Post-Auth DuckDB - SQL Injection To File Read | grafana | 9.4 (v4.0) | Critical | 340016 , 344360 , 344370 |
| CVE-2024-37404 | Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection | connect secure | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2016-15042 | WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload | frontend file manager | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-4449 | ZoomSounds Plugin - Unauthenticated Arbitrary File Upload | zoomsounds | 9.8 (v3.1) | Critical | 392301 |
| CVE-2012-10018 | WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload | mapplic | 8.3 (v3.1) | High | 346755 , 377360 |
| CVE-2020-36836 | WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion | wp fastest cache | 8.0 (v3.1) | High | 340748 , 347006 , 377360 |
| CVE-2019-25213 | WordPress Advanced Access Manager - Path Traversal | advanced access manager | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2016-15041 | MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting | mainwp dashboard | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 |
| CVE-2022-4971 | Sassy Social Share <= 3.3.3 - Cross-Site Scripting | sassy social share | 6.1 (v3.1) | Medium | 340099 , 341099 , 341258 , 346755 , 347198 |
| CVE-2024-35584 | openSIS < 9.1 - SQL Injection | opensis | 8.8 (v3.1) | High | 340156 , 380122 |
| CVE-2024-48259 | Cloudlog - SQL Injection | cloudlog | 7.3 (v3.1) | High | 331028 , 340016 , 340157 , 341245 , 360147 , 360148 , 380026 |
| CVE-2024-48120 | X2CRM 8.5 - Stored Cross-Site Scripting (XSS) | x2crm | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390726 , 392647 |
| CVE-2024-9047 | WordPress File Upload <= 4.24.11 - Arbitrary File Read | wordpress file upload | 9.8 (v3.1) | Critical | 344360 |
| CVE-2024-9234 | GutenKit <= 2.1.0 - Arbitrary File Upload | gutenkit | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2024-9463 | PaloAlto Networks Expedition - Remote Code Execution | expedition | 9.9 (v4.0) | Critical | 344363 |
| CVE-2024-9465 | Palo Alto Expedition - SQL Injection | expedition | 9.2 (v4.0) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-8911 | LatePoint <= 5.0.11 - SQL Injection | latepoint | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-45293 | TablePress < 2.4.3 - XXE Injection | tablepress | 7.5 (v3.1) | High | 377360 |
| CVE-2024-47374 | LiteSpeed Cache <= 6.5.0.2 - Stored XSS | litespeed cache | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-9054 | Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection | timeprovider 4100 firmware | 8.5 (v4.0) | High | 392301 |
| CVE-2024-43687 | Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS) | timeprovider 4100 firmware | 7.7 (v4.0) | High | 392301 |
| CVE-2024-7801 | Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection | timeprovider 4100 firmware | 6.3 (v4.0) | Medium | 392301 |
| CVE-2024-8353 | GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection | givewp | 9.8 (v3.1) | Critical | 340014 , 344370 |
| CVE-2024-9166 | TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution | Atemio AM 520 HD Full HD Satellite Receiver | 9.3 (v4.0) | Critical | 340014 , 340193 , 390904 |
| CVE-2024-6517 | Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting | ds-cf7-math-captcha | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-8484 | REST API TO MiniProgram <= 4.7.1 - SQL Injection | rest api to miniprogram | 7.5 (v3.1) | High | 380026 , 380122 |
| CVE-2024-8877 | Riello Netman 204 - SQL Injection | netman 204 firmware | 6.9 (v4.0) | Medium | 340156 , 341245 |
| CVE-2024-9007 | 123Solar 1.8.4.5 - Cross-Site Scripting | 123solar | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-46986 | Camaleon CMS < 2.8.1 Arbitrary File Write to RCE | camaleon cms | 9.9 (v3.1) | Critical | 392647 |
| CVE-2023-47105 | Chaosblade < 1.7.4 - Remote Code Execution | chaosblade | 8.6 (v3.1) | High | 393655 |
| CVE-2024-46987 | Camaleon CMS Directory Traversal CVE-2024-46987 | camaleon cms | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-43971 | Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 344361 , 344364 , 347198 , 377360 |
| CVE-2024-8752 | WebIQ 2.15.9 - Directory Traversal | webiq | 9.3 (v4.0) | Critical | 344365 , 347019 , 390716 |
| CVE-2024-46938 | Sitecore Experience Platform <= 10.4 - Arbitrary File Read | experience commerce | 7.5 (v3.1) | High | 340007 , 344360 , 344365 , 347019 , 390709 |
| CVE-2024-38816 | WebMvc.fn/WebFlux.fn - Path Traversal | Spring | 7.5 (v3.1) | High | 347009 |
| CVE-2024-6587 | LiteLLM - Server-Side Request Forgery | litellm | 7.5 (v3.1) | High | 340162 , 340163 |
| CVE-2024-8522 | WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529) | learnpress | 7.5 (v3.1) | High | 340145 , 341245 , 380026 , 380122 |
| CVE-2024-8529 | WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529) | learnpress | 7.5 (v3.1) | High | 340145 , 341245 , 380026 , 380122 |
| CVE-2024-8503 | Vicidial SQL Injection Time-based Admin Credentials Enumeration | VICIdial | 9.8 (v3.1) | Critical | 340156 |
| CVE-2024-8504 | VICIdial Authenticated Remote Code Execution | VICIdial | 8.8 (v3.1) | High | 344363 |
| CVE-2024-6924 | TrueBooker <= 1.0.2 - SQL Injection | truebooker | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2024-6928 | Opti Marketing <= 2.0.9 - SQL Injection | opti marketing | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-8517 | SPIP BigUp Plugin Unauthenticated RCE | spip | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2024-45507 | Apache OFBiz - Remote Code Execution | ofbiz | 9.8 (v3.1) | Critical | 340162 , 340163 , 344370 |
| CVE-2024-6926 | Viral Signup <= 2.1 - SQL Injection | viral signup | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-20440 | Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials | smart license utility | 7.5 (v3.1) | High | 390716 |
| CVE-2024-45622 | ASIS - SQL Injection Authentication Bypass | asis | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2024-45388 | Hoverfly < 1.10.3 - Arbitrary File Read | hoverfly | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-7354 | Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-3673 | Web Directory Free < 1.7.3 - Local File Inclusion | web directory free | 9.1 (v3.1) | Critical | 340748 , 344360 , 390709 |
| CVE-2024-8252 | WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion | clean login | 8.8 (v3.1) | High | 344360 |
| CVE-2024-43144 | Cost Calculator Builder <= 3.2.15 - SQL Injection | cost calculator builder | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-43917 | WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917) | ti woocommerce wishlist | 9.8 (v3.1) | Critical | 330791 , 334168 , 340145 , 340152 , 340156 , 341145 , 341245 , 344370 , 380026 , 380122 |
| CVE-2024-43965 | SendGrid for WordPress <= 1.4 - SQL Injection | sendgrid | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5057 | WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection | easy digital downloads | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-6670 | WhatsUp Gold SQL Injection (CVE-2024-6670) | whatsup gold | 9.8 (v3.1) | Critical | 340016 , 340145 , 340156 , 341145 , 341245 , 344362 |
| CVE-2024-6671 | WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass | whatsup gold | 9.8 (v3.1) | Critical | 340016 , 340159 , 344362 , 344366 |
| CVE-2024-45256 | BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257) | - | 9.8 (v3.1) | Critical | 344360 , 344363 |
| CVE-2024-45241 | CentralSquare CryWolf - Path Traversal | crywolf | 7.5 (v3.1) | High | 340007 |
| CVE-2024-7313 | Shield Security Plugin < 20.0.6 - Cross-Site Scripting | shield security | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-7954 | SPIP Unauthenticated RCE via porte_plume Plugin | SPIP | 9.8 (v3.1) | Critical | 340023 , 340128 , 342259 , 344370 , 380018 , 390801 |
| CVE-2024-42852 | AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting | acutoweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-7854 | Woo Inquiry <= 0.1 - SQL Injection | woo inquiry | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5932 | GiveWP - PHP Object Injection | givewp | 9.8 (v3.1) | Critical | 398001 |
| CVE-2024-7928 | FastAdmin < V1.3.4.20220530 - Path Traversal | fastadmin | 5.3 (v4.0) | Medium | 340007 |
| CVE-2024-6460 | WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion | tradedoubler-affiliate-tracker | 9.8 (v3.1) | Critical | 336461 , 340748 , 344360 , 347006 , 381206 |
| CVE-2024-32231 | Stash < 0.26.0 - SQL Injection | stash | 6.3 (v3.1) | Medium | 340016 , 340017 , 340157 , 340159 , 344361 , 344362 , 344363 , 344366 , 360147 , 360148 |
| CVE-2024-38653 | Ivanti Avalanche SmartDeviceServer - XML External Entity | avalanche | 7.5 (v3.1) | High | 330791 , 340152 |
| CVE-2024-7593 | Ivanti vTM - Authentication Bypass | virtual traffic manager | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-43360 | ZoneMinder - SQL Injection | zoneminder | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399) | magicinfo 9 server | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2024-30188 | Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write | dolphinscheduler | 8.1 (v3.1) | High | 340162 , 340165 , 344360 , 347009 , 390726 , 392647 |
| CVE-2022-38322 | Temenos Transact - Cross-Site Scripting | - | N/A | N/A | 333141 |
| CVE-2024-6893 | Journyx - XML External Entities Injection (XXE) | journyx-jtime | 7.5 (v3.1) | High | 344360 , 344370 , 344372 |
| CVE-2024-6892 | Journyx 11.5.4 - Reflected Cross Site Scripting | journyx | 6.1 (v3.1) | Medium | 333141 |
| CVE-2024-6782 | Calibre Python Code Injection (CVE-2024-6782) | Calibre | 9.8 (v3.1) | Critical | 330791 , 340014 , 340128 , 340152 , 344370 , 380018 , 390801 |
| CVE-2024-6651 | WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting | wp-file-upload | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-7314 | AJ-Report < 1.4.1 - Remote Code Execution | report | 9.8 (v3.1) | Critical | 337209 , 337211 , 380026 |
| CVE-2024-7029 | AVTECH IP Camera - Command Injection | avm1203 firmware | 8.7 (v4.0) | High | 344363 |
| CVE-2024-7332 | TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability | cp450 firmware | 9.3 (v4.0) | Critical | 390716 |
| CVE-2024-7339 | TVT DVR Sensitive Device - Information Disclosure | sh-4050a5-5l(mm) firmware | 6.9 (v4.0) | Medium | 392301 |
| CVE-2024-39646 | WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS | custom 404 pro | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2024-7340 | W&B Weave Server - Remote Arbitrary File Leak | - | 8.8 (v3.1) | High | 347009 |
| CVE-2024-5765 | WpStickyBar <= 2.1.0 - SQL Injection | wpstickybar | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5975 | CZ Loan Management <= 1.1 - SQL Injection | cz loan management | 9.1 (v3.1) | Critical | 380122 |
| CVE-2024-7188 | Bylancer Quicklancer 2.4 G - SQL Injection | quicklancer | 6.9 (v4.0) | Medium | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2024-41810 | Twisted - Open Redirect & XSS | twisted | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-41628 | Cluster Control CMON API - Directory Traversal | cluster control | 7.5 (v3.1) | High | 347009 |
| CVE-2024-41357 | phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS) | phpipam | 7.1 (v3.1) | High | 340147 , 340148 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2024-7120 | Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection | msg2300 firmware | 5.3 (v4.0) | Medium | 344363 , 344370 |
| CVE-2024-38289 | TurboMeeting - Boolean-based SQL Injection | turbomeeting | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 390572 |
| CVE-2024-38288 | TurboMeeting - Post-Authentication Command Injection | turbomeeting | 7.2 (v3.1) | High | 344363 , 344370 |
| CVE-2023-45249 | Acronis Cyber Infrastructure default password remote code execution | cyber infrastructure | 9.8 (v3.1) | Critical | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2024-40422 | Devika v1 - Path Traversal | devika | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-41667 | OpenAM<=15.0.3 FreeMarker - Template Injection | OpenAM | 8.8 (v3.1) | High | 344360 , 392647 , 393655 |
| CVE-2024-6753 | Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting | social auto poster | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-38773 | FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection | formlift for infusionsoft web forms | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2024-6911 | PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion | processplus | 8.7 (v4.0) | High | 344365 , 347019 |
| CVE-2024-37259 | WP Extended < 3.0.0 - Stored Cross-Site Scripting | wp extended | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2024-37261 | WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting | wp-lister lite for amazon | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2024-40348 | Bazarr < 1.4.3 - Arbitrary File Read | bazarr | 8.2 (v3.1) | High | 347009 |
| CVE-2024-6205 | PayPlus Payment Gateway < 6.6.9 - SQL Injection | payplus payment gateway | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-39907 | 1Panel SQL Injection - Authenticated | 1panel | 9.8 (v3.1) | Critical | 344370 , 380026 |
| CVE-2024-21136 | Oracle Retail Xstore Suite - Pre-authenticated Path Traversal | retail xstore office | 8.6 (v3.1) | High | 340007 , 344365 , 347019 |
| CVE-2024-6746 | EasySpider 0.6.2 - Arbitrary File Read | easyspider | 5.3 (v4.0) | Medium | 346019 |
| CVE-2024-3753 | Hostel < 1.1.5.3 - Cross-Site Scripting | hostel | 5.9 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-39914 | FOG Project < 1.5.10.34 - Remote Command Execution | fogproject | 9.8 (v3.1) | Critical | 344363 |
| CVE-2024-4879 | ServiceNow UI Macros - Template Injection | servicenow | 9.3 (v4.0) | Critical | 342259 , 344370 |
| CVE-2024-5910 | Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464) | expedition | 9.3 (v4.0) | Critical | 340029 , 344361 , 344363 , 344364 , 344366 , 350147 |
| CVE-2024-5217 | ServiceNow - Incomplete Input Validation | servicenow | 9.2 (v4.0) | Critical | 340157 , 340159 , 342259 , 344370 , 360147 , 360148 , 380026 |
| CVE-2024-6095 | LocalAI - Partial Local File Read | localai | 5.8 (v3.1) | Medium | 344360 |
| CVE-2024-38473 | Apache HTTP Server - ACL Bypass | Apache HTTP Server | 8.1 (v3.1) | High | 390709 |
| CVE-2024-36420 | Flowise 1.4.3 - Arbitrary File Read | flowise | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-36991 | Splunk Enterprise - Local File Inclusion | splunk | 7.5 (v3.1) | High | 390716 |
| CVE-2024-6265 | UsersWP <= 1.2.10 - Unauthenticated SQL Injection | userswp | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-5827 | Vanna - SQL injection | vanna-ai/vanna | 9.8 (v3.0) | Critical | 340029 , 344360 , 344370 , 347009 |
| CVE-2024-6127 | PowerShellEmpire Arbitrary File Upload (Skywalker) | Empire | 9.8 (v3.1) | Critical | 360152 |
| CVE-2024-5334 | Devika - Local File Inclusion | devika | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2024-6250 | LOLLMS WebUI - Absolute Path Traversal | lollms web ui | 7.5 (v3.0) | High | 392301 |
| CVE-2024-33326 | LumisXP - Cross-site Scripting | lumis experience platform | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2024-37843 | Craft CMS <=v3.7.31 - SQL Injection | craft cms | 9.8 (v3.1) | Critical | 344378 |
| CVE-2024-5276 | Fortra FileCatalyst Workflow SQL Injection (CVE-2024-5276) | filecatalyst workflow | 9.1 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2024-36683 | PrestaShop productsalert - SQL Injection | the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop | 7.3 (v3.1) | High | 340016 , 340156 , 380026 , 380122 |
| CVE-2024-4841 | LoLLMS WebUI - Subfolder Prediction via Path Traversal | lollms-webui | 3.3 (v3.1) | Low | 344365 |
| CVE-2024-3605 | WP Hotel Booking <= 2.1.0 - SQL Injection | wp hotel booking | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-5522 | WordPress HTML5 Video Player < 2.5.27 - SQL Injection | html5 video player | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 340159 , 360147 , 360148 |
| CVE-2024-28397 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | pyload | 5.3 (v3.1) | Medium | 340014 , 340128 , 344363 , 346755 , 360151 , 380018 , 380026 , 390801 |
| CVE-2024-36527 | Puppeteer Renderer - Directory Traversal | - | 6.5 (v3.1) | Medium | 340165 , 344360 , 347009 |
| CVE-2024-36597 | AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. | life insurance management system | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 390572 |
| CVE-2024-36599 | AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS) | life insurance management system | 6.1 (v3.1) | Medium | 345493 |
| CVE-2024-34102 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | commerce | 9.8 (v3.1) | Critical | 330791 , 340077 , 340152 , 341256 , 344370 , 344372 , 380018 |
| CVE-2024-3552 | Web Directory Free < 1.7.0 - SQL Injection | web directory free | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2024-3922 | Dokan Pro <= 3.10.3 - SQL Injection | dokan | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-3032 | WordPress Themify Builder < 7.5.8 - Open Redirect | builder | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-2473 | WPS Hide Login <= 1.9.15.2 - Login Page Disclosure | wps hide login | 5.3 (v3.1) | Medium | 377360 |
| CVE-2024-36412 | SuiteCRM - SQL Injection | suitecrm | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-37014 | Langflow <= 1.0.12 - Remote Code Execution | langflow | 9.8 (v3.1) | Critical | 340095 , 344370 |
| CVE-2024-37393 | SecurEnvoy Two Factor Authentication - LDAP Injection | multi-factor authentication solutions | 7.5 (v3.1) | High | 392301 |
| CVE-2024-4577 | PHP CGI Argument Injection Remote Code Execution | php | 9.8 (v3.1) | Critical | 340165 , 380026 , 392301 |
| CVE-2024-30464 | WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization | social-icons-widget-by-wpzoom | 8.8 (v3.1) | High | 377360 |
| CVE-2024-35693 | WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting | 12 step meeting list | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 |
| CVE-2024-35694 | Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting | wpmobile.app | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2024-30163 | IPS Community Suite - Unauthenticated SQL Injection | ips community suite | 9.8 (v3.1) | Critical | 380026 |
| CVE-2024-4620 | ArForms < 6.6 - Remote Code Execution | arforms | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical | 330791 , 334168 , 340087 , 340095 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-28995 | SolarWinds Serv-U Unauthenticated Arbitrary File Read | serv-u | 7.5 (v3.1) | High | 340006 , 340007 , 344360 , 344365 , 347009 , 347019 , 390709 |
| CVE-2024-2928 | MLflow < 2.11.3 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-36837 | CRMEB v.5.2.2 - SQL Injection | crmeb | 7.5 (v3.1) | High | 340156 , 340157 , 360147 , 360148 |
| CVE-2024-3469 | GP Premium <= 2.4.0 - Cross-Site Scripting | gp-premium | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-20404 | Cisco Finesse - Server-Side Request Forgery (SSRF) | finesse | 5.3 (v3.1) | Medium | 392301 |
| CVE-2024-25600 | Unauthenticated RCE in Bricks Builder Theme | Bricks Builder | 10.0 (v3.1) | Critical | 330791 , 340095 , 340128 , 340152 , 380018 , 390801 |
| CVE-2024-4180 | The Events Calendar < 6.4.0.1 - Cross-site Scripting | the events calendar | 9.1 (v3.1) | Critical | 346755 |
| CVE-2024-5420 | SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting | utnserver Pro | 8.3 (v4.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-23692 | Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution | http file server | 9.8 (v3.1) | Critical | 344364 , 344366 , 390703 , 390722 |
| CVE-2024-29824 | Ivanti EPM RecordGoodApp SQLi RCE | endpoint manager | 8.8 (v3.1) | High | 340145 , 340155 , 340156 , 341155 , 341245 |
| CVE-2024-37032 | Ollama Model Registry Path Traversal RCE | ollama | 8.8 (v3.1) | High | 340007 , 344360 , 347009 |
| CVE-2024-4358 | Telerik Report Server Auth Bypass and Deserialization RCE | report server 2024 | 9.8 (v3.1) | Critical | 330791 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2024-24919 | Check Point Security Gateway Arbitrary File Read | quantum spark firmware | 8.6 (v3.1) | High | 344360 , 390709 , 392301 |
| CVE-2024-35219 | OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete | openapi-generator | 8.3 (v3.1) | High | 340007 |
| CVE-2024-4455 | YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting | yith woocommerce ajax search | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-5084 | WordPress Hash Form Plugin RCE | hash form | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-4443 | Business Directory Plugin <= 6.4.2 - SQL Injection | business directory | 7.5 (v3.1) | High | 340156 , 380026 |
| CVE-2024-35627 | TileServer API - Cross Site Scripting | tileserver-gl up to v4.4.10 | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-21683 | Atlassian Confluence Administrator Code Macro Remote Code Execution | confluence data center | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-27954 | WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF | Automatic | 9.3 (v3.1) | Critical | 340165 , 344360 , 347009 |
| CVE-2024-3231 | Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting | popup4phone | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-22476 | Intel Neural Compressor <2.5.0 - SQL Injection | Intel(R) Neural Compressor software | 10.0 (v3.1) | Critical | 341245 |
| CVE-2024-3848 | Mlflow < 2.11.0 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-4956 | Sonatype Nexus Repository Manager 3 - Local File Inclusion | nexus | 7.5 (v3.1) | High | 347009 |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-32736 | CyberPower < v2.8.3 - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32737 | CyberPower - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32738 | CyberPower - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32739 | CyberPower < v2.8.3 - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-25641 | Cacti Import Packages RCE | cacti | 7.2 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-34257 | TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection | a3700r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-29889 | GLPI 10.0.10-10.0.14 - SQL Injection | glpi | 8.1 (v3.1) | High | 341245 |
| CVE-2024-34470 | HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion | mailinspector | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-33113 | D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure | dir-845l | 5.3 (v3.1) | Medium | 390722 |
| CVE-2023-38096 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | 9.8 (v3.1) | Critical | 334168 , 340156 , 390700 |
| CVE-2023-40498 | LG Simple Editor Remote Code Execution | simple editor | 9.8 (v3.1) | Critical | 340006 , 390719 |
| CVE-2023-40504 | LG Simple Editor Command Injection (CVE-2023-40504) | simple editor | 9.8 (v3.1) | Critical | 330791 , 334168 , 340007 , 340152 , 344362 |
| CVE-2023-38098 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | 8.8 (v3.1) | High | 334168 , 340156 , 390700 |
| CVE-2024-30851 | Jasmin Ransomware Web Server Unauthenticated Directory Traversal | jasmin-ransomware | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-4439 | WordPress Core <6.5.2 - Cross-Site Scripting | WordPress | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-2667 | InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload | instawp connect | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2024-2876 | Wordpress Email Subscribers by Icegram Express - SQL Injection | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2024-34061 | Changedetection.io <=v0.45.21 - Cross-Site Scripting | changedetection.io | 4.3 (v3.1) | Medium | 333141 , 340130 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-4348 | osCommerce v4.0 - Cross-site Scripting | oscommerce | 4.3 (v3.1) | Medium | 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2024-31823 | ecommerce-codeigniter-bootstrap Arbitrary Code Execution Vulnerability | ecommerce-codeigniter-bootstrap | 9.8 (v3.1) | Critical | 344360 |
| CVE-2024-33559 | Wordpress Theme XStore 9.3.8 - SQLi | XStore | 9.3 (v3.1) | Critical | 340016 , 340017 , 344366 |
| CVE-2024-4257 | BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection | clinical browsing system | 6.5 (v3.1) | Medium | 341245 , 344366 , 361149 |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-32709 | WP-Recall <= 16.26.5 - SQL Injection | WP-Recall | 9.3 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 , 390703 |
| CVE-2024-20353 | adaptive security appliance software Denial of Service Vulnerability | adaptive security appliance software | 8.6 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2024-4040 | CrushFTP Unauthenticated Arbitrary File Read | crushftp | 10.0 (v3.1) | Critical | 340006 , 340007 , 344360 , 390709 , 392301 |
| CVE-2024-27348 | Apache HugeGraph Gremlin RCE | hugegraph | 9.8 (v3.1) | Critical | 330791 , 340152 , 344361 , 344362 , 344363 , 380026 |
| CVE-2024-32238 | H3C ER8300G2-X - Password Disclosure | - | 9.8 (v3.1) | Critical | 390716 |
| CVE-2024-31750 | F-logic DataCube3 - SQL Injection | datacube3 firmware | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-28185 | Judge0 sandbox escape | judge0 | 10.0 (v3.1) | Critical | 340029 , 344361 , 344363 , 344364 , 344370 |
| CVE-2024-28189 | Judge0 sandbox escape | judge0 | 10.0 (v3.1) | Critical | 340029 , 344361 , 344363 , 344364 , 344370 |
| CVE-2024-2961 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | glibc | 7.3 (v3.1) | High | 330791 , 340077 , 340152 , 341256 , 344370 , 344372 , 380018 |
| CVE-2024-1483 | Mlflow < 2.9.2 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-1561 | Gradio 4.3-4.12 - Local File Read | gradio | 7.5 (v3.0) | High | 344365 |
| CVE-2024-32128 | WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection | Realtyna Organic IDX plugin | 9.3 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-32136 | BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection | BWL Advanced FAQ Manager | 7.6 (v3.1) | High | 380026 , 380122 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution | pan-os | 10.0 (v3.1) | Critical | 340006 |
| CVE-2023-51409 | Jordy Meow AI Engine - Unrestricted File Upload | ai engine | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-31839 | Chaos RAT XSS to RCE | chaos | 4.8 (v3.1) | Medium | 330791 , 334168 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 350148 , 390585 , 393655 |
| CVE-2024-30850 | Chaos RAT XSS to RCE | - | N/A | N/A | 330791 , 334168 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 350148 , 390585 , 393655 |
| CVE-2024-31214 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | 9.6 (v3.1) | Critical | 330791 , 340006 , 340007 , 340152 , 344360 , 390709 , 390719 |
| CVE-2024-24809 | Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809) | traccar | 8.5 (v3.1) | High | 330791 , 340006 , 340007 , 340029 , 340152 , 344360 , 344361 , 344363 , 344364 , 344366 , 350147 , 390709 , 390719 , 391213 |
| CVE-2024-1728 | Gradio > 4.19.1 UploadButton - Path Traversal | gradio | 7.5 (v3.1) | High | 344360 |
| CVE-2024-28741 | NorthStar C2 XSS to Agent RCE | EginDemirbilek NorthStar C2 v1 | 8.8 (v3.1) | High | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 360030 , 390585 |
| CVE-2024-3378 | iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS) | secure web gateway | 6.1 (v3.1) | Medium | 392301 |
| CVE-2024-31848 | CData API Server < 23.4.8844 - Path Traversal | API Server | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-31849 | CData Connect < 23.4.8846 - Path Traversal | Connect | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-31850 | CData Arc < 23.4.8839 - Path Traversal | Arc | 8.6 (v3.1) | High | 344365 |
| CVE-2024-31851 | CData Sync < 23.4.8843 - Path Traversal | Sync | 8.6 (v3.1) | High | 344365 |
| CVE-2024-3116 | pgAdmin Binary Path API RCE | pgadmin 4 | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2024-2879 | WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection | layerslider | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2024-2389 | Flowmon Unauthenticated Command Injection | flowmon | 9.8 (v3.1) | Critical | 344363 , 393655 |
| CVE-2024-30498 | CRM Perks Forms <= 1.1.4 - SQL Injection | crm perks forms | 10.0 (v3.1) | Critical | 380122 |
| CVE-2024-30490 | ProfileGrid <= 5.7.8 - SQL Injection | profilegrid | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2024-30502 | WP Travel Engine <= 5.7.9 - SQL Injection | wp travel engine | 9.8 (v3.1) | Critical | 330791 , 340016 , 340017 , 340152 , 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-29792 | Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting | unlimited elements for elementor | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2024-29931 | WP Go Maps <= 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 341266 , 344370 , 346755 , 377360 |
| CVE-2024-30194 | Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 333141 , 340149 , 344361 , 344364 , 346755 , 347198 , 377360 |
| CVE-2023-28787 | Quiz and Survey Master <= 8.1.4 - SQL Injection | Quiz And Survey Master | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-48777 | WordPress Elementor 3.18.1 - File Upload/Remote Code Execution | website builder | 8.8 (v3.1) | High | 377360 |
| CVE-2023-47873 | WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload | wp child theme generator | 7.2 (v3.1) | High | 377360 |
| CVE-2024-24725 | Gibbon School Platform Authenticated PHP Deserialization Vulnerability | gibbon | 8.8 (v3.1) | High | 344365 |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical | 340087 , 340095 , 340128 , 344370 , 346755 , 360152 , 380018 , 390801 |
| CVE-2024-27956 | WordPress wp-automatic Plugin SQLi Admin Creation | automatic | 9.8 (v3.1) | Critical | 340016 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390613 , 390614 |
| CVE-2024-27292 | Docassemble - Local File Inclusion | docassemble | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2024-1800 | Telerik Report Server Auth Bypass and Deserialization RCE | telerik report server | 8.8 (v3.1) | High | 330791 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2023-7246 | System Dashboard < 2.8.10 - Cross-Site Scripting | system dashboard | 5.4 (v3.1) | Medium | 377360 |
| CVE-2024-24050 | Workout Journal App 1.0 - Stored XSS | workout journal app | 4.7 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 380026 , 390727 , 392301 , 392648 |
| CVE-2024-2621 | Fujian Kelixin Communication - Command Injection | kelixin communication command and dispatch | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2023-40279 | OpenClinic GA 5.247.01 - Path Traversal (Authenticated) | openclinic ga | 7.5 (v3.1) | High | 340007 , 390727 , 392301 , 392648 |
| CVE-2024-28734 | Coda v.2024Q1 - Cross-Site Scripting | Unit4 Financials by Coda prior to 2023Q4 | 6.1 (v3.1) | Medium | 340112 , 340113 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-29138 | WordPress Restrict User Access <= 2.5 - Cross-Site Scripting | restrict user access | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2024-24578 | RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload. | raspberrymatic | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 390700 |
| CVE-2024-20767 | CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read | coldfusion | 7.4 (v3.1) | High | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2024-28255 | OpenMetadata authentication bypass and SpEL injection exploit chain | openmetadata | 9.8 (v3.1) | Critical | 337209 , 337211 , 340087 |
| CVE-2024-28253 | OpenMetaData - SpEL Injection in PUT /api/v1/policies | openmetadata | 8.8 (v3.1) | High | 337209 , 337210 , 337211 , 340095 |
| CVE-2024-28254 | OpenMetadata authentication bypass and SpEL injection exploit chain | openmetadata | 8.8 (v3.1) | High | 337209 , 337211 , 340087 |
| CVE-2023-6825 | WordPress File Manager <= 7.2.1 - Directory Traversal | file manager | 9.9 (v3.1) | Critical | 377360 |
| CVE-2024-0799 | Arcserve Unified Data Protection - Authentication Bypass | udp | 9.8 (v3.1) | Critical | 391213 |
| CVE-2024-1071 | WordPress Ultimate Member SQL Injection (CVE-2024-1071) | ultimate member | 9.8 (v3.1) | Critical | 340016 , 340156 |
| CVE-2024-1751 | Tutor LMS <= 2.1.10 - SQL Injection | tutor lms | 8.8 (v3.1) | High | 380122 |
| CVE-2024-28623 | RiteCMS 3.0.0 - Cross-site Scripting | ritecms | 6.1 (v3.1) | Medium | 346755 , 380026 |
| CVE-2024-2330 | NS-ASG Application Security Gateway 6.3 - Sql Injection | application security gateway | 9.8 (v3.1) | Critical | 340157 , 360147 |
| CVE-2024-2044 | pgAdmin Session Deserialization RCE | pgadmin 4 | 9.9 (v3.1) | Critical | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2024-27564 | ChatGPT个人专用版 - Server Side Request Forgery | chatgpt web | 6.5 (v3.1) | Medium | 340165 , 344360 , 347009 |
| CVE-2024-27198 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2024-1698 | NotificationX <= 2.8.2 - SQL Injection | notificationx | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-1709 | ConnectWise ScreenConnect Unauthenticated Remote Code Execution | screenconnect | 10.0 (v3.1) | Critical | 330791 , 340006 , 340007 , 340152 , 344360 , 390709 , 390719 |
| CVE-2024-1708 | ConnectWise ScreenConnect Unauthenticated Remote Code Execution | screenconnect | 8.4 (v3.1) | High | 330791 , 340006 , 340007 , 340152 , 344360 , 390709 , 390719 |
| CVE-2024-25608 | Liferay Portal - Open Redirect | digital experience platform,liferay portal | 6.1 (v3.1) | Medium | 398005 |
| CVE-2024-1512 | MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection | masterstudy lms | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2023-47218 | QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi | qts | 8.3 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2024-22024 | Ivanti Connect Secure - XXE | connect secure | 8.3 (v3.1) | High | 380019 |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | 9.8 (v3.1) | Critical | 340095 , 340128 , 344365 , 344370 , 346755 , 360152 , 360153 , 380018 , 390614 , 390801 |
| CVE-2024-0566 | Smart Manager 8.27.0 - Post-Authenticated SQL Injection | smart manager | 7.2 (v3.1) | High | 380122 , 390704 |
| CVE-2024-0250 | Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect | analytics insights | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2024-24495 | Daily Habit Tracker 1.0 - SQL Injection | daily habit tracker | 9.8 (v3.1) | Critical | 341245 , 344366 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2024-24494 | Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) | daily habit tracker | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 344370 , 346755 , 350148 , 360151 |
| CVE-2024-24497 | Employee Management System 1.0 - txtusername and txtpassword SQL Injection (Admin Login) | - | N/A | N/A | 340156 , 341245 , 345493 |
| CVE-2024-24131 | SuperWebMailer 9.31.0.01799 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-40355 | Axigen WebMail - Cross-Site Scripting | axigen mobile webmail | 5.4 (v3.1) | Medium | 346755 |
| CVE-2023-46359 | cPH2 Charging Station v1.87.0 - OS Command Injection | cph2 echarge | 9.8 (v3.1) | Critical | 340014 , 340193 , 344363 , 344364 , 344370 , 393655 |
| CVE-2024-24112 | Exrick XMall - SQL Injection | xmall | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-6989 | Shield Security WP Plugin <= 18.5.9 - Local File Inclusion | shield security | 9.8 (v3.1) | Critical | 340748 |
| CVE-2024-22319 | IBM Operational Decision Manager - JNDI Injection | operational decision manager | 9.8 (v3.1) | Critical | 398008 |
| CVE-2024-21485 | Dash Framework - Cross-site Scripting | dash | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2024-21893 | Ivanti Connect Secure Unauthenticated Remote Code Execution | connect secure | 8.2 (v3.1) | High | 337109 , 337110 , 392301 , 398021 , 398022 |
| CVE-2024-1061 | WordPress HTML5 Video Player - SQL Injection | html5 video player | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2024-24328 | TotoLink Router setMacFilterRules - Command Injection | a3300r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-24329 | TotoLink Router setPortForwardRules - Command Injection | a3300r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-24565 | CrateDB Database - Arbitrary File Read | cratedb | 6.5 (v3.1) | Medium | 340016 , 340017 , 340029 , 344360 , 344370 |
| CVE-2024-0986 | Issabel Authenticated - Remote Code Execution | pbx | 9.8 (v3.1) | Critical | 344362 , 344363 |
| CVE-2024-23334 | aiohttp - Directory Traversal | aiohttp | 7.5 (v3.1) | High | 347009 |
| CVE-2024-22729 | Netis MW5360 V1.0.1.3031 - Command Injection | mw5360 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-23897 | Jenkins cli Ampersand Replacement Arbitrary File Read | jenkins | 9.8 (v3.1) | Critical | 340006 , 390719 |
| CVE-2023-6697 | WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2024-0204 | Fortra GoAnywhere MFT Unauthenticated Remote Code Execution | goanywhere managed file transfer | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2023-27168 | write-back manager Arbitrary Code Execution Vulnerability | write-back manager | 9.8 (v3.1) | Critical | 351000 |
| CVE-2024-0705 | Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection | stripe payment plugin for woocommerce | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2022-1609 | The School Management < 9.9.7 - Remote Code Execution | school management | 9.8 (v3.1) | Critical | 340095 , 344361 |
| CVE-2023-22527 | Atlassian Confluence SSTI Injection | confluence data center | 9.8 (v3.1) | Critical | 340095 , 341245 , 344364 , 344366 , 393655 |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 390722 , 392301 |
| CVE-2023-2252 | Directorist < 7.5.4 - Local File Inclusion | directorist | 2.7 (v3.1) | Low | 344360 , 347009 , 390709 |
| CVE-2023-6623 | Essential Blocks < 4.4.3 - Local File Inclusion | essential blocks | 9.8 (v3.1) | Critical | 344360 , 347009 |
| CVE-2023-50919 | GL.iNet Unauthenticated Remote Command Execution via the logread module. | gl-ax1800 firmware | 9.8 (v3.1) | Critical | 341245 , 391213 |
| CVE-2024-21887 | Ivanti Connect Secure Unauthenticated Remote Code Execution | connect secure | 9.1 (v3.1) | Critical | 330791 , 337109 , 337110 , 340152 , 398021 , 398022 |
| CVE-2023-46805 | Ivanti Connect Secure Unauthenticated Remote Code Execution | connect secure | 8.2 (v3.1) | High | 330791 , 340152 |
| CVE-2023-6567 | LearnPress <= 4.2.5.7 - SQL Injection | learnpress | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-21650 | XWiki < 4.10.20 - Remote code execution | xwiki | 9.8 (v3.1) | Critical | 340130 |
| CVE-2023-6750 | WordPress WP Clone <= 2.4.2 - Database Backup Exposure | clone | 7.5 (v3.1) | High | 350590 , 390716 |
| CVE-2024-0195 | SpiderFlow Crawler Platform - Remote Code Execution | spider-flow | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340095 |
| CVE-2023-50094 | reNgine 2.2.0 - Command Injection | rengine | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2023-6000 | WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS | popup builder | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-50071 | CVE-2023-50071 - Multiple SQL Injection | customer support system | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2023-50839 | JS Help Desk <= 2.8.1 - SQL Injection | js help desk | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-49230 | Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload | balance two firmware | 8.8 (v3.1) | High | 330791 , 340152 , 392301 |
| CVE-2023-7137 | Client Details System 1.0 - SQL Injection | client details system | 8.8 (v3.1) | High | 331028 , 340016 , 340017 , 340144 , 340156 , 340157 , 344364 , 344366 , 344370 , 360147 , 360148 , 360151 , 380026 , 380122 |
| CVE-2023-50445 | GL.iNet Unauthenticated Remote Command Execution via the logread module. | gl-mt1300 firmware | 7.8 (v3.1) | High | 341245 , 391213 |
| CVE-2023-7116 | WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection | datax-web | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2023-5991 | Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion | hotel booking lite | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2023-5203 | WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection | wp sessions time monitoring full automatic | 7.5 (v3.1) | High | 340016 , 380026 , 380122 |
| CVE-2023-49085 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High | 340006 , 340007 , 340016 , 340017 , 340029 , 340095 , 340145 , 340156 , 340157 , 340159 , 341245 , 344360 , 344366 , 344370 , 347009 , 360147 , 360148 , 360152 , 380026 , 390709 , 390719 |
| CVE-2023-49084 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High | 340006 , 340007 , 340016 , 340017 , 340029 , 340095 , 340145 , 340156 , 340157 , 340159 , 341245 , 344360 , 344366 , 344370 , 347009 , 360147 , 360148 , 360152 , 380026 , 390709 , 390719 |
| CVE-2023-32590 | Subscribe to Category <= 2.7.4 - SQL Injection | subscribe to category | 7.5 (v3.1) | High | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-6977 | Mlflow <2.8.0 - Local File Inclusion | mlflow | 7.5 (v3.1) | High | 344360 |
| CVE-2023-44982 | WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure | perfect images | 7.5 (v3.1) | High | 390716 |
| CVE-2023-49489 | KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) | kodexplorer | 6.1 (v3.1) | Medium | 342259 , 346755 |
| CVE-2023-6909 | Mlflow <2.9.2 - Path Traversal | mlflow | 7.5 (v3.1) | High | 392301 |
| CVE-2023-50917 | MajorDoMo Command Injection | majordomo | 9.8 (v3.1) | Critical | 344363 , 393655 |
| CVE-2023-6553 | Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution | backup migration | 9.8 (v3.1) | Critical | 301106 |
| CVE-2023-6831 | mlflow - Path Traversal | mlflow | 8.1 (v3.1) | High | 390709 |
| CVE-2023-48084 | Nagios XI < 5.11.3 - SQL Injection | nagios xi | 9.8 (v3.1) | Critical | 340130 , 340145 , 340156 , 380026 , 380122 |
| CVE-2022-45365 | Stock Ticker <= 3.23.2 - Cross-Site-Scripting | stock ticker | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-41621 | Emlog Pro v2.1.14 - Cross-Site Scripting | emlog | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-6379 | OpenCMS 14 & 15 - Cross Site Scripting | opencms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-49494 | DedeCMS v5.7.111 - Cross-Site Scripting | dedecms | 6.1 (v3.1) | Medium | 333141 , 340087 , 340095 , 340099 , 340149 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-6655 | Hongjing e-HR 2020 - SQL Injection | e-hr | 9.8 (v3.1) | Critical | 341245 , 344366 , 361149 |
| CVE-2023-6568 | Mlflow - Cross-Site Scripting | mlflow | 6.1 (v3.1) | Medium | 334168 , 391213 |
| CVE-2023-6063 | WordPress WP Fastest Cache Unauthenticated SQLi (CVE-2023-6063) | wp fastest cache | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-49293 | Vite dev server - Cross-Site Scripting | vite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-6360 | WordPress My Calendar <3.4.22 - SQL Injection | my calendar | 9.8 (v3.1) | Critical | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-40211 | Post Grid <= 2.2.50 - Information Exposure via REST API | post grid combo | 7.5 (v3.1) | High | 330791 , 340152 |
| CVE-2023-40600 | EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure | image optimizer | 7.5 (v3.1) | High | 390716 |
| CVE-2023-3368 | Chamilo LMS <= v1.11.20 Unauthenticated Command Injection | chamilo | 9.8 (v3.1) | Critical | 344363 , 344370 , 393655 |
| CVE-2023-48022 | Anyscale Ray - Remote Code Execution | ray | 9.8 (v3.1) | Critical | 392301 , 392648 |
| CVE-2022-41678 | Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution | activemq | 8.8 (v3.1) | High | 330925 |
| CVE-2023-6329 | Control iD iDSecure Authentication Bypass (CVE-2023-6329) | idsecure | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-6275 | TOTVS Fluig Platform - Cross-Site Scripting | fluig | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-5815 | News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion | news & blog designer pack | 9.8 (v3.1) | Critical | 340748 , 347006 |
| CVE-2023-49103 | ownCloud Phpinfo Reader | graph api | 7.5 (v3.1) | High | 340035 |
| CVE-2023-5652 | WP Hotel Booking <= 2.0.7 - SQL Injection | wp hotel booking | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2023-38879 | openSIS v9.0 - Path Traversal | opensis | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-48241 | XWiki < 4.10.15 - Information Disclosure | xwiki | 7.5 (v3.1) | High | 390722 |
| CVE-2023-43177 | CrushFTP Unauthenticated RCE | crushftp | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 340156 , 341245 |
| CVE-2023-44353 | Adobe ColdFusion WDDX Deserialization Gadgets | coldfusion | 9.8 (v3.1) | Critical | 344365 , 344370 , 350147 |
| CVE-2023-44352 | Adobe Coldfusion - Cross-Site Scripting | coldfusion | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 341266 , 346755 , 347198 |
| CVE-2023-46214 | Splunk Authenticated XSLT Upload RCE | cloud | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 344363 , 344370 , 360152 , 380018 , 390801 |
| CVE-2023-6020 | Ray Static File - Local File Inclusion | ray | 7.5 (v3.1) | High | 347009 |
| CVE-2023-6023 | VertaAI ModelDB - Path Traversal | modeldb | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-6038 | H2O ImportFiles - Local File Inclusion | h2o | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-41597 | EyouCms v1.6.2 - Cross-Site Scripting | eyoucms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-46022 | Blood Bank 1.0 - 'bid' SQLi | blood bank | 7.8 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2023-47684 | Essential Grid <= 3.1.0 - Cross-Site Scripting | essential grid | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-46020 | Blood Bank v1.0 - Stored Cross Site Scripting (XSS) | blood bank | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 345493 , 346755 , 350147 , 350148 |
| CVE-2023-46014 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-46017 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-46018 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-39796 | WBCE 1.6.0 - Unauthenticated SQL injection | wbce cms | 9.8 (v3.1) | Critical | 340016 , 340145 , 340156 , 380026 , 380122 |
| CVE-2023-47246 | SysAid Server - Remote Code Execution | sysaid on-premises | 9.8 (v3.1) | Critical | 340007 , 390614 , 390626 , 390724 |
| CVE-2023-47248 | PyArrow Flight RPC - Remote Code Execution | pyarrow | 9.8 (v3.1) | Critical | 391213 |
| CVE-2023-41425 | WonderCMS Remote Code Execution | wondercms | 6.1 (v3.1) | Medium | 340128 , 340162 , 340163 , 344370 , 360152 , 380018 , 390801 |
| CVE-2023-46732 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-45805 | WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection | payment gateway | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-34259 | Kyocera TASKalfa printer - Path Traversal | d-copia253mf plus firmware | 4.9 (v3.1) | Medium | 347009 |
| CVE-2023-1719 | Bitrix Component - Cross-Site Scripting | bitrix24 | 9.8 (v3.1) | Critical | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390700 , 390801 , 391213 |
| CVE-2023-24000 | WordPress GamiPress <= 2.5.7 - SQL Injection | gamipress | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2023-5360 | WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload | royal elementor addons | 9.8 (v3.1) | Critical | 382238 |
| CVE-2023-5863 | phpMyFAQ < 3.2.0 - Cross-site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 333141 , 340248 , 342259 , 346755 , 350148 |
| CVE-2023-45671 | Frigate < 0.13.0 Beta 3 - Cross-Site Scripting | frigate | 4.7 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-45498 | Vinchin Backup and Recovery Command Injection | vinchin backup and recovery | 9.8 (v3.1) | Critical | 344361 , 344363 , 344364 , 344366 |
| CVE-2023-45499 | Vinchin Backup and Recovery Command Injection | vinchin backup and recovery | 9.8 (v3.1) | Critical | 344361 , 344363 , 344364 , 344366 |
| CVE-2023-46818 | ISPConfig language_edit.php PHP Code Injection | ispconfig | 7.2 (v3.1) | High | 340095 , 344363 , 346755 , 390801 |
| CVE-2023-43208 | Mirth Connect Deserialization RCE | mirth connect | 9.8 (v3.1) | Critical | 344361 , 344363 , 344364 , 344380 |
| CVE-2023-46747 | F5 BIG-IP TMUI AJP Smuggling RCE | big-ip access policy manager | 9.8 (v3.1) | Critical | 390626 , 392767 |
| CVE-2023-27170 | write-back manager Path Traversal Vulnerability | write-back manager | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2023-34048 | VMware vCenter Server - Out-of-Bounds Write | vcenter server | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-46347 | PrestaShop Step by Step products Pack - SQL Injection | ndk steppingpack | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 344366 , 360147 , 360148 |
| CVE-2023-46574 | TOTOLINK A3700R - Command Injection | a3700r firmware | 9.8 (v3.1) | Critical | 392301 , 392648 |
| CVE-2023-45136 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 9.6 (v3.1) | Critical | 341266 |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-38192 | SuperWebMailer 9.00.0.01710 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2023-38194 | SuperWebMailer - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-5204 | WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection | wpbot | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2023-45826 | Leantime < 2.4 - Authenticated SQL Injection | leantime | 6.5 (v3.1) | Medium | 340017 , 340159 , 341245 , 390726 , 392647 |
| CVE-2023-45375 | PrestaShop PireosPay - SQL Injection | pireospay | 8.8 (v3.1) | High | 341245 , 344366 |
| CVE-2023-45542 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2023-45852 | Viessmann Vitogate 300 - Remote Code Execution | vitogate 300 firmware | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 |
| CVE-2023-39999 | WordPress < 6.3.2 is vulnerable to Broken Access Control | WordPress | 4.3 (v3.1) | Medium | 333140 |
| CVE-2023-34993 | Fortinet FortiWLM Unauthenticated Command Injection Vulnerability | fortiwlm | 9.8 (v3.1) | Critical | 344363 |
| CVE-2023-30804 | Sangfor Next-Gen Application Firewall Authenticated File Disclosure | next-gen application firewall | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-44393 | Piwigo - Cross-Site Scripting | piwigo | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-44812 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 |
| CVE-2023-44813 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-5452 | SnipeIT 6.2.1 - Stored Cross Site Scripting | snipe-it | 5.4 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-22515 | Atlassian Confluence Unauthenticated Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2023-43261 | Milesight Routers - Information Disclosure | ur51 | 7.5 (v3.1) | High | 390716 |
| CVE-2023-5350 | SuiteCRM authenticated SQL injection in export functionality | suitecrm | 9.1 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2023-44012 | mojoPortal v.2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-43654 | PyTorch Model Server Registration and Deserialization RCE | torchserve | 9.8 (v3.1) | Critical | 337109 , 337110 , 398021 , 398022 |
| CVE-2023-43662 | ShokoServer System - Local File Inclusion (LFI) | shokoserver | 8.6 (v3.1) | High | 344365 , 390716 |
| CVE-2023-5244 | Microweber < V.2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 346755 , 380026 , 393655 |
| CVE-2023-40044 | Progress Software WS_FTP Unauthenticated Remote Code Execution | ws ftp server | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2023-43325 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-4490 | WordPress Job Portal < 2.0.6 - SQL Injection | wp job portal | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-4148 | Ditty < 3.1.25 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2023-43326 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-43373 | Hoteldruid v3.0.5 - SQL Injection | hoteldruid | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-43374 | Hoteldruid v3.0.5 - SQL Injection | hoteldruid | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-38875 | PHP Login System 2.0.1 - Cross-Site Scripting | php-login-system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-42793 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical | 340014 , 340193 |
| CVE-2023-41599 | JFinalCMS v5.0.0 - Directory Traversal | jfinalcms | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-33831 | FUXA - Unauthenticated Remote Code Execution | fuxa | 9.8 (v3.1) | Critical | 340095 , 344370 , 345240 , 380026 |
| CVE-2023-38040 | Revive Adserver 5.4.1 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium | 340147 , 341256 , 341266 , 346755 |
| CVE-2023-4974 | Academy LMS 6.2 - SQL Injection | academy lms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-4973 | Academy LMS 6.2 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium | 340147 , 346755 , 350148 |
| CVE-2023-41892 | Craft CMS unauthenticated Remote Code Execution (RCE) | craft cms | 9.8 (v3.1) | Critical | 330791 , 340152 , 344365 , 344370 , 390501 |
| CVE-2023-3710 | Honeywell PM43 Printers - Command Injection | pm43 firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2023-3169 | tagDiv Composer < 4.2 - Stored Cross-Site Scripting | tagdiv composer | 6.1 (v3.1) | Medium | 380026 |
| CVE-2023-40924 | SolarView Compact < 6.00 - Directory Traversal | solarview compact firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2023-39676 | PrestaShop fieldpopupnewsletter Module - Cross Site Scripting | fieldpopupnewsletter | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-4634 | Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion | media library assistant | 9.8 (v3.1) | Critical | 300017 |
| CVE-2023-37941 | Apache Superset Signed Cookie RCE | superset | 6.6 (v3.1) | Medium | 330791 , 340152 |
| CVE-2023-39265 | Apache Superset Signed Cookie RCE | superset | 6.5 (v3.1) | Medium | 330791 , 340152 |
| CVE-2021-36646 | KodExplorer - Cross-Site Scripting | kod-explorer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39361 | Cacti 1.2.24 - SQL Injection | cacti | 9.8 (v3.1) | Critical | 344366 , 380026 , 380122 |
| CVE-2023-39598 | IceWarp Email Client - Cross Site Scripting | webclient | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 |
| CVE-2023-2813 | Wordpress Multiple Themes - Reflected Cross-Site Scripting | connections reloaded | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-40208 | Stock Ticker <= 3.23.2 - Cross-Site Scripting | stock ticker | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-4151 | Store Locator WordPress < 1.4.13 - Cross-Site Scripting | store locator | 6.1 (v3.1) | Medium | 377360 |
| CVE-2023-4284 | WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting | post timeline | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2023-4596 | WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload | forminator | 9.8 (v3.1) | Critical | 300006 |
| CVE-2023-41538 | PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting | php forum script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39650 | PrestaShop Theme Volty CMS Blog - SQL Injection | theme volty cms blog | 9.8 (v3.1) | Critical | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-40748 | PHPJabbers Food Delivery Script - SQL Injection | food delivery script | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 |
| CVE-2023-40749 | PHPJabbers Food Delivery Script v3.0 - SQL Injection | food delivery script | 9.8 (v3.1) | Critical | 340017 , 340156 , 340157 , 341245 , 360147 , 360148 |
| CVE-2023-41109 | SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection | smartnode sn200 | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-40750 | PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting | yacht listing script | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40751 | PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting | fundraising script | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40752 | PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting | make an offer widget | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40755 | PHPJabbers Callback Widget v1.0 - Cross-Site Scripting | callback widget | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2023-40753 | PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting | ticket support script | 5.4 (v3.1) | Medium | 341266 |
| CVE-2023-4547 | SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting | ecommerce cms | 2.0 (v4.0) | Low | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39600 | IceWarp 11.4.6.0 - Cross-Site Scripting | icewarp | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-39700 | IceWarp Mail Server v10.4.5 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-39026 | FileMage Gateway - Directory Traversal | Windows | 7.5 (v3.1) | High | 344365 , 347019 , 390716 |
| CVE-2023-39141 | Aria2 WebUI - Path traversal | webui-aria2 | 7.5 (v3.1) | High | 347009 |
| CVE-2023-4450 | JeecgBoot JimuReport - Template injection | jeecg | 9.8 (v3.1) | Critical | 340014 , 344370 , 393655 |
| CVE-2023-38836 | BoidCMS Command Injection | boidcms | 8.8 (v3.1) | High | 330791 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904 |
| CVE-2023-3936 | Blog2Social < 7.2.1 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium | 347198 |
| CVE-2022-24989 | TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 | terramaster operating system | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344364 , 390709 , 390719 |
| CVE-2023-4451 | Cockpit - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2023-4415 | Ruijie RG-EW1200G Router Background - Login Bypass | rg-ew1200g firmware | 8.8 (v3.1) | High | 392301 |
| CVE-2023-38910 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' ) | csz cms | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-38911 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery') | csz cms | 5.4 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-26469 | Jorani unauthenticated Remote Code Execution | jorani | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344364 , 344370 , 347009 , 360152 , 380026 , 390109 , 390709 , 390719 |
| CVE-2023-36845 | Juniper J-Web - Remote Code Execution | junos | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2023-40315 | OpenNMS Horizon Authenticated RCE | horizon | 8.0 (v3.1) | High | 330791 , 340152 |
| CVE-2023-2122 | Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting | image optimizer | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2023-2272 | Tiempo.com <= 0.1.2 - Cross-Site Scripting | tiempo | 6.1 (v3.1) | Medium | 377360 |
| CVE-2023-4382 | Hyip Rio 2.1 - Arbitrary File Upload | hyip rio | 5.4 (v3.1) | Medium | 392301 |
| CVE-2023-0872 | OpenNMS Horizon Authenticated RCE | horizon | 8.0 (v3.1) | High | 330791 , 340152 |
| CVE-2023-3452 | WordPress Canto Plugin <= 3.0.4 - File Inclusion | canto | 9.8 (v3.1) | Critical | 340077 , 340694 , 340695 |
| CVE-2023-32563 | Ivanti Avalanche - Remote Code Execution | avalanche | 9.8 (v3.1) | Critical | 340007 |
| CVE-2023-37988 | Contact Form Generator <= 2.5.5 - Cross-Site Scripting | contact form generator | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-32781 | PRTG CVE-2023-32781 Authenticated RCE | prtg network monitor | 7.2 (v3.1) | High | 341245 , 344365 , 390704 |
| CVE-2023-36306 | Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting | loganalyzer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4173 | mooSocial 3.1.8 - Reflected XSS | moostore | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-4174 | mooSocial 3.1.6 - Reflected Cross Site Scripting | moostore | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-4169 | Ruijie RG-EW1200G Router - Password Reset | rg-ew1200g firmware | 8.8 (v3.1) | High | 392301 |
| CVE-2023-39143 | PaperCut < 22.1.3 - Path Traversal | papercut mf | 9.8 (v3.1) | Critical | 344365 , 347019 |
| CVE-2023-38964 | Academy LMS 6.0 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium | 333141 , 342259 , 347198 , 350147 , 350148 |
| CVE-2023-37679 | Mirth Connect Deserialization RCE | mirth connect | 9.8 (v3.1) | Critical | 344361 , 344363 , 344364 , 344380 |
| CVE-2023-38950 | ZKTeco BioTime v8.5.5 - Path Traversal | biotime | 7.5 (v3.1) | High | 340007 |
| CVE-2023-4110 | PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting | availability booking calendar | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4111 | PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting | bus reservation system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4112 | PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting | shuttle booking software | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2023-4113 | PHPJabbers Service Booking Script 1.0 - Cross Site Scripting | service booking script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4114 | PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting | night club booking software | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4115 | PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting | cleaning business software | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4116 | PHPJabbers Taxi Booking 2.0 - Cross Site Scripting | taxi booking script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4136 | CrafterCMS Engine - Cross-Site Scripting | craftercms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2023-34960 | Chamilo unauthenticated command injection in PowerPoint upload | chamilo | 9.8 (v3.1) | Critical | 340195 , 340196 , 341245 , 344360 , 344361 , 344363 , 344364 , 344370 , 360152 , 380019 , 383023 , 390811 |
| CVE-2023-39108 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39109 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39110 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2023-34635 | Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection | unibox administration | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2023-3345 | LMS by Masteriyo < 1.6.8 - Information Exposure | masteriyo | 6.5 (v3.1) | Medium | 377360 |
| CVE-2023-0602 | Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting | twittee text tweet | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | zimbra | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-3990 | Mingsoft MCMS < 5.3.1 - Cross-Site Scripting | mcms | 6.1 (v3.1) | Medium | 342259 , 350148 |
| CVE-2023-37979 | Ninja Forms < 3.6.26 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-31465 | TimeKeeper by FSMLabs - Remote Code Execution | timekeeper | 9.8 (v3.1) | Critical | 344361 , 344364 , 393655 |
| CVE-2023-38501 | CopyParty v1.8.6 - Cross Site Scripting | copyparty | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 , 390722 |
| CVE-2023-2309 | wpForo Forum <= 2.1.8 - Cross-Site Scripting | wpforo forum | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2023-3843 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3844 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3845 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3846 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3847 | MooDating 1.2 - Cross-Site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3848 | MooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3849 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-38646 | Metabase Setup Token RCE | metabase | 9.8 (v3.1) | Critical | 330791 , 337209 , 337210 , 337211 , 340152 , 340155 , 341155 , 344361 , 344362 , 344363 , 344370 |
| CVE-2023-38203 | Adobe ColdFusion - Deserialization of Untrusted Data | coldfusion | 9.8 (v3.1) | Critical | 344370 , 344380 , 350147 |
| CVE-2023-37728 | IceWarp Webmail Server v10.2.1 - Cross Site Scripting | icewarp | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-3519 | Citrix ADC (NetScaler) Forms SSO Target RCE | netscaler application delivery controller | 9.8 (v3.1) | Critical | 340128 , 380018 , 390801 |
| CVE-2023-3722 | Avaya Aura Device Services - OS Command Injection | aura device services | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-22047 | Oracle Peoplesoft - Unauthenticated File Read | peoplesoft enterprise | 7.5 (v3.1) | High | 340165 , 344360 , 344365 , 347009 |
| CVE-2023-1893 | Login Configurator <=2.1 - Cross-Site Scripting | login configurator | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-37462 | XWiki Platform - Remote Code Execution | xwiki | 8.8 (v3.1) | High | 340130 |
| CVE-2023-37474 | Copyparty <= 1.8.2 - Directory Traversal | copyparty | 7.5 (v3.1) | High | 347009 |
| CVE-2023-34124 | Sonicwall | analytics | 9.8 (v3.1) | Critical | 340017 , 340145 , 340156 , 341145 , 341245 , 344361 , 344362 , 344363 , 344364 , 344365 , 344366 , 360148 , 380123 , 393655 |
| CVE-2023-34132 | Sonicwall | analytics | 9.8 (v3.1) | Critical | 340017 , 340145 , 340156 , 341145 , 341245 , 344361 , 344362 , 344363 , 344364 , 344365 , 344366 , 360148 , 380123 , 393655 |
| CVE-2023-34127 | Sonicwall | analytics | 8.8 (v3.1) | High | 340017 , 340145 , 340156 , 341145 , 341245 , 344361 , 344362 , 344363 , 344364 , 344365 , 344366 , 360148 , 380123 , 393655 |
| CVE-2023-34133 | Sonicwall | analytics | 7.5 (v3.1) | High | 340017 , 340145 , 340156 , 341145 , 341245 , 344361 , 344362 , 344363 , 344364 , 344365 , 344366 , 360148 , 380123 , 393655 |
| CVE-2023-29300 | Adobe ColdFusion - Pre-Auth Remote Code Execution | coldfusion | 9.8 (v3.1) | Critical | 344370 , 344380 , 350147 |
| CVE-2023-3643 | CAREL Boss Mini <= 1.4.0 - Local File Inclusion | boss-mini | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2023-37629 | Online Piggery Management System v1.0 - Unauthenticated File Upload | simple online piggery management system | 9.8 (v3.1) | Critical | 330791 |
| CVE-2023-3077 | MStore API < 3.9.8 - SQL Injection | mstore api | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-23897 | Ozette Plugins - Cross-Site Request Forgery | simple mobile url redirect | 8.8 (v3.1) | High | 345490 , 377360 |
| CVE-2023-1119 | WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting | wp-optimize,srbtranslatin | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-1780 | Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting | companion sitemap generator | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 341266 , 342259 , 360151 , 390722 |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | collaboration | 9.0 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-36969 | CmsMadeSimple Authenticated File Manager RCE | cms made simple | 8.8 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2023-3521 | FOSSBilling < 0.5.3 - Cross-Site Scripting | fossbilling | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-36934 | MOVEit Transfer - SQL Injection | moveit transfer | 9.1 (v3.1) | Critical | 340016 , 344362 |
| CVE-2023-3479 | Hestiacp <= 1.7.7 - Cross-Site Scripting | control panel | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-34843 | Traggo Server - Local File Inclusion | traggo | 7.5 (v3.1) | High | 344365 , 347019 |
| CVE-2023-34599 | Gibbon v25.0.0 - Cross-Site Scripting | gibbon | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-30203 | Dzzoffice 2.02.1 - Cross-Site Scripting | dzzoffice | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-2624 | KiviCare WordPress Plugin - Cross-Site Scripting | kivicare | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-2178 | Aajoda Testimonials < 2.2.2 - Cross-Site Scripting | aajoda testimonials | 4.8 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-36661 | Ivanti Connect Secure Unauthenticated Remote Code Execution | xmltooling | 7.5 (v3.1) | High | 337109 , 337110 , 398021 , 398022 |
| CVE-2023-3197 | WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection | mstore api | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2023-30258 | MagnusBilling - Remote Code Execution | magnusbilling | 9.8 (v3.1) | Critical | 344363 , 344364 , 344366 |
| CVE-2023-3380 | WAVLINK WN579X3 - Remote Command Execution | wn579x3 firmware | 9.8 (v3.1) | Critical | 340014 , 344363 |
| CVE-2023-36284 | QloApps 1.6.0 - SQL Injection | qloapps | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2023-35155 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-35156 | XWiki >= 6.0-rc-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35158 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35159 | XWiki >= 3.4-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35160 | XWiki >= 2.5-milestone-2 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35161 | XWiki >= 6.2-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35162 | XWiki < 14.10.5 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-36287 | Webkul QloApps 1.6.0 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 350148 |
| CVE-2023-36289 | Webkul QloApps 1.6.0 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 346755 |
| CVE-2023-36346 | POS Codekop v2.0 - Cross Site Scripting | codekop | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2020-20969 | PluckCMS 4.7.10 - Unrestricted File Upload | pluck | 7.2 (v3.1) | High | 340035 , 390727 , 392301 , 392648 |
| CVE-2023-35843 | NocoDB version <= 0.106.1 - Arbitrary File Read | nocodb | 7.5 (v3.1) | High | 347009 |
| CVE-2023-35844 | Lightdash version <= 0.510.3 Arbitrary File Read | lightdash | 7.5 (v3.1) | High | 347009 |
| CVE-2023-2779 | Super Socializer < 7.13.52 - Cross-Site Scripting | social share, social login and social comments | 6.1 (v3.1) | Medium | 340099 , 341099 , 341258 , 346755 , 347198 |
| CVE-2023-34659 | JeecgBoot 3.5.0 - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-30625 | Rudder Server SQLI Remote Code Execution | rudder-server | 8.8 (v3.1) | High | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 , 380026 , 392301 |
| CVE-2023-29357 | Sharepoint Dynamic Proxy Generator Unauth RCE | sharepoint server | 9.8 (v3.1) | Critical | 340014 , 342259 , 344361 , 344363 , 344370 |
| CVE-2023-30150 | PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection | leocustomajax | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34751 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34752 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34753 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34754 | Bloofox v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34755 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2023-34756 | Bloofox v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2023-34537 | Hoteldruid 3.0.5 - Cross-Site Scripting | hoteldruid | 5.4 (v3.1) | Medium | 340130 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-27624 | WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS | redirect after login | 4.8 (v3.1) | Medium | 346755 |
| CVE-2023-33625 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-600 firmware | 9.8 (v3.1) | Critical | 381237 , 392648 |
| CVE-2023-34468 | Apache NiFi H2 Connection String Remote Code Execution | nifi | 8.8 (v3.1) | High | 330791 , 337209 , 337210 , 337211 , 340095 , 340152 |
| CVE-2023-34105 | SRS - Command Injection | simple realtime server | 7.5 (v3.1) | High | 344364 |
| CVE-2023-3188 | Owncast - Server Side Request Forgery | owncast | 6.5 (v3.1) | Medium | 392301 |
| CVE-2023-3187 | Teachers Record Management System 1.0 - File Upload Type Validation | teachers record management system | 5.4 (v3.1) | Medium | 345493 |
| CVE-2023-3184 | Sales Tracker Management System v1.0 - Multiple Vulnerabilities | sales tracker management system | 4.8 (v3.1) | Medium | 345493 |
| CVE-2023-32749 | Pydio Cells 4.1.2 - Unauthorised Role Assignments | cells | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2019-25141 | Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update | easy wp smtp | 9.8 (v3.1) | Critical | 390726 , 392647 |
| CVE-2021-4374 | WordPress Plugin Automatic Config Change to RCE | wordpress automatic plugin | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2023-20887 | VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE | aria operations for networks | 9.8 (v3.1) | Critical | 391213 |
| CVE-2023-33510 | Jeecg P3 Biz Chat - Local File Inclusion | jeecg p3 biz chat | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-36731 | Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update | flexible checkout fields for woocommerce | 6.1 (v3.1) | Medium | 346755 , 377360 , 390585 |
| CVE-2023-0900 | AP Pricing Tables Lite <= 1.1.6 - SQL Injection | pricing table builder | 7.2 (v3.1) | High | 377360 |
| CVE-2023-2224 | Seo By 10Web < 1.2.7 - Cross-Site Scripting | seo | 4.8 (v3.1) | Medium | 377360 |
| CVE-2023-34362 | MOVEit SQL Injection vulnerability | moveit cloud | 9.8 (v3.1) | Critical | 334168 , 340016 , 340145 , 340156 , 341145 , 341245 , 390716 , 391213 |
| CVE-2023-32707 | Splunk "edit_user" Capability Privilege Escalation | splunk | 8.8 (v3.1) | High | 340128 , 350147 , 360152 , 380018 , 390801 |
| CVE-2023-27639 | PrestaShop TshirteCommerce - Directory Traversal | custom product designer | 7.5 (v3.1) | High | 340007 |
| CVE-2023-27640 | PrestaShop tshirtecommerce - Directory Traversal | custom product designer | 7.5 (v3.1) | High | 340007 |
| CVE-2023-34092 | Vite Dev Server - Information Exposure | vite | 7.5 (v3.1) | High | 390709 |
| CVE-2023-33629 | H3C Magic R300-2100M - Remote Code Execution | magic r300-2100m firmware | 7.2 (v3.1) | High | 392301 |
| CVE-2023-26842 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-31548 | ChurchCRM v4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2023-2023 | Custom 404 Pro < 3.7.3 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-2256 | WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting | woocommerce-product-addon | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-2518 | WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting | easy forms for mailchimp | 6.1 (v3.1) | Medium | 347198 , 377360 |
| CVE-2022-24627 | AudioCodes Device Manager Express - SQL Injection | device manager express | 9.8 (v3.1) | Critical | 340145 , 340156 , 390572 |
| CVE-2023-30253 | Dolibarr ERP/CRM Authenticated Code Injection | dolibarr erp/crm | 8.8 (v3.1) | High | 344370 |
| CVE-2023-2948 | OpenEMR < 7.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium | 344363 , 346755 |
| CVE-2023-2949 | OpenEMR < 7.0.1 - Cross-site Scripting | openemr | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2023-2825 | GitLab Authenticated File Read | gitlab | 7.5 (v3.1) | High | 340006 , 340007 , 344360 , 344364 , 390709 , 390719 , 390724 |
| CVE-2023-32315 | Openfire authentication bypass with RCE plugin | openfire | 7.5 (v3.1) | High | 340006 , 340007 , 344360 , 347009 , 390703 , 390709 , 390719 |
| CVE-2023-33439 | Faculty Evaluation System v1.0 - SQL Injection | faculty evaluation system | 7.2 (v3.1) | High | 340157 , 340159 , 360147 , 360148 |
| CVE-2023-2734 | MStore API <= 3.9.1 - Authentication Bypass | mstore api | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-33338 | Old Age Home Management System v1.0 - SQL Injection | old age home management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 390572 |
| CVE-2023-33362 | Piwigo 13.6.0 - SQL Injection | piwigo | 9.8 (v3.1) | Critical | 390727 , 392301 , 392648 |
| CVE-2023-27922 | Newsletter < 7.6.9 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-31742 | Linksys WRT54GL Remote Command Execution | wrt54gl firmware | 7.2 (v3.1) | High | 340128 , 344364 , 344366 , 360152 , 380018 , 390801 |
| CVE-2023-2822 | Ellucian Ethos Identity CAS - Cross-Site Scripting | ethos identity | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-30868 | Tree Page View Plugin < 1.6.7 - Cross-Site Scripting | cms tree page view | 6.1 (v3.1) | Medium | 341266 |
| CVE-2023-2780 | Mlflow <2.3.1 - Local File Inclusion Bypass | mlflow | 9.8 (v3.1) | Critical | 398008 |
| CVE-2023-2766 | Weaver OA 9.5 - Information Disclosure | weaver office automation | 7.5 (v3.1) | High | 390716 |
| CVE-2023-2745 | WordPress Core <=6.2 - Directory Traversal | WordPress | 5.4 (v3.1) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2023-29439 | FooGallery plugin <= 2.2.35 - Cross-Site Scripting | foogallery | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2023-0600 | WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection | wp visitor statistics | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-1835 | Ninja Forms < 3.6.22 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 347198 |
| CVE-2023-1890 | Tablesome < 1.0.9 - Cross-Site Scripting | tablesome | 6.1 (v3.1) | Medium | 340148 , 341266 |
| CVE-2023-2009 | Pretty Url <= 1.5.4 - Cross-Site Scripting | pretty url | 4.8 (v3.1) | Medium | 377360 |
| CVE-2023-30192 | PrestaShop 'possearchproducts' <= 1.7 - SQL Injection | possearchproducts | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-2648 | Weaver E-Office 9.5 - Remote Code Execution | e-office | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-30256 | Webkul QloApps 1.5.2 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 346755 , 347198 |
| CVE-2023-30194 | Prestashop posstaticfooter <= 1.0.0 - SQL Injection | poststaticfooter | 9.8 (v3.1) | Critical | 341245 , 344366 |
| CVE-2023-30777 | Advanced Custom Fields < 6.1.6 - Cross-Site Scripting | advanced custom fields | 6.1 (v3.1) | Medium | 333141 , 347198 |
| CVE-2023-24955 | Sharepoint Dynamic Proxy Generator Unauth RCE | sharepoint enterprise server | 7.2 (v3.1) | High | 340014 , 342259 , 344361 , 344363 , 344370 |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | 7.2 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 344365 , 360152 , 380018 , 390801 |
| CVE-2023-1408 | Video List Manager <= 1.7 - SQL Injection | video list manager | 7.2 (v3.1) | High | 380122 |
| CVE-2023-0514 | Membership Database <= 1.0 - Cross-Site Scripting | membership database | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-0948 | WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-30013 | TOTOLink - Unauthenticated Command Injection | x5000r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-32235 | Ghost CMS < 5.42.1 - Path Traversal | ghost | 7.5 (v3.1) | High | 390703 |
| CVE-2023-29827 | Embedded JavaScript(EJS) 3.1.6 - Template Injection | ejs | 9.8 (v3.1) | Critical | 340014 , 340193 , 344370 , 345240 , 380026 |
| CVE-2023-25826 | OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection | opentsdb | 9.8 (v3.1) | Critical | 340029 , 344363 , 390722 |
| CVE-2022-3405 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 8.8 (v3.1) | High | 340011 , 340128 , 380018 , 390801 |
| CVE-2022-30995 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 7.5 (v3.1) | High | 340011 , 340128 , 380018 , 390801 |
| CVE-2023-1730 | SupportCandy < 3.1.5 - Unauthenticated SQL Injection | supportcandy | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-2479 | Appium Desktop Server - Remote Code Execution | appium-desktop | 9.8 (v3.1) | Critical | 342259 |
| CVE-2023-30869 | Easy Digital Downloads - Privilege Escalation | easy digital downloads | 9.8 (v3.1) | Critical | 377360 |
| CVE-2023-1546 | MyCryptoCheckout < 2.124 - Cross-Site Scripting | mycryptocheckout | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-30943 | Moodle - Cross-Site Scripting/Remote Code Execution | moodle | 5.3 (v3.1) | Medium | 333141 , 340007 , 340099 , 340147 , 340148 , 340149 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-2356 | Mlflow <2.3.0 - Local File Inclusion | mlflow | 7.5 (v3.1) | High | 340007 |
| CVE-2023-28384 | mySCADA MyPRO Authenticated Command Injection (CVE-2023-28384) | mypro | 8.8 (v3.1) | High | 330925 |
| CVE-2023-29489 | cPanel < 11.109.9999.116 - Cross-Site Scripting | cpanel | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 |
| CVE-2023-30210 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2023-30212 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26947 | Odoo <= 15.0 - Cross-Site Scripting | odoo | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 |
| CVE-2023-25346 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-26843 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 |
| CVE-2023-1020 | Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection | wp live chat shoutbox | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2023-27524 | Apache Superset Signed Cookie RCE | superset | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-31059 | Repetier Server - Directory Traversal | repetier-server | 7.5 (v3.1) | High | 344365 , 347019 |
| CVE-2023-1892 | Sidekiq < 7.0.8 - Cross-Site Scripting | sidekiq | 9.6 (v3.1) | Critical | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-26876 | Piwigo CVE-2023-26876 Gather Credentials via SQL Injection | piwigo | 8.8 (v3.1) | High | 340017 , 340144 , 340145 , 340156 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-27350 | PaperCut PaperCutNG Authentication Bypass | papercut mf | 9.8 (v3.1) | Critical | 344370 , 390727 , 392648 |
| CVE-2023-29887 | Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion | spreadsheet-reader | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-45836 | WordPress Download Manager <= 3.2.59 - Reflected XSS | download manager | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2023-2130 | Purchase Order Management v1.0 - SQL Injection | purchase order management system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-34128 | GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) | positions | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-34127 | GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin | manageentities | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2022-38840 | Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) | man-eam-0003 | 7.5 (v3.1) | High | 344360 , 344370 , 344372 , 380018 |
| CVE-2022-34125 | GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin | cmdb | 6.5 (v3.1) | Medium | 340007 , 344360 |
| CVE-2023-29506 | XWiki >= 13.10.8 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-43128 | Dreamer CMS v4.0.0 - SQL Injection | - | N/A | N/A | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-48178 | X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) | x2crm | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 390585 |
| CVE-2022-47501 | Apache OFBiz < 18.12.07 - Local File Inclusion | ofbiz | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2023-29623 | Purchase Order Management v1.0 - Cross Site Scripting (Reflected) | purchase order management | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 342259 , 346755 |
| CVE-2023-2059 | DedeCMS 5.7.87 - Directory Traversal | dedecms | 5.3 (v3.1) | Medium | 340007 , 347019 |
| CVE-2023-26068 | Lexmark Device Embedded Web Server RCE | cxtpc firmware | 9.8 (v3.1) | Critical | 340128 , 380018 , 390801 , 393655 |
| CVE-2023-26067 | Lexmark Printers - Command Injection | cxtpc firmware | 8.1 (v3.1) | High | 392301 |
| CVE-2023-1880 | Phpmyfaq v3.1.11 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-43939 | Pentaho Business Server Auth Bypass and Server Side Template Injection RCE | vantara pentaho business analytics server | 9.8 (v3.1) | Critical | 393655 |
| CVE-2022-43769 | Pentaho Business Server Auth Bypass and Server Side Template Injection RCE | vantara pentaho business analytics server | 7.2 (v3.1) | High | 393655 |
| CVE-2023-26482 | Nextcloud Workflows Remote Code Execution | nextcloud server | 8.8 (v3.1) | High | 344365 |
| CVE-2023-27167 | Suprema BioStar 2 v2.8.16 - SQL Injection | biostar 2 | 6.5 (v3.1) | Medium | 330791 , 340152 , 341145 , 380026 , 380122 |
| CVE-2023-27008 | ATutor < 2.2.1 - Cross Site Scripting | atutor | 6.1 (v3.1) | Medium | 344363 , 346755 , 350148 |
| CVE-2023-1133 | Delta Electronics InfraSuite Device Master Deserialization | infrasuite device master | 9.8 (v3.1) | Critical | 392648 |
| CVE-2023-27847 | PrestaShop xipblog - SQL Injection | xipblog | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2023-26802 | DCBI-Netlog-LAB v1.0 - Command Injection | dcbi-netlog-lab firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2023-1177 | Mlflow <2.2.1 - Local File Inclusion | mlflow | 9.8 (v3.1) | Critical | 398008 |
| CVE-2023-27034 | Jms Blog - SQL Injection | jms blog | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-26360 | Adobe ColdFusion Unauthenticated Remote Code Execution | coldfusion | 8.6 (v3.1) | High | 340007 , 344360 , 344370 , 350147 , 390709 |
| CVE-2023-24367 | Temenos T24 R20 - Cross-Site Scripting | t24 | 6.1 | Medium | 341266 |
| CVE-2023-27637 | PrestaShop tshirtecommerce Module - SQL Injection | custom product designer | 9.8 (v3.1) | Critical | 341245 , 344366 , 380026 , 380122 |
| CVE-2023-27638 | tshirtecommerce PrestaShop Module - SQL Injection | prestashop | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-28665 | Woo Bulk Price Update <2.2.2 - Cross-Site Scripting | bulk price update for woocommerce | 5.4 (v3.1) | Medium | 347198 |
| CVE-2023-0630 | Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection | slimstat analytics | 8.8 (v3.1) | High | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2023-24278 | Squidex <7.4.0 - Cross-Site Scripting | squidex | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2023-1454 | Jeecg-boot 3.5.0 qurestSql - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 340157 , 340159 , 360147 , 360148 |
| CVE-2023-27253 | pfSense Restore RRD Data Command Injection | pfsense | 8.8 (v3.1) | High | 330791 , 340152 , 390700 |
| CVE-2023-25280 | D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection | dir820la1 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2023-1389 | TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection | archer-ax21 | 8.8 (v3.1) | High | 393655 |
| CVE-2023-28343 | Altenergy Power Control Software C1.2.5 - Remote Command Injection | energy communication unit firmware | 9.8 (v3.1) | Critical | 344364 |
| CVE-2023-0037 | WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection | map builder for google maps | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-31474 | BackupBuddy - Local File Inclusion | backupbuddy | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-1315 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-1317 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2023-1318 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-24657 | phpIPAM - 1.6 - Cross-Site Scripting | phpipam | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-1211 | phpIPAM 1.5.1 - SQL Injection | phpipam | 7.2 (v3.1) | High | 341245 , 344366 , 344370 , 380026 , 380122 |
| CVE-2022-4328 | WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload | woocommerce checkout field manager | 9.8 (v3.1) | Critical | 382238 |
| CVE-2023-24733 | PMB 7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2023-24737 | PMB v7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2023-27641 | L-Soft LISTSERV 16.5 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0968 | WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting | watu quiz | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-26256 | STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion | stagil navigation | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-1080 | WordPress GN Publisher <1.5.6 - Cross-Site Scripting | gn publisher | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-0334 | ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting | shortpixel adaptive images | 6.1 (v3.1) | Medium | 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-26035 | ZoneMinder Snapshots - Command Injection | zoneminder | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2023-0961 | Music Gallery Site v1.0 - SQL Injection on page view_music_details.php | music gallery site | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0962 | Music Gallery Site v1.0 - SQL Injection on page Master.php | music gallery site | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2023-23063 | Cellinx NVT Web Server - Local File Disclosure | nvt web server | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-0938 | Music Gallery Site v1.0 - SQL Injection on music_list.php | music gallery site | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2022-4897 | WordPress BackupBuddy <8.8.3 - Cross Site Scripting | backupbuddy | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2023-0942 | WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-32853 | Erxes <0.23.0 - Cross-Site Scripting | erxes | 9.6 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0915 | Auto Dealer Management System v1.0 - SQL Injection on manage_user.php | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0916 | Auto Dealer Management System 1.0 - Broken Access Control Exploit | auto dealer management system | 8.8 (v3.1) | High | 345493 |
| CVE-2023-0903 | Employee Task Management System v1.0 - SQL Injection on edit-task.php | employee task management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2023-0904 | Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?) | employee task management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2023-0912 | Auto Dealer Management System v1.0 - SQL Injection | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0913 | Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0905 | Employee Task Management System v1.0 - Broken Authentication | employee task management system | 7.5 (v3.1) | High | 344365 , 344370 , 345493 , 350147 |
| CVE-2023-0902 | Employee Task Management System v1.0 - SQL Injection on edit-task.php | simple food ordering system | 5.4 (v3.1) | Medium | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-40032 | Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) | simple task managing system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 345493 , 360147 , 360148 , 380026 , 380122 , 390572 , 393655 |
| CVE-2022-40347 | Intern Record System v1.0 - SQL Injection (Unauthenticated) | intern record system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390572 , 393655 |
| CVE-2022-47986 | IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution | linux kernel | 9.8 (v3.1) | Critical | 344364 , 344370 |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2022-40022 | Symmetricom SyncServer Unauthenticated Remote Command Execution | syncserver s650 firmware | 9.8 (v3.1) | Critical | 340014 , 344363 , 344364 , 344366 , 344370 |
| CVE-2022-48323 | Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution | sunflower | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-25717 | Ruckus Wireless Admin - Remote Code Execution | ruckus wireless admin | 9.8 (v3.1) | Critical | 344363 , 393655 |
| CVE-2023-0261 | WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection | wp tripadvisor review slider | 8.8 (v3.1) | High | 340016 , 380122 |
| CVE-2023-0159 | Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE | extensive vc addons for wpbakery page builder | 7.5 (v3.1) | High | 340077 , 344360 , 381206 |
| CVE-2023-0099 | Simple URLs < 115 - Cross Site Scripting | simple urls | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-45699 | APsystems ECU-R Firmware - Command Injection | ecu-r firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2023-23161 | Art Gallery Management System Project v1.0 - Cross-Site Scripting | art gallery management system | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2023-24322 | mojoPortal 2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2022-24990 | TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 | terramaster operating system | 7.5 (v3.1) | High | 340006 , 340007 , 344360 , 344364 , 390709 , 390719 |
| CVE-2023-23333 | SolarView Compact unauthenticated remote command execution vulnerability. | solarview compact firmware | 9.8 (v3.1) | Critical | 340128 , 344361 , 344362 , 344363 , 360152 , 380018 , 390613 , 390614 , 390801 |
| CVE-2023-0669 | Fortra GoAnywhere MFT - Remote Code Execution | goanywhere managed file transfer | 7.2 (v3.1) | High | 344370 |
| CVE-2022-4321 | PDF Generator for WordPress < 1.1.2 - Cross Site Scripting | pdf generator for wordpress | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0236 | WordPress Tutor LMS <2.0.10 - Cross Site Scripting | tutor lms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 |
| CVE-2023-0676 | phpIPAM 1.5.1 - Cross-site Scripting | phpipam | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-25135 | vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution | vbulletin | 9.8 (v3.1) | Critical | 344365 , 390614 |
| CVE-2022-46552 | D-Link DIR-846 - Remote Command Execution (RCE) vulnerability | dir-846 firmware | 8.8 (v3.1) | High | 330791 , 340152 , 381237 |
| CVE-2022-2546 | WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting | all-in-one wp migration | 4.7 (v3.1) | Medium | 377360 |
| CVE-2022-45297 | EQ Enterprise management system v2.2.0 - SQL Injection | eq | 9.8 (v3.1) | Critical | 334168 , 341245 , 344370 |
| CVE-2022-4306 | WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting | panda pods repeater field | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-0562 | Bank Locker Management System v1.0 - SQL Injection | bank locker management system | 9.8 (v3.1) | Critical | 340156 , 341145 |
| CVE-2023-0563 | Bank Locker Management System - Cross-Site Scripting | bank locker management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-48012 | OpenCATS 0.9.7 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2023-0527 | Online Security Guards Hiring System - Cross-Site Scripting | online security guards hiring system | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-45808 | LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi | learnpress | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-47615 | LearnPress Plugin < 4.2.0 - Local File Inclusion | learnpress | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2023-0448 | WP Helper Lite < 4.3 - Cross-Site Scripting | wp helper premium | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-23488 | Wordpress Paid Membership Pro code Unauthenticated SQLi | paid memberships pro | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 380122 |
| CVE-2023-23489 | WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection | easy digital downloads | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2023-23492 | Login with Phone Number - Cross-Site Scripting | login with phone number | 8.8 (v3.1) | High | 346755 , 347198 |
| CVE-2022-41441 | ReQlogic v11.3 - Cross Site Scripting | reqlogic | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-23491 | Quick Event Manager < 9.7.5 - Cross-Site Scripting | quick event manager | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-0126 | SonicWall SMA1000 LFI | sma1000 | 7.5 (v3.1) | High | 347009 |
| CVE-2022-46888 | NexusPHP <1.7.33 - Cross-Site Scripting | nexusphp | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2022-47966 | ManageEngine Endpoint Central Unauthenticated SAML RCE | manageengine access manager plus | 9.8 (v3.1) | Critical | 341256 , 344370 , 350147 , 383023 |
| CVE-2022-39195 | LISTSERV 17 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-4060 | WordPress User Post Gallery <=2.19 - Remote Code Execution | user post gallery | 9.8 (v3.1) | Critical | 340087 , 344360 , 347009 |
| CVE-2022-4447 | WordPress Fontsy <=1.8.6 - SQL Injection | fontsy | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2023-0315 | Froxlor Log Path RCE | froxlor | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2022-4295 | Show all comments < 7.0.1 - Cross-Site Scripting | show all comments | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-4320 | WordPress Events Calendar <1.4.5 - Cross-Site Scripting | wordpress events calendar plugin | 6.1 (v3.1) | Medium | 340748 , 341266 , 346755 , 347006 |
| CVE-2023-0297 | PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE) | pyload | 9.8 (v3.1) | Critical | 340095 |
| CVE-2022-38467 | CRM Perks Forms < 1.1.1 - Cross Site Scripting | crm perks forms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 , 390720 |
| CVE-2023-22952 | SugarCRM unauthenticated Remote Code Execution (RCE) | sugarcrm | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2022-4301 | WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-4325 | WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting | post status notifier lite | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-44877 | Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) | webpanel | 9.8 (v3.1) | Critical | 344364 , 344366 , 393655 |
| CVE-2023-22463 | KubePi JwtSigKey - Admin Authentication Bypass | kubepi | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-38627 | Nortek Linear eMerge E3-Series - SQL Injection | emerge e3 firmware | 9.8 (v3.1) | Critical | 334073 , 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-4059 | Cryptocurrency Widgets Pack < 2.0 - SQL Injection | cryptocurrency widgets pack | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-4140 | WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access | welcart e-commerce | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2022-48197 | Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting | yui | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-4260 | WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting | wp-ban | 4.8 (v3.1) | Medium | 377360 |
| CVE-2021-45467 | Control Web Panel (CWP) - File Inclusion | webpanel | 9.8 (v3.1) | Critical | 320464 , 320465 , 390613 , 390614 |
| CVE-2022-4117 | WordPress IWS Geo Form Fields <=1.0 - SQL Injection | iws-geo-form-fields | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-30134 | Php-mod/curl Library <2.3.2 - Cross-Site Scripting | php curl class | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-42953 | ZKTeco ZEM/ZMM 8.88 - Missing Authentication | zmm200 firmware | 7.5 (v3.1) | High | 345493 |
| CVE-2022-47945 | Thinkphp Lang - Local File Inclusion | thinkphp | 9.8 (v3.1) | Critical | 340007 |
| CVE-2022-23854 | AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion | intouch access anywhere | 7.5 (v3.1) | High | 390716 |
| CVE-2022-4050 | WordPress JoomSport <5.2.8 - SQL Injection | joomsport | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-44588 | Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection | cryptocurrency widgets pack | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-46071 | Helmet Store Showroom v1.0 - SQL Injection | helmet store showroom site | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2022-46443 | Bangresto - SQL Injection | bangresto | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-46073 | Helmet Store Showroom - Cross Site Scripting | helmet store showroom | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-3590 | WordPress <= 6.2 - Server Side Request Forgery | WordPress | 5.9 (v3.1) | Medium | 398001 |
| CVE-2022-4223 | pgAdmin < 6.17 - Unauthenticated Remote Code Execution | pgadmin 4 | 8.8 (v3.1) | High | 393655 |
| CVE-2022-46381 | Linear eMerge E3-Series - Cross-Site Scripting | linear emerge e3 access control firmware | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-3982 | WordPress Booking Calendar <3.2.2 - Arbitrary File Upload | booking calendar | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-3908 | WordPress Helloprint <1.4.7 - Cross-Site Scripting | helloprint | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3933 | WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting | essential real estate | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3934 | WordPress FlatPM <3.0.13 - Cross-Site Scripting | flat pm | 5.4 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-41800 | F5 BIG-IP iControl Authenticated RCE via RPM Creator | big-ip access policy manager | 8.7 (v3.1) | High | 330791 , 340152 , 344362 , 344363 |
| CVE-2022-35507 | Proxmox - CRLF Injection | proxmox mail gateway | 7.1 (v3.1) | High | 390714 |
| CVE-2022-44290 | WebTareas 2.4p5 - SQL Injection | webtareas | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-44291 | WebTareas 2.4p5 - SQL Injection | webtareas | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-1471 | PyTorch Model Server Registration and Deserialization RCE | snakeyaml | 9.8 (v3.1) | Critical | 337109 , 337110 , 398021 , 398022 |
| CVE-2022-41412 | perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery | perfsonar | 8.6 (v3.1) | High | 340007 |
| CVE-2022-3768 | WordPress WPSmartContracts <1.3.12 - SQL Injection | wpsmartcontracts | 8.8 (v3.1) | High | 340016 , 380026 , 380122 |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2022-41840 | Welcart eCommerce <=2.7.7 - Local File Inclusion | welcart e-commerce | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-40881 | SolarView 6.00 - Remote Command Execution | solarview compact | 9.8 (v3.1) | Critical | 340029 , 344360 , 344370 , 393655 |
| CVE-2022-44384 | rConfig Vendors Auth File Upload RCE | rconfig | 8.8 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2022-3980 | Sophos Mobile managed on-premises - XML External Entity Injection | mobile | 9.8 (v3.1) | Critical | 344372 |
| CVE-2022-42118 | Liferay Portal - Cross-site Scripting | liferay portal | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2022-40843 | Tenda AC1200 V-W15Ev2 - Authentication Bypass | ac1200 v-w15ev2 | 4.9 (v3.1) | Medium | 390716 |
| CVE-2021-40272 | IRTS OP5 Monitor - Cross-Site Scripting | monitor | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-3484 | WordPress WPB Show Core - Cross-Site Scripting | wpb show core | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-3578 | WordPress ProfileGrid <5.1.1 - Cross-Site Scripting | profilegrid | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-44727 | PrestaShop lgcookieslaw - SQL Injection | eu cookie law gdpr | 9.1 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-3481 | NotificationX Dropshipping < 4.4 - SQL Injection | woocommerce dropshipping | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2022-42746 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42747 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42748 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42749 | CandidATS 3.0.0 - Cross-Site Scripting | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3800 | IBAX - SQL Injection | go-ibax | 8.8 (v3.1) | High | 344366 |
| CVE-2022-3254 | AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection | awp classifieds | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 |
| CVE-2022-40471 | Clinic\ | clinic's patient management system | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390501 , 390801 |
| CVE-2021-40661 | IND780 - Local File Inclusion | ind780 firmware | 7.5 (v3.1) | High | 340007 , 390716 |
| CVE-2022-2627 | WordPress Newspaper < 12 - Cross-Site Scripting | newspaper | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-3766 | phpMyFAQ < 3.1.8 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-31678 | VMWare Cloud Foundation NSX-V - XML External Entity (XXE) | cloud foundation | 9.1 (v3.1) | Critical | 344372 |
| CVE-2022-38580 | X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) | skipper | 9.8 (v3.1) | Critical | 337110 , 390727 , 392301 , 392648 , 398022 |
| CVE-2022-41358 | Garage Management System 1.0 (categoriesName) - Stored XSS | garage management system | 5.4 (v3.1) | Medium | 330791 , 340152 |
| CVE-2016-20016 | MVPower DVR Shell Unauthenticated Command Execution | tv-7104he firmware | 9.8 (v3.1) | Critical | 392647 |
| CVE-2016-20017 | D-Link DSL-2750B OS Command Injection | dsl-2750b firmware | 9.8 (v3.1) | Critical | 344362 , 392657 |
| CVE-2022-43014 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-43015 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-43016 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-43017 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-43018 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2022-21587 | Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload | e-business suite | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 , 390700 |
| CVE-2022-22242 | Juniper Web Device Manager - Cross-Site Scripting | junos | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-3552 | BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) | boxbilling | 7.2 (v3.1) | High | 340128 , 380018 |
| CVE-2022-3506 | WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting | related posts | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-42889 | Apache Commons Text RCE | commons text | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340014 , 340029 , 340087 , 340095 , 340193 , 344361 , 344363 , 344370 , 380026 , 393655 |
| CVE-2022-41473 | RPCMS 3.0.2 - Cross-Site Scripting | rpcms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2022-35155 | Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) | bus pass management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 390585 |
| CVE-2022-3062 | Simple File List < 4.4.12 - Cross Site Scripting | simple-file-list | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2022-38553 | Academy Learning Management System <5.9.1 - Cross-Site Scripting | academy learning management system | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-3236 | Sophos Firewall <= 19.0 MR1 - Remote Code Execution | firewall | 9.8 (v3.1) | Critical | 344361 , 344364 |
| CVE-2022-40359 | Kae's File Manager <=1.4.7 - Cross-Site Scripting | kfm | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2022-3242 | Microweber <1.3.2 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-2840 | Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi | zephyr project manager | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 341155 , 360147 , 360148 , 380122 |
| CVE-2022-35914 | GLPI htmLawed php command injection | glpi | 9.8 (v3.1) | Critical | 340011 , 340023 , 340128 , 344360 , 380018 , 390801 |
| CVE-2022-3142 | NEX-Forms Plugin < 7.9.7 - SQL Injection | nex-forms | 8.8 (v3.1) | High | 380122 |
| CVE-2022-2863 | WordPress WPvivid Backup <0.9.76 - Local File Inclusion | migration, backup, staging | 4.9 (v3.1) | Medium | 377360 |
| CVE-2022-40734 | Laravel Filemanager v2.5.1 - Local File Inclusion | laravel filemanager | 6.5 (v3.1) | Medium | 340007 |
| CVE-2022-38637 | Hospital Management System 1.0 - SQL Injection | hospital management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-38295 | Cuppa CMS v1.0 - Cross Site Scripting | cuppacms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-37299 | Shirne CMS 1.2.0 - Local File Inclusion | shirne cms | 6.5 (v3.1) | Medium | 340077 , 340162 , 340165 , 344360 , 347009 |
| CVE-2022-27593 | QNAP QTS Photo Station External Reference - Local File Inclusion | photo station | 9.1 (v3.1) | Critical | 340007 |
| CVE-2022-2633 | All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery | all-in-one video gallery | 8.2 (v3.1) | High | 340163 |
| CVE-2022-31814 | pfSense plugin pfBlockerNG unauthenticated RCE as root | pfblockerng | 9.8 (v3.1) | Critical | 340128 , 340362 , 360152 , 380018 , 390801 |
| CVE-2022-36642 | Omnia MPX 1.5.0+r1 - Local File Inclusion | omnia mpx node firmware | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 |
| CVE-2022-37122 | Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal | pcoweb hvac bacnet gateway | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-38812 | AeroCMS 0.1.1 - SQL Injection | aerocms | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-22897 | PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection | ap pagebuilder | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS - Remote Command Execution | hwl-2511-ss firmware | 9.8 (v3.1) | Critical | 344360 , 347009 , 390904 |
| CVE-2022-2599 | WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting | anti-malware security and brute-force firewall | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2022-38794 | Zaver - Local File Inclusion | zaver | 7.5 (v3.1) | High | 347009 |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection | emerge e3 firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2022-36804 | Bitbucket Git Command Injection | bitbucket | 8.8 (v3.1) | High | 390613 , 390614 |
| CVE-2022-31798 | Nortek Linear eMerge E3-Series - Cross-Site Scripting | emerge e3 firmware | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-37153 | Artica Proxy 4.30.000000 - Cross-Site Scripting | artica proxy | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2022-38463 | ServiceNow - Cross-Site Scripting | servicenow | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-24910 | WordPress Transposh Translation <1.0.8 - Cross-Site Scripting | transposh wordpress translation | 6.1 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2022-2383 | WordPress Feed Them Social <3.0.1 - Cross-Site Scripting | feed them social | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32772 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 341266 , 342259 |
| CVE-2022-37061 | FLIR AX8 unauthenticated RCE | flir ax8 firmware | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390801 |
| CVE-2022-1373 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2022-2334 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2020-14321 | Moodle Teacher Enrollment Privilege Escalation to RCE | moodle | 8.8 (v3.1) | High | 340128 , 360152 , 380018 , 390801 |
| CVE-2022-37042 | Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925) | zimbra collaboration suite | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390614 , 390626 , 390709 |
| CVE-2022-2733 | Openemr < 7.0.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-35493 | eShop 3.0.4 - Cross-Site Scripting | eshop - ecommerce / store website | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-1950 | Youzify < 1.2.0 - Unauthenticated SQLi | youzify | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-31181 | PrestaShop - SQL Injection to Eval Injection | prestashop | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 344362 , 360147 , 360148 , 390704 |
| CVE-2022-31188 | CVAT 2.0 - Server Side Request Forgery | computer vision annotation tool | 9.8 (v3.1) | Critical | 345493 |
| CVE-2022-1906 | WordPress Copyright Proof <=4.16 - Cross-Site-Scripting | copyright proof | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2414 | FreeIPA - XML Entity Injection | dogtagpki | 7.5 (v3.1) | High | 344372 |
| CVE-2022-34140 | Feehi CMS 2.1.1 - Remote Code Execution (Authenticated) | feehi cms | 5.4 (v3.1) | Medium | 330791 , 340152 , 345493 |
| CVE-2022-34121 | CuppaCMS v1.0 - Local File Inclusion | cuppacms | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-33965 | WordPress Visitor Statistics <=5.7 - SQL Injection | wp visitor statistics | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-36446 | Webmin Package Updates RCE | webmin | 9.8 (v3.1) | Critical | 341245 , 344364 , 392301 , 393655 |
| CVE-2022-2219 | Unyson < 2.7.27 - Cross Site Scripting | unyson | 7.2 (v3.1) | High | 341266 , 346755 |
| CVE-2022-0899 | Header Footer Code Manager < 1.1.24 - Cross-Site Scripting | header footer code manager | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-35653 | Moodle LTI module Reflected - Cross-Site Scripting | moodle | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-2143 | Advantech iView NetworkServlet Command Injection | iview | 9.8 (v3.1) | Critical | 337209 , 337211 , 340007 , 340014 , 340193 , 344360 , 344364 , 347009 , 390703 , 390709 |
| CVE-2022-33901 | WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read | multisafepay plugin for woocommerce | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2022-29495 | WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery | popup builder | 4.3 (v3.1) | Medium | 345490 , 377360 |
| CVE-2022-28666 | Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update | custom product tabs for woocommerce | 5.3 (v3.1) | Medium | 392301 |
| CVE-2022-2486 | Wavlink WN535K2/WN535K3 - OS Command Injection | wl-wn535k2 | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 , 344370 |
| CVE-2022-2488 | Wavlink WN535K2/WN535K3 - OS Command Injection | wl-wn535k2 firmware | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 |
| CVE-2022-34045 | WAVLINK WN530HG4 - Improper Access Control | wl-wn530hg4 firmware | 9.8 (v3.1) | Critical | 390716 |
| CVE-2022-34590 | Hospital Management System 1.0 - SQL Injection | hospital management system | 7.2 (v3.1) | High | 340145 , 340156 |
| CVE-2022-34048 | Wavlink WN-533A8 - Cross-Site Scripting | wn533a8 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2022-2467 | Garage Management System 1.0 - SQL Injection | garage management system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-35405 | Zoho Password Manager Pro XML-RPC Java Deserialization | manageengine access manager plus | 9.8 (v3.1) | Critical | 344361 , 344363 , 392301 |
| CVE-2022-33891 | Apache Spark Unauthenticated Command Injection RCE | spark | 8.8 (v3.1) | High | 344361 , 344362 , 344363 |
| CVE-2022-26352 | DotCMS RCE via Arbitrary File Upload. | dotcms | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-40150 | Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure | e1 zoom firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2022-1933 | WordPress CDI <5.1.9 - Cross Site Scripting | collect and deliver interface for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2168 | WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting | download manager | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2022-2187 | WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting | contact form 7 captcha | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-40149 | Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure | e1 zoom | 5.9 (v3.1) | Medium | 390716 |
| CVE-2022-32409 | Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion | i3geo | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-34093 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-34094 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-2297 | Clinic\ | clinic's patient management system | 8.8 (v3.1) | High | 330791 , 334168 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2022-1057 | WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection | pricing deals for woocommerce | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2022-1952 | WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload | free booking plugin for hotels, restaurant and car rental | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-1910 | WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting | shortcodes and extra features for phlox theme | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1937 | WordPress Awin Data Feed <=1.6 - Cross-Site Scripting | awin data feed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-35416 | H3C SSL VPN <=2022-07-10 - Cross-Site Scripting | ssl vpn | 6.1 (v3.1) | Medium | 342259 , 346755 |
| CVE-2022-31137 | Roxy-WI < 6.1.1.0 - Remote Code Execution | roxy-wi | 9.8 (v3.1) | Critical | 340023 , 340029 , 344360 , 344361 , 344363 |
| CVE-2022-34876 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High | 340006 , 340007 , 340016 , 340156 , 341245 , 344360 , 344370 , 347009 , 390709 , 390719 |
| CVE-2022-34877 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High | 340006 , 340007 , 340016 , 340156 , 341245 , 344360 , 344370 , 347009 , 390709 , 390719 |
| CVE-2022-34878 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High | 340006 , 340007 , 340016 , 340156 , 341245 , 344360 , 344370 , 347009 , 390709 , 390719 |
| CVE-2022-0250 | Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting | redirection for contact form 7 | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1946 | WordPress Gallery <2.0.0 - Cross-Site Scripting | gallery | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2290 | Trilium <0.52.4 - Cross-Site Scripting | trilium | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2022-32094 | Hospital Management System 1.0 - SQL Injection | hospital management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-31056 | GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration) | glpi | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-41460 | ECShop 4.1.0 - SQL Injection | ecshop | 7.5 (v3.1) | High | 340157 , 340159 , 360147 , 360148 |
| CVE-2022-1574 | WordPress HTML2WP <=1.0.0 - Arbitrary File Upload | html2wp | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-1904 | WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting | easy pricing tables | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1916 | WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting | woot | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-1029 | Limit Login Attempts - Stored Cross-Site Scripting | limit login attempts | 4.8 (v3.1) | Medium | 377360 |
| CVE-2022-34305 | Apache Tomcat Examples Web Application - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-34328 | PMB 7.3.10 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29299 | SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting | solarview compact firmware | N/A | N/A | 341266 |
| CVE-2022-29301 | SolarView Compact 6.00 - 'pow' Cross-Site Scripting | - | N/A | N/A | 341266 |
| CVE-2022-2174 | microweber 1.2.18 - Cross-site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-31373 | SolarView Compact 6.00 - Cross-Site Scripting | sv-cpt-mc310 firmware | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-33119 | NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting | nvrsolo firmware | 6.1 (v3.1) | Medium | 340003 , 340158 , 342259 |
| CVE-2021-25104 | WordPress Ocean Extra <1.9.5 - Cross-Site Scripting | ocean extra | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2022-2130 | Microweber < 1.2.17 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-31062 | GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion | glpi inventory | 5.3 (v3.1) | Medium | 340007 , 344360 |
| CVE-2022-31299 | Haraj 3.7 - Cross-Site Scripting | haraj | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2022-0786 | WordPress KiviCare <2.3.9 - SQL Injection | kivicare | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0827 | WordPress Best Books <=2.6.3 - SQL Injection | bestbooks | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2022-1768 | WordPress RSVPMaker <=9.3.2 - SQL Injection | rsvpmaker | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2022-1724 | WordPress Simple Membership <4.1.1 - Cross-Site Scripting | simple membership | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1756 | Newsletter < 7.4.5 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-41749 | CraftCMS SEOmatic - Server-Side Template Injection | seomatic | 9.8 (v3.1) | Critical | 390719 |
| CVE-2022-29013 | Razer Sila Gaming Router - Remote Code Execution | sila | 9.8 (v3.1) | Critical | 392301 |
| CVE-2019-25066 | Ajenti auth username Command Injection | ajenti | 8.8 (v3.1) | High | 344364 , 344366 |
| CVE-2022-29014 | Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion | sila firmware | 7.5 (v3.1) | High | 344360 |
| CVE-2022-32195 | Open edX <2022-06-06 - Cross-Site Scripting | open edx | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2022-0788 | WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection | wp fundraising donation and crowdfunding platform | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 , 390727 , 392648 |
| CVE-2022-1597 | WordPress WPQA <5.4 - Cross-Site Scripting | wpqa builder | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-37589 | Virtua Software Cobranca 12S - SQLi | cobranca | 7.5 (v3.1) | High | 340156 , 341145 , 341245 |
| CVE-2022-31470 | Axigen WebMail - Cross-Site Scripting | webmail | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-29296 | Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS) | genialcloud proj | 6.1 (v3.1) | Medium | 344370 |
| CVE-2022-26134 | Confluence - Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical | 337209 , 337211 , 340087 |
| CVE-2022-31340 | simple inventory system SQL Injection Vulnerability | simple inventory system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-31976 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31977 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31978 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31339 | simple inventory system SQL Injection Vulnerability | simple inventory system | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-31974 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-31975 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-31984 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2022-32007 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32015 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32018 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32022 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340156 |
| CVE-2022-32024 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32025 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32026 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32028 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-30513 | School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting | school dormitory management system | 6.1 (v3.1) | Medium | 392301 |
| CVE-2022-30514 | School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting | school dormitory management system | 6.1 (v3.1) | Medium | 346755 , 392301 |
| CVE-2022-26833 | Open Automation Software OAS Platform V16.00.0121 - Missing Authentication | oas platform | 9.4 (v3.1) | Critical | 390726 , 392647 |
| CVE-2022-1883 | Terraboard <2.2.0 - SQL Injection | terraboard | 8.8 (v3.1) | High | 341245 |
| CVE-2022-0781 | WordPress Nirweb Support <2.8.2 - SQL Injection | nirweb support | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0346 | WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution | xml sitemap generator | 6.1 (v3.1) | Medium | 333141 , 340165 , 341256 , 342259 , 344370 , 346755 , 347198 , 350148 |
| CVE-2022-1221 | WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting | gwyn's imagemap selector | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29004 | Diary Management System 1.0 - Cross-Site Scripting | e-diary management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-29005 | Online Birth Certificate System 1.2 - Stored Cross-Site Scripting | online birth certificate system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-0867 | WordPress ARPrice <3.6.1 - SQL Injection | pricing table | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1398 | External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery | external media without import | 6.5 (v3.1) | Medium | 377360 |
| CVE-2022-30776 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 |
| CVE-2022-30777 | Parallels H-Sphere 3.6.1713 - Cross-Site Scripting | h-sphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0873 | WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting | gmedia gallery | 4.8 (v3.1) | Medium | 377360 |
| CVE-2022-29383 | NETGEAR ProSafe SSL VPN firmware - SQL Injection | ssl312 firmware | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 |
| CVE-2022-30489 | Wavlink WN-535G3 - Cross-Site Scripting | wn535g3 firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29303 | SolarView Compact 6.0 - OS Command Injection | sv-cpt-mc310 firmware | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 393655 |
| CVE-2022-30525 | Zyxel Firewall - OS Command Injection | usg flex 100w firmware | 9.8 (v3.1) | Critical | 344363 |
| CVE-2022-29298 | SolarView Compact 6.00 - Local File Inclusion | sv-cpt-mc310 firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2022-29006 | Directory Management System 1.0 - SQL Injection | directory management system | 9.8 (v3.1) | Critical | 340145 , 340156 |
| CVE-2022-29007 | Dairy Farm Shop Management System 1.0 - SQL Injection | dairy farm shop management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-29316 | Complete Online Job Search System 1.0 - Cross-Site Scripting | complete online job search system | 9.8 (v3.1) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-1453 | RSVPMaker <= 9.2.5 - SQL Injection | rsvpmaker | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-0592 | MapSVG < 6.2.20 - Unauthenticated SQLi | mapsvg | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2022-0814 | Ubigeo de Peru < 3.6.4 - SQL Injection | ubigeo de peru para woocommerce | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0817 | WordPress BadgeOS <=3.7.0 - SQL Injection | badgeos | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0826 | WordPress WP Video Gallery <=1.7.1 - SQL Injection | wp-video-gallery-free | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0948 | WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection | order listener for woocommerce | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-1013 | WordPress Personal Dictionary <1.3.4 - Blind SQL Injection | personal dictionary | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-27412 | Explore CMS 1.0 - SQL Injection | explore cms | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2022-24899 | Contao <4.13.3 - Cross-Site Scripting | contao | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-1388 | F5 BIG-IP iControl RCE via REST Authentication Bypass | big-ip access policy manager | 9.8 (v3.1) | Critical | 344361 , 344363 , 392767 , 393655 |
| CVE-2022-28079 | College Management System 1.0 - 'course_code' SQL Injection (Authenticated) | college management system | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 345493 , 360147 , 360148 , 390572 |
| CVE-2022-28080 | Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated) | event management system | 8.8 (v3.1) | High | 330791 , 340016 , 340017 , 340144 , 340145 , 340152 , 340156 , 340157 , 341145 , 341245 , 345493 , 360147 , 360148 , 390572 |
| CVE-2022-28508 | MantisBT < 2.25.2 - Cross-Site Scripting | mantisbt | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0773 | Documentor <= 1.5.3 - Unauthenticated SQL Injection | documentor | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0783 | Multiple Shipping Address Woocommerce < 2.0 - SQL Injection | multiple shipping addresses for woocommerce | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1281 | Photo Gallery WordPress v1.6.3 - SQL Injection | photo gallery | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 |
| CVE-2021-40822 | Geoserver - Server-Side Request Forgery | geoserver | 7.5 (v3.1) | High | 340007 |
| CVE-2022-24900 | Piano LED Visualizer 1.3 - Local File Inclusion | piano led visualizer | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-27984 | Cuppa CMS v1.0 - SQL injection | cuppacms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-27985 | Cuppa CMS v1.0 - SQL injection | cuppacms | 9.8 (v3.1) | Critical | 340017 , 341245 |
| CVE-2022-29806 | ZoneMinder Language Settings Remote Code Execution | zoneminder | 9.8 (v3.1) | Critical | 340007 , 344360 , 344370 , 347009 , 390709 |
| CVE-2022-26564 | HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-45837 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 9.8 (v3.1) | Critical | 340006 , 340007 , 340029 , 344360 , 344364 , 347009 , 390709 , 390719 |
| CVE-2022-0693 | WordPress Master Elements <=8.0 - SQL Injection | master elements | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0769 | Users Ultra <= 3.1.0 - SQL Injection | users ultra | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1390 | WordPress Admin Word Count Column 2.2 - Local File Inclusion | admin word count column | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-1391 | WordPress Cab fare calculator < 1.0.4 - Local File Inclusion | cab fare calculator | 9.8 (v3.1) | Critical | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2022-29078 | Node.js Embedded JavaScript 3.1.6 - Template Injection | ejs | 9.8 (v3.1) | Critical | 340014 , 340193 , 344370 , 345240 , 380026 |
| CVE-2021-25094 | Tatsu Wordpress Plugin RCE | tatsu | 8.1 (v3.1) | High | 330791 , 334168 , 340152 , 382238 |
| CVE-2021-45841 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 8.1 (v3.1) | High | 340006 , 340007 , 340029 , 344360 , 344364 , 347009 , 390709 , 390719 |
| CVE-2021-35250 | SolarWinds Serv-U 15.3 - Directory Traversal | serv-u | 7.5 (v3.1) | High | 340007 |
| CVE-2022-0656 | uDraw <3.3.3 - Local File Inclusion | [web to print shop](vendors/webtoprint/web-to-print-shop.md) | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2021-45839 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 6.5 (v3.1) | Medium | 340006 , 340007 , 340029 , 344360 , 344364 , 347009 , 390709 , 390719 |
| CVE-2022-28290 | WordPress Country Selector <1.6.6 - Cross-Site Scripting | wordpress country selector | 6.1 (v3.1) | Medium | 340130 , 346755 |
| CVE-2022-1439 | Microweber <1.2.15 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 346755 , 347198 , 350148 |
| CVE-2022-27925 | Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925) | zimbra collaboration suite | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-27926 | Zimbra Collaboration (ZCS) - Cross Site Scripting | collaboration | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-29548 | WSO2 - Cross-Site Scripting | api manager | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-27927 | Microfinance Management System 1.0 - 'customer_number' SQLi | microfinance management system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390572 , 393655 |
| CVE-2022-1329 | Wordpress Plugin Elementor Authenticated Upload Remote Code Execution | website builder | 8.8 (v3.1) | High | 330791 , 340152 , 377360 |
| CVE-2022-1119 | WordPress Simple File List <3.2.8 - Local File Inclusion | simple-file-list | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2022-0785 | WordPress Daily Prayer Time <2022.03.01 - SQL Injection | daily prayer time | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-29464 | WSO2 Arbitrary File Upload to RCE | api manager | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2022-28810 | ManageEngine ADSelfService Plus Custom Script Execution | manageengine adselfservice plus | 6.8 (v3.1) | Medium | 340007 , 340014 , 340029 , 340193 , 344360 , 347009 , 390709 |
| CVE-2021-25120 | Easy Social Feed < 6.2.7 - Cross-Site Scripting | easy social feed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-0879 | Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting | caldera forms | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 344361 , 344364 , 346755 , 347198 , 350148 |
| CVE-2022-0765 | WordPress Loco Translate < 2.6.1 - Cross-Site Scripting | loco translate | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-27043 | Yearning - Directory Traversal | yearning | 7.5 (v3.1) | High | 347009 , 347019 , 390709 , 390716 |
| CVE-2021-43287 | Pre-Auth Takeover of Build Pipelines in GoCD | gocd | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-24816 | GeoServer <1.2.2 - Remote Code Execution | jai-ext | 10.0 (v3.1) | Critical | 337209 , 337210 , 337211 , 340121 , 344360 , 344370 , 380026 |
| CVE-2022-22956 | VMware Workspace ONE Access VMSA-2022-0011 exploit chain | identity manager | 9.8 (v3.1) | Critical | 392647 |
| CVE-2022-22957 | VMware Workspace ONE Access VMSA-2022-0011 exploit chain | cloud foundation | 7.2 (v3.1) | High | 392647 |
| CVE-2021-31805 | Apache Struts2 S2-062 - Remote Code Execution | struts | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2022-28032 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-28033 | Atom.CMS 2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2021-37291 | KevinLAB BEMS 1.0 - SQL Injection | 4st l-bems | 9.8 (v3.1) | Critical | 340156 , 341245 |
| CVE-2022-0949 | WordPress Stop Bad Bots <6.930 - SQL Injection | block and stop bad bots | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-22954 | VMware Workspace ONE Access CVE-2022-22954 | identity manager | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 , 344370 , 393655 |
| CVE-2021-24987 | WordPress Super Socializer <7.13.30 - Cross-Site Scripting | super socializer | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-0271 | LearnPress <4.1.6 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-1007 | WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting | advanced booking calendar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-28363 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-43421 | Studio-42 elFinder <2.1.60 - Arbitrary File Upload | elfinder | 9.8 (v3.1) | Critical | 393781 |
| CVE-2021-46419 | Telesquare TLR-2855KS6 - Arbitrary File Deletion | tlr-2855ks6 firmware | 9.1 (v3.1) | Critical | 392301 , 393134 |
| CVE-2021-46417 | Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI) | colibri firmware | 7.5 (v3.1) | High | 340007 , 344360 , 347009 |
| CVE-2021-46418 | Telesquare TLR-2855KS6 - Arbitrary File Creation | tlr-2855ks6 | 7.5 (v3.1) | High | 392301 |
| CVE-2022-26585 | Mingsoft MCMS v5.2.7 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340156 , 340157 , 360147 , 360148 |
| CVE-2022-28219 | ManageEngine ADAudit Plus CVE-2022-28219 | manageengine adaudit plus | 9.8 (v3.1) | Critical | 330791 , 340007 , 340152 , 344360 , 344370 , 347009 , 380018 , 390709 |
| CVE-2022-25356 | Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection | securitygateway | 5.3 (v3.1) | Medium | 390716 |
| CVE-2022-0864 | UpdraftPlus < 1.22.9 - Cross-Site Scripting | updraftplus | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1168 | WordPress WP JobSearch <1.5.1 - Cross-Site Scripting | jobsearch wp job board | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-1170 | JobMonster < 4.5.2.9 - Cross-Site Scripting | jobmonster | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-26233 | Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion | control room management suite | 7.5 (v3.1) | High | 347019 |
| CVE-2022-22963 | Spring Cloud Function SpEL Injection | spring cloud function | 9.8 (v3.1) | Critical | 340011 |
| CVE-2021-26599 | ImpressCMS < 1.4.3 - SQL Injection | impresscms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-0479 | Popup Builder Plugin - SQL Injection and Cross-Site Scripting | popup builder | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 377360 |
| CVE-2022-0679 | WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion | narnoo distributor | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2022-0784 | WordPress Title Experiments Free <9.0.1 - SQL Injection | title experiments free | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0787 | Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection | limit login attempts | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0846 | SpeakOut Email Petitions < 2.14.15.1 - SQL Injection | speakout! email petitions | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-26271 | 74cmsSE v3.4.1 - Arbitrary File Read | 74cms | 7.5 (v3.1) | High | 340007 |
| CVE-2021-43725 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-0599 | WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting | mapping multiple urls redirect same page | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-4191 | GitLab GraphQL API User Enumeration | gitlab | 5.3 (v3.1) | Medium | 330791 , 340152 , 344361 , 344363 |
| CVE-2022-1040 | Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass | sfos | 9.8 (v3.1) | Critical | 345493 |
| CVE-2021-20323 | Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting | keycloak | 6.1 (v3.1) | Medium | 333141 , 341258 |
| CVE-2022-0739 | Wordpress BookingPress bookingpress_front_get_category_services SQLi | bookingpress | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 |
| CVE-2022-0747 | Infographic Maker iList < 4.3.8 - SQL Injection | infographic maker | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0760 | WordPress Simple Link Directory <7.7.2 - SQL injection | simple link directory | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-26960 | elFinder <=2.1.60 - Local File Inclusion | elfinder | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 , 393781 |
| CVE-2022-23347 | BigAnt Server v5.6.06 - Local File Inclusion | bigant server | 7.5 (v3.1) | High | 340007 |
| CVE-2022-24637 | Open Web Analytics 1.7.3 - Remote Code Execution (RCE) | open web analytics | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390801 |
| CVE-2021-46107 | Ligeo Archives Ligeo Basics - Server Side Request Forgery | ligeo basics | 7.5 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2022-25488 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-25485 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 7.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-25486 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 7.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-0954 | Microweber <1.2.11 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-25489 | Atom CMS v2.0 - Cross-Site Scripting | atomcms | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-25497 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2021-25003 | WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution | wpcargo track & trace | 9.8 (v3.1) | Critical | 331324 |
| CVE-2022-0169 | WordPress Photo Gallery Plugin SQL Injection (CVE-2022-0169) | photo gallery | 9.8 (v3.1) | Critical | 340016 , 340017 , 340156 , 360147 , 360148 |
| CVE-2022-0658 | CommonsBooking < 2.6.8 - SQL Injection | commonsbooking | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-24940 | WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting | persian-woocommerce | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0147 | WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting | wp-gdpr-compliance | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-24384 | SmarterTools SmarterTrack - Cross-Site Scripting | smartertrack | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 |
| CVE-2021-24966 | WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) | error log viewer | 4.9 (v3.1) | Medium | 336461 , 344360 , 381206 |
| CVE-2021-32478 | Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect | moodle | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2022-0928 | Microweber < 1.2.12 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-33851 | WordPress Customize Login Image <3.5.3 - Cross-Site Scripting | customize login image | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-24734 | MyBB Admin Control Code Injection RCE | mybb | 7.2 (v3.1) | High | 340095 , 340128 , 346755 , 390801 |
| CVE-2022-24716 | Icingaweb Directory Traversal in Static Library File Requests | icinga web 2 | 7.5 (v3.1) | High | 347009 , 390716 |
| CVE-2022-0349 | WordPress NotificationX <2.3.9 - SQL Injection | notificationx | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-0434 | WordPress Page Views Count <2.4.15 - SQL Injection | page view count | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-0439 | Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection | email subscribers & newsletters | 8.8 (v3.1) | High | 340016 , 377360 , 380122 |
| CVE-2022-0429 | WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting | wp cerber security, anti-spam & malware scan | 6.1 (v3.1) | Medium | 347198 |
| CVE-2022-0533 | Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2022-0535 | WordPress E2Pdf <1.16.45 - Cross-Site Scripting | e2pdf | 4.8 (v3.1) | Medium | 377360 |
| CVE-2022-26318 | WatchGuard XTM Firebox Unauthenticated Remote Command Execution | fireware | 9.8 (v3.1) | Critical | 340362 |
| CVE-2021-46381 | DLINK DAP-1620 A1 v1.01 - Directory Traversal | dap-1620 firmware | 7.5 (v3.1) | High | 344360 , 390709 , 390726 , 392301 , 392647 |
| CVE-2022-23397 | Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting | ez-net portal | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 341256 , 346755 , 347198 |
| CVE-2022-22947 | Spring Cloud Gateway Remote Code Execution | spring cloud gateway | 10.0 (v3.1) | Critical | 330791 , 337209 , 337210 , 337211 , 340029 , 340152 , 344361 , 344370 , 393655 |
| CVE-2022-23898 | MCMS 5.2.5 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340156 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-25125 | MCMS 5.2.4 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-0824 | Webmin File Manager RCE | webmin | 8.8 (v3.1) | High | 340128 , 340133 , 360152 , 380018 , 390801 , 392647 |
| CVE-2021-4039 | Zyxel NWA-1100-NH - Command Injection | nwa1100-nh firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High | 340087 , 340128 , 344365 , 344370 , 360152 , 380018 , 390722 , 390801 , 390904 |
| CVE-2021-46387 | Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) | zywall 2 plus internet security appliance firmware | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 |
| CVE-2022-0412 | WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection | ti woocommerce wishlist | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2020-36510 | WordPress 15Zine <3.3.0 - Cross-Site Scripting | 15zine | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-25112 | WordPress WHMCS Bridge <6.4b - Cross-Site Scripting | whmcs bridge | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0189 | WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting | wp rss aggregator | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2022-0377 | WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming | learnpress | 4.3 (v3.1) | Medium | 340007 , 345493 |
| CVE-2021-44567 | RosarioSIS 7.6 - SQL Injection | rosariosis | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-25082 | TOTOLink - Unauthenticated Command Injection | a950rg firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2020-27467 | Processwire CMS <2.7.1 - Local File Inclusion | processwire | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2022-0653 | Wordpress Profile Builder Plugin Cross-Site Scripting | profile builder | 6.1 (v3.1) | Medium | 340112 |
| CVE-2021-25082 | WordPress Popup Builder < 4.0.7 - Remote Code Execution | popup builder | 8.8 (v3.1) | High | 340162 , 340165 , 377360 , 390904 , 398007 |
| CVE-2022-0228 | Popup Builder < 4.0.7 - SQL Injection | popup builder | 7.2 (v3.1) | High | 340017 , 380026 , 380122 |
| CVE-2021-25055 | WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting | feedwordpress | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-0234 | WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting | woocs | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25075 | WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting | duplicate page or post | 3.5 (v3.1) | Low | 346755 , 377360 |
| CVE-2022-0678 | Microweber <1.2.11 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0666 | Microweber < 1.2.11 - CRLF Injection | microweber | 7.5 (v3.1) | High | 330708 , 390722 |
| CVE-2022-25323 | ZEROF Web Server 2.0 - Cross-Site Scripting | web server | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-45382 | D-Link - Remote Command Execution | dir-820l firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-24086 | Adobe Commerce (Magento) - Remote Code Execution | commerce | 9.8 (v3.1) | Critical | 344360 , 344370 |
| CVE-2022-25241 | FileCloud 21.2 - Cross-Site Request Forgery (CSRF) | filecloud | 8.8 (v3.1) | High | 345490 |
| CVE-2021-35380 | TermTalk Server 3.24.0.2 - Local File Inclusion | termtalk server | 7.5 (v3.1) | High | 340007 |
| CVE-2021-43734 | kkFileview v4.0.0 - Local File Inclusion | kkfileview | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2022-0201 | WordPress Permalink Manager <2.2.15 - Cross-Site Scripting | permalink manager lite | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-0206 | WordPress NewStatPress <1.3.6 - Cross-Site Scripting | newstatpress | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0208 | WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting | mappress | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-0212 | WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting | spidercalendar | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2022-24112 | APISIX Admin API default access token RCE | apisix | 9.8 (v3.1) | Critical | 344364 , 344366 , 344370 |
| CVE-2022-20705 | Cisco RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical | 340006 , 340007 , 340029 , 344360 , 344364 , 344370 , 390709 , 390719 |
| CVE-2022-20707 | Cisco RV Series Authentication Bypass and Command Injection | rv340 firmware | 7.3 (v3.1) | High | 340006 , 340007 , 340029 , 344360 , 344364 , 344370 , 390709 , 390719 |
| CVE-2022-0020 | Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) | cortex xsoar | 5.4 (v3.1) | Medium | 330791 , 333141 , 340152 , 341256 , 342259 , 346755 |
| CVE-2022-22536 | SAP Memory Pipes (MPI) Desynchronization | content server | 10.0 (v3.1) | Critical | 392301 |
| CVE-2021-25114 | WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection | paid memberships pro | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2021-24947 | WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read | responsive vector maps | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2021-24878 | SupportCandy < 2.2.7 - Reflected Cross-Site Scripting | supportcandy | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-0149 | WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting | store exporter for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-0148 | WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting | mystickyelements | 5.4 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0437 | karma-runner DOM-based Cross-Site Scripting | karma | 6.1 (v3.1) | Medium | 340112 , 346755 , 350148 |
| CVE-2022-24260 | VoipMonitor - Pre-Auth SQL Injection | voipmonitor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2021-46398 | FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) | filebrowser | 8.8 (v3.1) | High | 345490 , 345493 |
| CVE-2022-0381 | WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting | embed swagger | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-43062 | Fortinet FortiMail 7.0.1 - Cross-Site Scripting | fortimail | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-24762 | WordPress Perfect Survey <1.5.2 - SQL Injection | perfect survey | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-43510 | Sourcecodester Simple Client Management System 1.0 - SQL Injection | simple client management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-24223 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 340016 , 340156 , 380122 |
| CVE-2021-24926 | WordPress Domain Check <1.0.17 - Cross-Site Scripting | domain check | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24934 | Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting | visual css style editor | 6.1 (v3.1) | Medium | 341266 |
| CVE-2021-25063 | WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting | contact form 7 skins | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25085 | WOOF WordPress plugin - Cross-Site Scripting | woocommerce products filter | 6.1 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2021-34805 | FAUST iServer 9.0.018.018.4 - Local File Inclusion | faust iserver | 7.5 (v3.1) | High | 344365 , 347019 , 390716 |
| CVE-2022-24264 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-24265 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 341245 , 344370 , 380026 , 380122 |
| CVE-2022-24266 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2022-24124 | Casdoor 1.13.0 - Unauthenticated SQL Injection | casdoor | 7.5 (v3.1) | High | 341245 |
| CVE-2022-0378 | Microweber Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-0332 | Moodle 3.11.4 - SQL Injection | moodle | 9.8 (v3.1) | Critical | 340017 , 340157 , 341245 , 344361 , 360147 , 360148 , 380026 , 390727 , 392301 , 392648 |
| CVE-2021-25008 | The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting | code snippets | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25074 | WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect | webp converter for media | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2021-25078 | Affiliates Manager < 2.9.0 - Cross Site Scripting | affiliates manager | 6.1 (v3.1) | Medium | 347198 |
| CVE-2021-25079 | Contact Form Entries < 1.2.4 - Cross-Site Scripting | contact form entries | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-45380 | AppCMS - Cross-Site Scripting | appcms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-23808 | phpMyAdmin < 5.1.2 - Cross-Site Scripting | phpmyadmin | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-35587 | Oracle Access Manager unauthenticated Remote Code Execution | access manager | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2021-46104 | webp_server_go 0.4.0 - Path Traversal | webp server go | 7.5 (v3.1) | High | 390709 |
| CVE-2021-26247 | Cacti - Cross-Site Scripting | cacti | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46005 | Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting | car rental management system | 5.4 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24838 | WordPress AnyComment <0.3.5 - Open Redirect | anycomment | 6.1 (v3.1) | Medium | 390145 |
| CVE-2021-25065 | Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting | smash balloon social post feed | 5.4 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-25067 | Landing Page Builder < 1.4.9.6 - Cross-Site Scripting | landing page | 5.4 (v3.1) | Medium | 333141 , 347198 |
| CVE-2021-42551 | NetBiblio WebOPAC - Cross-Site Scripting | netbiblio | 6.1 (v3.1) | Medium | 341245 , 344370 , 346755 |
| CVE-2021-45422 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0087 | Keystone 6 Login Page - Open Redirect and Cross-Site Scripting | keystone | 6.1 (v3.1) | Medium | 333140 , 346755 , 350148 |
| CVE-2021-28377 | Joomla! ChronoForums 2.0.11 - Local File Inclusion | chronoforums | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-25052 | WordPress Button Generator <2.3.3 - Remote File Inclusion | button generator | 8.8 (v3.1) | High | 340464 , 340465 |
| CVE-2021-24862 | Wordpress RegistrationMagic task_ids Authenticated SQLi | registrationmagic | 7.2 (v3.1) | High | 340016 , 340156 , 380122 |
| CVE-2022-21661 | WordPress Core 5.8.2 - 'WP_Query' SQL Injection | WordPress | 7.5 (v3.1) | High | 345493 |
| CVE-2021-46068 | Vehicle Service Management System - Stored Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46069 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2021-46071 | ehicle Service Management System 1.0 - Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46072 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46073 | Vehicle Service Management System 1.0 - Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-31589 | BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting | appliance base software | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2021-45428 | Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload | tlr-2005ksh | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-24786 | Download Monitor < 4.4.5 - SQL Injection | download monitor | 7.2 (v3.1) | High | 380026 , 380122 |
| CVE-2021-25016 | Chaty < 2.8.2 - Cross-Site Scripting | chaty | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-24991 | WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting | woocommerce pdf invoices& packing slips | 4.8 (v3.1) | Medium | 347198 |
| CVE-2021-20158 | Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change | tew-827dru firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-20167 | Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun | rax43 firmware | 8.0 (v3.1) | High | 392301 |
| CVE-2021-20150 | Trendnet AC2600 TEW-827DRU - Credentials Disclosure | tew-827dru firmware | 5.3 (v3.1) | Medium | 392301 |
| CVE-2021-45425 | SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) | safari montage | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24979 | Paid Memberships Pro < 2.6.6 - Cross-Site Scripting | paid memberships pro | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-21881 | Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection | premierwave 2050 firmware | 9.9 (v3.1) | Critical | 340014 , 344363 , 344370 |
| CVE-2021-24849 | WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection | frontend manager for woocommerce along with bookings subscription listings compatible | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2021-24750 | WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection | wp visitor statistics (real time traffic) | 8.8 (v3.1) | High | 340016 , 340017 , 360147 , 360148 |
| CVE-2021-24956 | Blog2Social < 6.8.7 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-43831 | Gradio < 2.5.0 - Arbitrary File Read | gradio | 7.7 (v3.1) | High | 347009 |
| CVE-2021-45043 | HD-Network Realtime Monitoring System 2.0 - Local File Inclusion | hd-network real-time monitoring system | 7.5 (v3.1) | High | 344360 |
| CVE-2021-36450 | Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting | workforce optimization | 6.1 (v3.1) | Medium | 350147 |
| CVE-2021-45046 | Apache Log4j2 - Remote Code Injection | log4j | 9.0 (v3.1) | Critical | 345115 , 345117 , 345118 , 393655 |
| CVE-2021-39312 | WordPress True Ranker <2.2.4 - Local File Inclusion | true ranker | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2021-3831 | Gnuboard 5 - Cross-Site Scripting | gnuboard5 | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-42063 | SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting | knowledge warehouse | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24946 | WordPress Modern Events Calendar SQLi Scanner | modern events calendar lite | 9.8 (v3.1) | Critical | 340016 , 340017 , 340156 , 360147 , 360148 , 380122 |
| CVE-2021-24970 | WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion | all-in-one video gallery | 7.2 (v3.1) | High | 377360 |
| CVE-2021-44228 | VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell) | 6bk1602-0aa12-0tp0 firmware | 10.0 (v3.1) | Critical | 345115 , 345117 , 345118 , 393655 |
| CVE-2021-20137 | Gryphon Tower - Cross-Site Scripting | gryphon tower | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-20038 | SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution | sma 200 firmware | 9.8 (v3.1) | Critical | 340193 |
| CVE-2021-20039 | SonicWall SMA 100 Series Authenticated Command Injection | sma 200 firmware | 8.8 (v3.1) | High | 344364 , 344366 |
| CVE-2021-43798 | Grafana v8.x - Arbitrary File Read | grafana | 7.5 (v3.1) | High | 347009 |
| CVE-2021-42567 | Apereo CAS Cross-Site Scripting | central authentication service | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350148 |
| CVE-2021-43810 | Admidio - Cross-Site Scripting | admidio | 6.1 (v3.1) | Medium | 340112 , 350148 , 390722 |
| CVE-2021-24931 | Wordpress Secure Copy Content Protection and Content Locking sccp_id Unauthenticated SQLi | secure copy content protection and content locking | 9.8 (v3.1) | Critical | 340016 , 340156 , 380122 |
| CVE-2021-24943 | Registrations for the Events Calendar < 2.7.6 - SQL Injection | registrations for the events calendar | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-23758 | AjaxPro Deserialization Remote Code Execution | ajaxpro.2 | 9.8 (v3.1) | Critical | 344380 |
| CVE-2021-24915 | Contest Gallery < 13.1.0.6 - SQL injection | contest gallery | 9.8 (v3.1) | Critical | 340017 , 340144 , 340157 , 344361 |
| CVE-2021-44077 | ManageEngine ServiceDesk Plus CVE-2021-44077 | manageengine servicedesk plus | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2021-24876 | Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting | registrations for the events calendar | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2021-43778 | GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability. | barcode | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24644 | Images to WebP < 1.9 - Authenticated Local File Inclusion | images to webp | 7.5 (v3.1) | High | 340007 , 377360 |
| CVE-2021-24875 | WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting | ecommerce product catalog | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2021-22053 | Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution | spring cloud netflix | 8.8 (v3.1) | High | 337209 , 337211 , 340087 , 340193 |
| CVE-2021-41569 | SAS/Internet 9.4 1520 - Local File Inclusion | sas/intrnet | 7.5 (v3.1) | High | 344360 , 347009 |
| CVE-2021-42362 | Wordpress Popular Posts Authenticated RCE | wordpress popular posts | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2021-41277 | Metabase - Local File Inclusion | metabase | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2021-43495 | AlquistManager Local File Inclusion | alquist | 7.5 (v3.1) | High | 347009 |
| CVE-2021-41951 | Resourcespace - Cross-Site Scripting | resourcespace | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2021-43574 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-16152 | Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE | aerohive netconfig | 9.8 (v3.1) | Critical | 320464 , 320465 , 340007 , 340128 , 344360 , 344370 , 360152 , 380018 , 390709 , 390801 |
| CVE-2021-3577 | Motorola Baby Monitors - Remote Command Execution | halo+ camera firmware | 8.8 (v3.1) | High | 340014 , 340193 , 344364 , 344370 , 393655 |
| CVE-2021-43496 | Clustering Local File Inclusion | clustering | 7.5 (v3.1) | High | 347009 |
| CVE-2021-42847 | ManageEngine ADAudit Plus Authenticated File Write RCE | manageengine adaudit plus | 9.8 (v3.1) | Critical | 390703 |
| CVE-2021-41349 | Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2021-35488 | Thruk 2.40-2 - Cross-Site Scripting | thruk | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-24731 | Pie Register < 3.7.1.6 - SQL Injection | pie register | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-24827 | WordPress Asgaros Forum <1.15.13 - SQL Injection | asgaros forum | 9.8 (v3.1) | Critical | 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2021-24627 | G Auto-Hyperlink <= 1.0.1 - SQL Injection | g auto-hyperlink | 7.2 (v3.1) | High | 340017 , 340144 , 340157 |
| CVE-2021-24791 | Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection | header footer code manager | 7.2 (v3.1) | High | 380122 |
| CVE-2021-40577 | Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting | online enrollment management system | 5.4 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2021-42237 | Sitecore Experience Platform (XP) PreAuth Deserialization RCE | experience platform | 9.8 (v3.1) | Critical | 344361 , 344362 , 344363 , 344366 |
| CVE-2021-42667 | Online Event Booking and Reservation System 2.3.0 - SQL Injection | online event booking and reservation system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2021-39411 | Hospital Management System 1.0 - Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2021-42663 | Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting | online event booking and reservation system | 4.3 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-43140 | Simple Subscription Website 1.0 - SQLi Authentication Bypass | simple subscription website | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 345493 , 390572 |
| CVE-2020-20982 | shadoweb wdja v1.5.1 - Cross-Site Scripting | wdja cms | 9.6 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-41174 | Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting | grafana | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-31862 | SysAid 20.4.74 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-42258 | BillQuick Web Suite txtID SQLi | billquick web suite | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2021-42840 | SuiteCRM Log File Remote Code Execution | suitecrm | 8.8 (v3.1) | High | 330791 , 340014 , 340152 , 341256 , 344362 , 344363 , 344370 |
| CVE-2021-31682 | WebCTRL OEM <= 6.5 - Cross-Site Scripting | webctrl | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-39352 | Wordpress Plugin Catch Themes Demo Import RCE | catch themes demo import | 7.2 (v3.1) | High | 330791 , 334168 , 340152 , 382238 |
| CVE-2021-42565 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-42566 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-20123 | Draytek VigorConnect 1.6.0-B - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-20124 | Draytek VigorConnect 6.0-B3 - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-42325 | Froxlor 0.10.29.1 - SQL Injection (Authenticated) | froxlor | 9.8 (v3.1) | Critical | 344370 , 350147 , 390724 |
| CVE-2021-40617 | openSIS Community Edition 8.0 - SQL Injection | opensis | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 390727 , 392301 , 392648 |
| CVE-2021-29006 | rConfig 3.9.6 - Local File Inclusion | rconfig | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2021-24563 | WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated) | frontend uploader | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-40542 | Opensis-Classic 8.0 - Cross-Site Scripting | opensis | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-24681 | Duplicate Page WordPress - Stored Cross-Site Scripting | duplicate page | 4.8 (v3.1) | Medium | 377360 |
| CVE-2021-42013 | Apache 2.4.49/2.4.50 Traversal RCE | http server | 9.8 (v3.1) | Critical | 347009 , 392648 |
| CVE-2021-40978 | MKdocs 1.2.2 - Directory Traversal | mkdocs | 7.5 (v3.1) | High | 347009 |
| CVE-2021-39350 | FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting | fv flowplayer video player | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-41773 | Apache 2.4.49/2.4.50 Traversal RCE | http server | 9.8 (v3.1) | Critical | 347009 , 392648 |
| CVE-2021-39433 | BIQS IT Biqs-drive v1.83 Local File Inclusion | biqsdrive | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-41878 | i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS) | i-panel administration system | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-40960 | Galera WebTemplate 1.0 Directory Traversal | galera webtemplate | 9.8 (v3.1) | Critical | 347009 , 390709 |
| CVE-2021-41649 | PuneethReddyHC Online Shopping System homeaction.php SQL Injection | online-shopping-system-advanced | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-41648 | PuneethReddyHC action.php SQL Injection | online-shopping-system-advanced | 7.5 (v3.1) | High | 392301 |
| CVE-2021-40968 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40969 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40970 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40971 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40972 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40973 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-41467 | JustWriting - Cross-Site Scripting | justwriting | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-41291 | ECOA Building Automation System - Directory Traversal Content Disclosure | ecs router controller-ecs firmware | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-41293 | ECOA Building Automation System - Arbitrary File Retrieval | ecs router controller-ecs firmware | 7.5 (v3.1) | High | 392301 |
| CVE-2021-40651 | OS4Ed OpenSIS Community 8.0 - Local File Inclusion | opensis | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24666 | WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection | podlove podcast publisher | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2021-36749 | Apache Druid - Local File Inclusion | druid | 6.5 (v3.1) | Medium | 340029 , 344360 |
| CVE-2021-22005 | VMware vCenter Server Analytics (CEIP) Service File Upload | cloud foundation | 9.8 (v3.1) | Critical | 330791 , 340007 , 340152 , 344360 , 347009 , 390709 |
| CVE-2021-36873 | WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting | iq block country | 5.4 (v3.1) | Medium | 377360 |
| CVE-2021-22017 | vCenter Server - Improper Access Control | vcenter server | 5.3 (v3.1) | Medium | 344370 |
| CVE-2021-36260 | Hikvision IP Camera Unauthenticated Command Injection | ds-2cd2026g2-iu/sl firmware | 9.8 (v3.1) | Critical | 393655 |
| CVE-2021-40868 | Cloudron 6.2 Cross-Site Scripting | cloudron | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24657 | Limit Login Attempts WordPress - Stored Cross-site Scripting | limit login attempts | 6.1 (v3.1) | Medium | 377360 |
| CVE-2021-40438 | Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery | http server | 9.0 (v3.1) | Critical | 345271 , 390723 |
| CVE-2021-33690 | SAP NetWeaver Development Infrastructure - Server Side Request Forgery | netweaver development infrastructure | 9.9 (v3.1) | Critical | 340162 , 340163 |
| CVE-2021-40870 | Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution | controller | 9.8 (v3.1) | Critical | 340007 |
| CVE-2021-33544 | Geutebruck - Remote Command Injection | g-cam ebc-2110 | 7.2 (v3.1) | High | 340014 , 340193 , 344364 , 344370 , 393655 |
| CVE-2021-24510 | WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting | mf gig calendar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2020-19282 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-19283 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-19295 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 341266 |
| CVE-2020-19515 | qdPM 9.1 - Cross-site Scripting | qdpm | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2021-40539 | ManageEngine ADSelfService Plus CVE-2021-40539 | manageengine adselfservice plus | 9.8 (v3.1) | Critical | 340006 , 340007 , 340029 , 344360 , 390709 , 390719 |
| CVE-2021-38704 | ClinicCases 7.3.3 Cross-Site Scripting | cliniccases | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24435 | WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting | titan framework | 6.1 (v3.1) | Medium | 333141 , 340149 , 341245 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-39322 | WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting | easy social icons | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-39320 | WordPress Under Construction <1.19 - Cross-Site Scripting | underconstruction | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-39316 | WordPress DZS Zoomsounds <=6.50 - Local File Inclusion | zoomsounds | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-26084 | Atlassian Confluence WebWork OGNL Injection | confluence data center | 9.8 (v3.1) | Critical | 346755 |
| CVE-2021-27909 | Mautic <3.3.4 - Cross-Site Scripting | mautic | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-37416 | Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting | manageengine adselfservice plus | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2021-39165 | Cachet <=2.3.18 - SQL Injection | cachet | 6.5 (v3.1) | Medium | 340145 , 340156 , 341145 , 380026 , 380122 |
| CVE-2021-37538 | PrestaShop SmartBlog <4.0.6 - SQL Injection | smartblog | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2021-39144 | XStream 1.4.18 - Remote Code Execution | xstream | 8.5 (v3.1) | High | 344363 |
| CVE-2021-24554 | WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection | paytm-pay | 7.2 (v3.1) | High | 380122 |
| CVE-2021-36748 | PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection | blog | 7.5 (v3.1) | High | 341245 |
| CVE-2021-20792 | WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting | quiz and survey master | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-38702 | Cyberoam NetGenie Cross-Site Scripting | netgenie c0101b1-20141120-ng11vo firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24527 | Profile Builder < 3.4.9 - Improper Authentication | profile builder | 9.8 (v3.1) | Critical | 340130 |
| CVE-2021-35395 | RealTek Jungle SDK - Arbitrary Command Injection | realtek jungle sdk | 9.8 (v3.1) | Critical | 340014 , 340029 , 344361 , 344363 |
| CVE-2021-34643 | WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting | skaut-bazar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-26086 | Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read | jira data center | 5.3 (v3.1) | Medium | 345113 , 390727 , 392301 , 392648 |
| CVE-2021-36380 | Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection | sureline | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-37343 | Nagios XI Autodiscovery Webshell Upload | nagios xi | 8.8 (v3.1) | High | 340007 , 340095 , 340128 , 344360 , 347009 , 360152 , 380018 , 380026 , 390709 |
| CVE-2020-20988 | DomainMOD 4.13.0 - Cross-Site Scripting | domainmod | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-34640 | WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting | securimage-wp-fixed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-37425 | Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE) | mobiletogether server | 9.1 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-24499 | WordPress Workreap - Remote Code Execution | workreap | 9.8 (v3.1) | Critical | 330791 , 340152 , 382238 |
| CVE-2021-24495 | Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting | marmoset viewer | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 340162 , 340163 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-24522 | ProfilePress < 3.1.11 - Cross-Site Scripting | profilepress | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-37573 | Tiny Java Web Server - Cross-Site Scripting | tiny java web server | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-35265 | MaxSite CMS > V106 - Cross-Site Scripting | maxsite cms | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-37833 | Hotel Druid 3.0.2 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26085 | Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read | confluence data center | 5.3 (v3.1) | Medium | 390727 , 392301 , 392648 |
| CVE-2021-24472 | Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery | kentharadio | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2021-24488 | WordPress Post Grid <2.1.8 - Cross-Site Scripting | post grid | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 , 347198 |
| CVE-2021-24498 | WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting | calendar event multi view | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-37593 | PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection | peel shopping | 9.1 (v3.1) | Critical | 340016 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2021-34630 | GTranslate < 2.8.65 - Cross-Site Scripting | gtranslate | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-32789 | WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection | woocommerce blocks | 7.5 (v3.1) | High | 360150 |
| CVE-2021-30049 | SysAid Technologies 20.3.64 b14 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-22145 | Elasticsearch Memory Disclosure | elasticsearch | 6.5 (v3.1) | Medium | 330791 , 340152 |
| CVE-2021-24436 | WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24452 | WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-21799 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-21800 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-21801 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-21802 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-21803 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-34429 | Eclipse Jetty 11.0.5 - Sensitive File Disclosure | jetty | 5.3 (v3.1) | Medium | 390703 |
| CVE-2021-34473 | Microsoft Exchange ProxyShell RCE | exchange server | 9.1 (v3.1) | Critical | 340095 , 344365 , 344366 , 390716 |
| CVE-2021-34523 | Microsoft Exchange ProxyShell RCE | exchange server | 9.0 (v3.1) | Critical | 340095 , 344365 , 344366 , 390716 |
| CVE-2020-26153 | Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting | event espresso | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-24442 | Wordpress Polls Widget < 1.5.3 - SQL Injection | poll, survey, questionnaire and voting system | 9.8 (v3.1) | Critical | 380122 |
| CVE-2021-33807 | Cartadis Gespage 8.2.1 - Directory Traversal | gespage | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2021-24409 | Prismatic < 2.8 - Cross-Site Scripting | prismatic | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-30118 | Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution | vsa | 9.8 (v3.1) | Critical | 344365 , 392301 |
| CVE-2021-34621 | WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness | profilepress | 9.8 (v3.1) | Critical | 377360 |
| CVE-2021-34624 | WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload | profilepress | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-24405 | WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS | easy cookies policy | 6.5 (v3.1) | Medium | 346755 , 390585 , 390726 , 392647 |
| CVE-2021-24387 | WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting | real estate 7 | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-24389 | WordPress FoodBakery <2.2 - Cross-Site Scripting | foodbakery | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24407 | WordPress Jannah Theme <5.4.5 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-35956 | AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS) | sensorprobe2 firmware | 5.4 (v3.1) | Medium | 333141 , 341256 , 342259 , 350147 |
| CVE-2021-34187 | Chamilo model.ajax.php - SQL Injection | chamilo | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-18662 | Gnuboard5 5.3.2.8 - SQL Injection | gnuboard | 9.8 (v3.1) | Critical | 344366 , 380122 |
| CVE-2021-21809 | Moodle SpellChecker Path Authenticated Remote Command Execution | moodle | 9.1 (v3.1) | Critical | 344361 , 344364 , 344366 |
| CVE-2020-22165 | PHPGurukul Hospital Management System 4.0 - SQL Injection | hospital management system | 7.5 (v3.1) | High | 340016 , 340017 , 340145 , 340157 , 340159 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-24364 | WordPress Jannah Theme <5.4.4 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2020-22208 | 74cms - ajax_street.php 'x' SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-22209 | 74cms - ajax_common.php SQL Injection | 74cms | 9.8 (v3.1) | Critical | 341250 , 390703 |
| CVE-2020-22210 | 74cms - ajax_officebuilding.php SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340145 |
| CVE-2020-22211 | 74cms - ajax_street.php 'key' SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-29214 | Alumni Management System 1.0 - SQL Injection | alumni management system | 9.8 (v3.1) | Critical | 340156 |
| CVE-2021-32682 | elFinder Archive Command Injection | elfinder | 9.8 (v3.1) | Critical | 340007 , 344360 , 344361 , 344363 , 344364 , 344370 , 347009 , 393655 , 393781 |
| CVE-2021-24347 | Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution | sp project & document manager | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 377360 , 382238 , 390801 |
| CVE-2021-24351 | WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting | the plus addons for elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-23394 | elFinder < 2.1.58 - Remote Code Execution | elfinder | 9.8 (v3.1) | Critical | 393781 |
| CVE-2021-22175 | GitLab CI Lint API - Server-Side Request Forgery | gitlab | 9.8 (v3.1) | Critical | 344362 , 344370 |
| CVE-2021-33357 | RaspAP <=2.6.5 - Remote Command Injection | raspap | 9.8 (v3.1) | Critical | 344363 , 344364 , 344366 , 344370 |
| CVE-2021-33393 | IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE | ipfire | 8.8 (v3.1) | High | 340029 , 344361 , 344363 , 350147 |
| CVE-2021-34369 | Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR) | civic platform | 6.5 (v3.1) | Medium | 390727 , 392301 , 392648 |
| CVE-2021-33829 | Drupal 7 CKEditor XSS | ckeditor | 6.1 (v3.1) | Medium | 333141 |
| CVE-2021-34370 | Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2021-22214 | Gitlab CE/EE 10.5 - Server-Side Request Forgery | gitlab | 8.6 (v3.1) | High | 344362 |
| CVE-2021-24340 | WordPress Statistics <13.0.8 - Blind SQL Injection | wp statistics | 7.5 (v3.1) | High | 380122 |
| CVE-2020-18268 | Z-Blog <=1.5.2 - Open Redirect | z-blogphp | 6.1 (v3.1) | Medium | 390500 , 390501 |
| CVE-2021-24342 | WordPress JNews Theme <8.0.6 - Cross-Site Scripting | jnews | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-33904 | Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390722 |
| CVE-2021-31250 | CHIYU TCP/IP Converter - Cross-Site Scripting | bf-430 firmware | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-6950 | Eclipse Mojarra - Local File Read | mojarra | 6.5 (v3.1) | Medium | 340007 |
| CVE-2021-27828 | In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection | in4suite erp | 9.1 (v3.1) | Critical | 392301 |
| CVE-2021-24316 | WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting | mediumish | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24320 | WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting | bello | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24335 | WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting | car repair services & auto mechanic | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-21985 | VMware vCenter Server Virtual SAN Health Check Plugin RCE | vcenter server | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2021-24298 | WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting | simple giveaways | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24300 | WordPress WooCommerce <1.13.22 - Cross-Site Scripting | product slider for woocommerce | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 , 347198 |
| CVE-2020-35580 | SearchBlox <9.2.2 - Local File Inclusion | searchblox | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-29625 | Adminer <=4.8.0 - Cross-Site Scripting | adminer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-31316 | CentOS Web Panel - SQL Injection | webpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 341245 |
| CVE-2021-31324 | CentOS Web Panel - OS Command Injection | webpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 341245 |
| CVE-2021-32305 | Websvn <2.6.1 - Remote Code Execution | websvn | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 , 344370 |
| CVE-2021-24284 | WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload | kaswara | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-24285 | WordPress Car Seller - Auto Classifieds Script - SQL Injection | cars-seller-auto-classifieds-script | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2021-32819 | Nodejs Squirrelly - Remote Code Execution | squirrelly | 8.8 (v3.1) | High | 340014 , 340087 , 340095 , 340193 , 344370 , 345240 , 380026 |
| CVE-2021-32820 | Express-handlebars - Local File Inclusion | express handlebars | 8.6 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-24286 | WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting | redirect 404 to parent | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-24287 | WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting | select all categories and taxonomies, change checkbox to radio buttons | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-24291 | WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting | photo gallery | 6.1 (v3.1) | Medium | 347198 |
| CVE-2021-28799 | QNAP HBS 3 - Broken Access Control | hybrid backup sync | 9.8 (v3.1) | Critical | 344360 , 390904 |
| CVE-2021-30213 | Knowage Suite 7.3 - Cross-Site Scripting | knowage | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-31181 | Microsoft SharePoint Unsafe Control and ViewState RCE | sharepoint enterprise server | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2021-31207 | Microsoft Exchange ProxyShell RCE | exchange server | 6.6 (v3.1) | Medium | 340095 , 344365 , 344366 , 390716 |
| CVE-2021-31195 | Microsoft Exchange Server - Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-31537 | SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting | sis-rewe go | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2020-23575 | Kyocera Printer d-COPIA253MF - Directory Traversal | d-copia253mf plus firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2021-31755 | Tenda Router AC11 - Remote Command Injection | ac11 firmware | 9.8 (v3.1) | Critical | 340014 |
| CVE-2021-1497 | Cisco HyperFlex HX Data Platform Command Execution | hyperflex hx data platform | 9.8 (v3.1) | Critical | 393655 |
| CVE-2021-1498 | Cisco HyperFlex HX Data Platform Command Execution | hyperflex hx data platform | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 , 393655 |
| CVE-2021-28151 | Hongdian H8922 3.0.5 - Remote Command Injection | h8922 firmware | 8.8 (v3.1) | High | 330925 , 392301 |
| CVE-2021-28149 | Hongdian H8922 3.0.5 Devices - Local File Inclusion | h8922 firmware | 6.5 (v3.1) | Medium | 330925 , 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24214 | WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting | openid connect generic client | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-24245 | WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) | stop spammers | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 398005 |
| CVE-2021-28150 | Hongdian H8922 3.0.5 - Information Disclosure | h8922 firmware | 5.5 (v3.1) | Medium | 330925 |
| CVE-2021-1499 | Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499) | hyperflex hx data platform | 5.3 (v3.1) | Medium | 330791 , 334168 , 340152 , 390700 |
| CVE-2020-36333 | ThemeGrill Demo Importer < 1.6.2 - Database Reset | themegrill demo importer | 9.1 (v3.1) | Critical | 375357 |
| CVE-2021-24274 | WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting | ultimate maps | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24275 | Popup by Supsystic <1.10.5 - Cross-Site scripting | popup | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24276 | WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting | contact form | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-31856 | Layer5 Meshery 0.5.2 - SQL Injection | meshery | 9.8 (v3.1) | Critical | 341245 , 344366 |
| CVE-2021-29460 | Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS) | kirby | 5.4 (v3.1) | Medium | 330791 , 340152 |
| CVE-2021-22205 | GitLab Unauthenticated Remote ExifTool Command Injection | gitlab | 10.0 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2021-20086 | Odoo Apps - Cross-Site Scripting via Prototype Pollution | jquery-bbq | 8.8 (v3.1) | High | 333141 , 340099 , 340147 , 341099 , 341256 , 346755 , 347198 |
| CVE-2021-22204 | GitLab Unauthenticated Remote ExifTool Command Injection | exiftool | 7.8 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2021-25899 | Void Aural Rec Monitor 9.0.0.1 - SQL Injection | aurall rec monitor | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2021-24235 | WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting | goto | 6.1 (v3.1) | Medium | 333141 , 340099 , 340149 , 341099 , 341256 , 342259 , 344370 , 346755 , 347198 , 350148 , 390722 |
| CVE-2021-24237 | WordPress Realteo <=1.2.3 - Cross-Site Scripting | findeo | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-25864 | HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting | consul | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-26812 | Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting | meet | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24215 | Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation | controlled admin access | 9.8 (v3.1) | Critical | 377360 |
| CVE-2020-24285 | INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion | tip200 | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-24227 | Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion | patreon wordpress | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24213 | GiveWP <= 2.9.7 - Cross-Site Scripting | givewp | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | 9.8 (v3.1) | Critical | 330791 , 334168 , 340014 , 340128 , 340149 , 340152 , 344364 , 344366 , 344370 , 350147 , 360152 , 380018 , 390801 |
| CVE-2021-1473 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340149 , 340152 , 350147 , 360152 , 380018 , 390801 |
| CVE-2021-30151 | Sidekiq <=6.2.0 - Cross-Site Scripting | sidekiq | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24212 | WooCommerce Help Scout - Arbitrary File Upload | help scout | 9.8 (v3.1) | Critical | 330791 , 340152 , 382238 |
| CVE-2021-24170 | User Profile Picture < 2.5.0 - Sensitive Information Disclosure | user profile picture | 7.5 (v3.1) | High | 377360 |
| CVE-2021-24155 | Wordpress Plugin Backup Guard - Authenticated Remote Code Execution | backup guard | 7.2 (v3.1) | High | 330791 , 334168 , 340133 , 340152 , 377360 , 382238 |
| CVE-2021-24165 | WordPress Ninja Forms <3.4.34 - Open Redirect | ninja forms | 6.1 (v3.1) | Medium | 377360 |
| CVE-2021-24169 | WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting | advanced order export | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24210 | WordPress PhastPress <1.111 - Open Redirect | phastpress | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2021-28918 | Netmask NPM Package - Server-Side Request Forgery | netmask | 9.1 (v3.1) | Critical | 340162 , 344360 , 347009 , 398003 |
| CVE-2021-22986 | F5 iControl REST Unauthenticated SSRF Token Generation RCE | big-ip access policy manager | 9.8 (v3.1) | Critical | 330791 , 337109 , 337110 , 340152 , 344363 , 344370 , 392767 , 393655 , 398021 , 398022 |
| CVE-2021-21975 | VMware vRealize Operations (vROps) Manager SSRF RCE | cloud foundation | 7.5 (v3.1) | High | 334168 |
| CVE-2021-21983 | VMware vRealize Operations (vROps) Manager SSRF RCE | cloud foundation | 6.5 (v3.1) | Medium | 334168 |
| CVE-2020-24391 | Mongo-Express - Remote Code Execution | mongo-express | 9.8 (v3.1) | Critical | 345240 , 380026 |
| CVE-2021-25161 | Aruba Instant Access Point (IAP) - Cross-Site Scripting | aruba-instant-access-point | 6.1 (v3.1) | Medium | 344370 , 346755 , 390722 |
| CVE-2020-19625 | Gridx 1.3 - Remote Code Execution | gridx | 9.8 (v3.1) | Critical | 341250 |
| CVE-2020-23517 | Aryanic HighMail (High CMS) - Cross-Site Scripting | high cms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27316 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-27319 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 380122 |
| CVE-2021-27320 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-21345 | XStream < 1.4.16 - Remote Code Execution | xstream | 9.9 (v3.1) | Critical | 344363 , 344366 |
| CVE-2021-21351 | XStream <1.4.16 - Remote Code Execution | xstream | 9.1 (v3.1) | Critical | 344380 |
| CVE-2021-21402 | Jellyfin <10.7.0 - Local File Inclusion | jellyfin | 6.5 (v3.1) | Medium | 344365 , 347019 |
| CVE-2021-27309 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27310 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27519 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-27520 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-24139 | 10Web Photo Gallery < 1.5.55 - SQL Injection | photo gallery | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2021-24145 | Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution | modern events calendar lite | 7.2 (v3.1) | High | 330791 , 334168 , 340152 , 382238 |
| CVE-2021-27695 | openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting | openmaint | 6.1 (v3.1) | Medium | 330791 , 333141 , 340147 , 340148 , 340149 , 340152 , 341256 , 342259 , 346755 |
| CVE-2021-27314 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2020-29047 | WP Hotel Booking < 1.10.4 - PHP Object Injection | wp hotel booking | 9.8 (v3.1) | Critical | 330889 |
| CVE-2021-21978 | VMware View Planner Unauthenticated Log File Upload RCE | view planner | 9.8 (v3.1) | Critical | 330791 , 334168 , 340007 , 340152 , 390700 |
| CVE-2021-26855 | Microsoft Exchange ProxyLogon RCE | exchange server | 9.1 (v3.1) | Critical | 330791 , 340014 , 340147 , 340148 , 340152 , 340193 , 341256 , 342259 , 344363 , 346755 , 390716 |
| CVE-2021-27931 | LumisXP <10.0.0 - Blind XML External Entity Attack | lumis experience platform | 9.1 (v3.1) | Critical | 344372 , 392301 |
| CVE-2021-27065 | Microsoft Exchange ProxyLogon RCE | exchange server | 7.8 (v3.1) | High | 330791 , 340014 , 340147 , 340148 , 340152 , 340193 , 341256 , 342259 , 344363 , 346755 , 390716 |
| CVE-2021-26475 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26702 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-25281 | SaltStack Salt API Unauthenticated RCE through wheel_async client | salt | 9.8 (v3.1) | Critical | 340007 , 340029 , 344360 , 344364 , 344370 , 390709 |
| CVE-2021-27132 | Sercomm VD625 Smart Modems - CRLF Injection | agcombo vd625 firmware | 9.8 (v3.1) | Critical | 330708 , 390714 |
| CVE-2021-25282 | SaltStack Salt API Unauthenticated RCE through wheel_async client | salt | 9.1 (v3.1) | Critical | 340007 , 340029 , 344360 , 344364 , 344370 , 390709 |
| CVE-2021-27330 | Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting | datepicker calendar | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2021-21972 | VMware vCenter Server Unauthenticated OVA File Upload RCE | cloud foundation | 9.8 (v3.1) | Critical | 330791 , 340006 , 340152 , 390719 |
| CVE-2020-28429 | geojson2kml - Command Injection | geojson2kml | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2020-21224 | Inspur ClusterEngine 4.0 - Remote Code Execution | clusterengine | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 344370 |
| CVE-2021-27124 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2021-21315 | Node.JS System Information Library <5.3.1 - Remote Command Injection | systeminformation | 7.8 (v3.1) | High | 340029 , 344360 , 344364 , 344370 , 347009 , 393655 |
| CVE-2021-3239 | E-Learning System 1.0 - SQL Injection | e-learning system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2021-21307 | Lucee Administrator imgProcess.cfm Arbitrary File Write | lucee server | 9.8 (v3.1) | Critical | 340007 , 340029 , 340149 , 342259 , 344360 , 344364 , 344366 , 347009 , 350147 , 390709 |
| CVE-2021-22652 | Advantech iView Unauthenticated Remote Code Execution | iview | 9.8 (v3.1) | Critical | 340014 , 340193 |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 340195 , 360152 , 380018 , 390801 , 390811 |
| CVE-2020-13117 | Wavlink Multiple AP - Remote Command Injection | wn575a4 | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 |
| CVE-2021-21479 | SCIMono <0.0.19 - Remote Code Execution | scimono | 9.1 (v3.1) | Critical | 337209 , 337211 , 340087 , 346755 |
| CVE-2021-22502 | Micro Focus Operations Bridge Reporter Unauthenticated Command Injection | operation bridge reporter | 9.8 (v3.1) | Critical | 330791 , 340152 , 344364 , 344366 |
| CVE-2021-22122 | FortiWeb - Cross Site Scripting | fortiweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-26723 | Jenzabar 9.2x-9.2.2 - Cross-Site Scripting | jenzabar | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2021-26710 | Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting | report2web | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-29164 | PacsOne Server <7.1.1 - Cross-Site Scripting | pacsone server | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 346755 , 360030 |
| CVE-2020-25506 | D-Link DNS-320 - Unauthenticated Remote Code Execution | dns-320 firmware | 9.8 (v3.1) | Critical | 344363 , 392301 |
| CVE-2021-3378 | FortiLogger Arbitrary File Upload Exploit | fortilogger | 9.8 (v3.1) | Critical | 330791 , 340006 , 340152 , 390719 |
| CVE-2020-15568 | TerraMaster TOS <.1.29 - Remote Code Execution | tos | 9.8 (v3.1) | Critical | 340023 , 344360 , 347009 |
| CVE-2021-25646 | Apache Druid 0.20.0 Remote Command Execution | druid | 8.8 (v3.1) | High | 330791 , 337209 , 337210 , 337211 , 340095 , 340152 , 344360 , 344361 , 344370 , 380026 |
| CVE-2021-3278 | Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass | local services search engine management system | 9.8 (v3.1) | Critical | 340156 , 345493 |
| CVE-2021-25864 | Hue Magic 3.0.0 - Local File Inclusion | huemagic | 7.5 (v3.1) | High | 347009 |
| CVE-2021-3223 | Node RED Dashboard <2.26.2 - Local File Inclusion | node-red-dashboard | 7.5 (v3.1) | High | 347009 |
| CVE-2020-27735 | Wing FTP 6.4.4 - Cross-Site Scripting | wing ftp server | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-3110 | PrestaShop 1.7.7.0 - SQL Injection | prestashop | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2020-19360 | FHEM 6.0 - Local File Inclusion | fhem | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2020-35749 | WordPress Simple Job Board <2.9.4 - Local File Inclusion | simple board job | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-20617 | Acmailer - Improper Access Control to OS Command Injection | acmailer,acmailer db | 9.8 (v3.1) | Critical | 340014 , 344363 |
| CVE-2020-35578 | Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High | 330791 , 334168 , 340152 , 390700 |
| CVE-2021-3129 | Unauthenticated remote code execution in Ignition | ignition | 9.8 (v3.1) | Critical | 330791 , 340007 , 340077 , 340152 , 340162 , 340165 , 344365 , 398007 |
| CVE-2020-24701 | OX Appsuite - Cross-Site Scripting | open-xchange appsuite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2020-35131 | Cockpit CMS 0.6.1 - Remote Code Execution | cockpit | 9.8 (v3.1) | Critical | 340095 |
| CVE-2020-24902 | Quixplorer <=2.4.1 - Cross-Site Scripting | quixplorer | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-24903 | Cute Editor for ASP.NET 6.4 - Cross-Site Scripting | cute editor | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-23241 | MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion | mercury x18g firmware | 5.3 (v3.1) | Medium | 347009 |
| CVE-2021-3018 | IPeakCMS 3.5 - SQL Injection | ipeakcms | 9.8 (v3.1) | Critical | 380122 |
| CVE-2021-21234 | Spring Boot Actuator Logview Directory Traversal | spring-boot-actuator-logview | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-17519 | Apache Flink JobManager Traversal | flink | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2021-3002 | Seo Panel 4.8.0 - Cross-Site Scripting | seo panel | 6.1 (v3.1) | Medium | 333141 , 340147 , 346755 |
| CVE-2020-35846 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical | 330791 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2020-35847 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical | 330791 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2020-29233 | WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting | wondercms | 5.4 (v3.1) | Medium | 345493 |
| CVE-2020-29477 | Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting | community | 4.8 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 390585 |
| CVE-2020-35241 | Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting | flatpress | 4.8 (v3.1) | Medium | 344370 , 346755 , 390724 |
| CVE-2020-10148 | SolarWinds Orion API - Auth Bypass | orion platform | 9.8 (v3.1) | Critical | 390709 |
| CVE-2020-35774 | twitter-server Cross-Site Scripting | twitter-server | 5.4 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-29470 | OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting | opencart | 4.8 (v3.1) | Medium | 340247 , 340248 , 340476 , 340477 , 341245 , 342259 , 346755 , 390585 |
| CVE-2020-29475 | nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting | store | 4.8 (v3.1) | Medium | 346755 |
| CVE-2020-35729 | Klog Server authenticate.php user Unauthenticated Command Injection | klog server | 9.8 (v3.1) | Critical | 344364 , 390720 , 392301 |
| CVE-2020-35736 | GateOne 1.1 - Local File Inclusion | gateone | 7.5 (v3.1) | High | 347009 |
| CVE-2020-35713 | Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution | re6500 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical | 340014 , 340087 , 340095 , 340128 , 340193 , 344363 , 344370 , 346755 , 350147 , 360152 , 380018 , 390801 , 390811 |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical | 340087 , 340095 , 340128 , 344363 , 346755 , 350147 , 360152 , 380018 , 390801 , 390811 |
| CVE-2020-35598 | Advanced Comment System 1.0 - Local File Inclusion | advanced comment system | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2020-24579 | D-Link DSL 2888a - Authentication Bypass/Remote Command Execution | dsl2888a firmware | 8.8 (v3.1) | High | 344360 , 347009 , 390904 , 392301 |
| CVE-2020-35151 | Online Marriage Registration System 1.0 - 'searchdata' SQL Injection | online marriage registration system | 8.8 (v3.1) | High | 345493 |
| CVE-2020-20300 | WeiPHP 5.0 - SQL Injection | weiphp | 9.8 (v3.1) | Critical | 340157 , 340159 , 360147 , 360148 |
| CVE-2020-25494 | SCO Openserver 5.0.7 - 'outputform' Command Injection | openserver | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2020-25495 | SCO Openserver 5.0.7 - 'section' Reflected XSS | openserver | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 390585 |
| CVE-2020-20285 | ZZcms - Cross-Site Scripting | zzcms | 5.4 (v3.1) | Medium | 333141 , 340003 , 340099 , 341099 , 342259 |
| CVE-2020-35545 | Spotweb 1.4.9 - 'search' SQL Injection | spotweb | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2020-35476 | OpenTSDB 2.4.0 unauthenticated command injection | opentsdb | 9.8 (v3.1) | Critical | 340014 , 340087 , 340095 , 340193 , 344361 , 344363 , 344370 |
| CVE-2020-35416 | PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) | phpjabbers appointment scheduler | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2020-29227 | Car Rental Management System 1.0 - Local File Inclusion | car rental management system | 9.8 (v3.1) | Critical | 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2020-17530 | Apache Struts 2 Forced Multi OGNL Evaluation | struts | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 344360 , 344362 , 344363 , 347009 |
| CVE-2020-17132 | Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE | exchange server | 9.1 (v3.1) | Critical | 330791 , 340152 |
| CVE-2020-13945 | APISIX Admin API default access token RCE | apisix | 6.5 (v3.1) | Medium | 344363 , 344370 , 380026 |
| CVE-2020-26248 | PrestaShop Product Comments <4.2.0 - SQL Injection | productcomments | 8.2 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2020-29279 | 74CMS - Remote File Inclusion | 74cms | 9.8 (v3.1) | Critical | 340128 , 344363 , 380018 |
| CVE-2020-29240 | LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting | leptoncms | 4.8 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 398005 |
| CVE-2020-29390 | Zeroshell 3.9.3 - Command Injection | zeroshell | 9.8 (v3.1) | Critical | 340023 , 341245 , 344360 , 344361 , 344363 , 344370 , 347009 |
| CVE-2020-29395 | Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting | eventon | 6.1 (v3.1) | Medium | 333141 , 342259 , 347198 , 350148 |
| CVE-2020-12262 | Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting | tip300 | 5.4 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-13886 | Intelbras TIP 200/200 LITE/300 - Local File Inclusion | tip200 firmware | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-13942 | Apache Unomi <1.5.2 - Remote Code Execution | unomi | 9.8 (v3.1) | Critical | 340095 |
| CVE-2020-26217 | XStream <1.4.14 - Remote Code Execution | xstream | 8.8 (v3.1) | High | 344363 , 344366 |
| CVE-2020-27191 | LionWiki <3.2.12 - Local File Inclusion | lionwiki | 7.5 (v3.1) | High | 344360 , 347009 |
| CVE-2020-27481 | Good Layers LMS Plugin <= 2.1.4 - SQL Injection | good learning management system | 9.8 (v3.1) | Critical | 322102 , 340016 , 380122 |
| CVE-2020-27386 | FlexDotnetCMS Arbitrary ASP File Upload | flexdotnetcms | 8.8 (v3.1) | High | 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2020-28351 | Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting | shoretel | 6.1 (v3.1) | Medium | 341266 |
| CVE-2020-16846 | SaltStack Salt REST API Arbitrary Command Execution | salt | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2020-25592 | SaltStack Salt REST API Arbitrary Command Execution | salt | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2020-28328 | SuiteCRM Log File Remote Code Execution | suitecrm | 8.8 (v3.1) | High | 330791 , 340014 , 340152 , 341256 , 344362 , 344363 , 344370 |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2020-14750 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340007 , 340014 , 340029 , 340095 , 344360 , 344361 , 344362 , 344364 , 344370 , 380026 , 390709 |
| CVE-2020-24881 | OsTicket < 1.14.3 - Server Side Request Forgery | osticket | 9.8 (v3.1) | Critical | 340147 , 340148 |
| CVE-2020-27982 | IceWarp WebMail 11.4.5.0 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-8260 | Pulse Secure VPN gzip RCE | connect secure | 7.2 (v3.1) | High | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2020-27533 | DedeCMS v.5.8 - keyword Cross-Site Scripting | dedecms | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-14882 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340007 , 340014 , 340029 , 340095 , 344360 , 344361 , 344362 , 344364 , 344370 , 390709 |
| CVE-2020-27615 | WordPress Loginizer log SQLi Scanner | loginizer | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2020-14864 | Oracle Fusion - Directory Traversal/Local File Inclusion | business intelligence | 7.5 (v3.1) | High | 344360 , 347009 , 390709 , 390716 |
| CVE-2020-14883 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 7.2 (v3.1) | High | 337209 , 337210 , 337211 , 340007 , 340014 , 340029 , 340095 , 344360 , 344361 , 344362 , 344364 , 344370 , 380026 , 390709 |
| CVE-2020-3580 | Cisco ASA/FTD Software - Cross-Site Scripting | firepower threat defense | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-5792 | Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High | 340128 , 344370 , 360152 , 380018 , 380020 , 390801 , 390810 |
| CVE-2020-16952 | Microsoft SharePoint Server-Side Include and ViewState RCE | sharepoint enterprise server | 8.6 (v3.1) | High | 380016 , 392648 |
| CVE-2020-14144 | Gitea Git Hooks Remote Code Execution | gitea | 7.2 (v3.1) | High | 344362 |
| CVE-2020-7318 | McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting | epolicy orchestrator | 4.3 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2020-26935 | phpMyAdmin < 5.0.3 - SQL Injection | phpmyadmin | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2020-26919 | NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution | jgs516pe firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-26124 | OpenMediaVault rpc.php Authenticated PHP Code Injection | openmediavault | 8.8 (v3.1) | High | 340095 |
| CVE-2020-25760 | Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) | visitor management system | 8.8 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2020-25223 | Sophos UTM Preauth - Remote Code Execution | unified threat management | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2019-0230 | Apache Struts 2 Forced Multi OGNL Evaluation | struts | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 344362 , 344363 |
| CVE-2020-16875 | Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE | exchange server | 8.4 (v3.1) | High | 330791 , 340152 |
| CVE-2020-11991 | Apache Cocoon 2.1.12 - XML Injection | cocoon | 7.5 (v3.1) | High | 344372 |
| CVE-2020-25213 | WordPress File Manager Unauthenticated Remote Code Execution | file manager | 9.8 (v3.1) | Critical | 344370 , 393781 |
| CVE-2020-2036 | Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting | pan-os | 8.8 (v3.1) | High | 347198 |
| CVE-2020-2038 | Palo Alto Networks Authenticated Remote Code Execution | pan-os | 7.2 (v3.1) | High | 344361 , 344363 , 350147 |
| CVE-2020-24963 | Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated) | best support system | 5.4 (v3.1) | Medium | 333141 , 344370 , 360151 |
| CVE-2020-24193 | Daily Tracker System 1.0 - Authentication Bypass | daily tracker system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 345493 , 390572 |
| CVE-2020-24949 | PHP-Fusion 9.03.50 - Remote Code Execution | php-fusion | 8.8 (v3.1) | High | 393655 |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | 7.2 (v3.1) | High | 330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 380018 , 390801 |
| CVE-2020-23814 | XXL-JOB v2.2.0 — Stored Cross Site Scripting | xxl-job | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2020-5776 | MAGMI - Cross-Site Request Forgery | magmi | 8.8 (v3.1) | High | 344364 , 344366 , 344370 , 345490 |
| CVE-2020-24223 | Mara CMS 7.5 - Cross-Site Scripting | mara cms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-24609 | Savsoft Quiz 5 - Stored Cross-Site Scripting | savsoft quiz | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2020-24186 | WordPress wpDiscuz Unauthenticated File Upload Vulnerability | wpdiscuz | 10.0 (v3.1) | Critical | 340748 , 344360 , 347006 , 382238 , 390709 , 390719 |
| CVE-2020-24589 | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection | api manager | 9.1 (v3.1) | Critical | 341256 , 344370 , 344372 , 380018 |
| CVE-2020-5775 | Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery | canvas learning management service | 5.8 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-17456 | SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution | slc-130 | 9.8 (v3.1) | Critical | 340014 , 344363 , 344370 |
| CVE-2020-8209 | Citrix XenMobile Server - Local File Inclusion | xenmobile server | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-16205 | Geutebruck testaction.cgi Remote Command Execution | g-cam ebc-2110 firmware | 7.2 (v3.1) | High | 390722 |
| CVE-2019-6112 | WordPress Sell Media 2.4.1 - Cross-Site Scripting | sell media | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-17463 | Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated) | fuel cms | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2020-17496 | vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution. | vbulletin | 9.8 (v3.1) | Critical | 340007 , 340095 , 340128 , 344360 , 344370 , 380018 , 390709 , 390801 |
| CVE-2020-17506 | Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection | web proxy | 9.8 (v3.1) | Critical | 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-17505 | Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection | web proxy | 8.8 (v3.1) | High | 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344364 , 344366 , 360147 , 360148 |
| CVE-2020-17362 | Nova Lite < 1.3.9 - Cross-Site Scripting | nova lite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-11984 | Apache HTTP Server - Remote Code Execution | http server | 9.8 (v3.1) | Critical | 344363 , 390614 , 390626 , 390724 |
| CVE-2020-7356 | Cayin xPost wayfinder_seqid SQLi to RCE | xpost | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344370 , 360147 , 360148 |
| CVE-2020-7361 | ZenTao Pro 8.8.2 Remote Code Execution | zentao pro | 8.8 (v3.1) | High | 344365 |
| CVE-2020-9036 | Jeedom <=4.0.38 - Cross-Site Scripting | jeedom | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-13820 | Extreme Management Center 8.4.1.24 - Cross-Site Scripting | extreme management center | 6.1 (v3.1) | Medium | 333141 , 340149 , 342259 , 346755 |
| CVE-2020-11110 | Grafana <= 6.7.1 - Cross-Site Scripting | grafana | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2020-15920 | Mida eFramework <=2.9.0 - Remote Command Execution | eframework | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 347009 |
| CVE-2020-15893 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-816l firmware | 9.8 (v3.1) | Critical | 381237 , 392648 |
| CVE-2020-15895 | D-Link DIR-816L 2.x - Cross-Site Scripting | dir-816l firmware | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-12028 | Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution | factorytalk view | 8.1 (v3.1) | High | 390716 |
| CVE-2020-12029 | Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution | factorytalk view | 7.8 (v3.1) | High | 390716 |
| CVE-2020-12027 | Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution | factorytalk view | 4.3 (v3.1) | Medium | 390716 |
| CVE-2020-11978 | Apache Airflow <=1.10.10 - Remote Code Execution | airflow | 8.8 (v3.1) | High | 344364 |
| CVE-2020-15718 | RosarioSIS 6.7.2 - Cross-Site Scripting | rosariosis | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-11546 | SuperWebmailer 7.21.0.01526 - Remote Code Execution | superwebmailer | 9.8 (v3.1) | Critical | 340095 , 393655 |
| CVE-2020-1147 | SharePoint DataSet / DataTable Deserialization | .net core | 7.8 (v3.1) | High | 341256 , 344370 , 344380 , 350147 |
| CVE-2020-10987 | Tenda AC15 AC1900 version 15.03.05.19 - Command Injection | ac15 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 |
| CVE-2020-5766 | SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection | srs simple hits counter | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 360147 , 360148 , 380122 , 380123 |
| CVE-2020-8191 | Citrix ADC/Gateway - Cross-Site Scripting | application delivery controller firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-15505 | MobileIron MDM Hessian-Based Java Deserialization RCE | core | 9.8 (v3.1) | Critical | 391213 |
| CVE-2020-15599 | Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting | victor cms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 350148 |
| CVE-2020-8163 | Ruby on Rails <5.0.1 - Remote Code Execution | rails | 8.8 (v3.1) | High | 340023 , 344360 , 344370 , 347009 , 390724 |
| CVE-2020-13381 | openSIS Unauthenticated PHP Code Execution | opensis | 9.8 (v3.1) | Critical | 340016 , 340017 , 340145 , 340156 , 340157 , 340195 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-5902 | F5 BIG-IP TMUI Directory Traversal and File Upload RCE | big-ip access policy manager | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 , 390714 , 392301 |
| CVE-2020-13382 | openSIS Unauthenticated PHP Code Execution | opensis | 9.1 (v3.1) | Critical | 340016 , 340017 , 340145 , 340156 , 340157 , 340195 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-13383 | openSIS Unauthenticated PHP Code Execution | opensis | 7.5 (v3.1) | High | 340016 , 340017 , 340145 , 340156 , 340157 , 340195 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-15500 | TileServer GL <=3.0.0 - Cross-Site Scripting | tileservergl | 6.1 (v3.1) | Medium | 333141 , 341245 , 341256 , 342259 , 346755 , 350147 |
| CVE-2020-15415 | DrayTek Vigor - Command Injection | vigor | 9.8 (v3.1) | Critical | 390700 |
| CVE-2020-9483 | SkyWalking SQLI | skywalking | 7.5 (v3.1) | High | 341250 |
| CVE-2020-14413 | NeDi 1.9C - Cross-Site Scripting | nedi | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-13483 | Bitrix24 <=20.0.0 - Cross-Site Scripting | bitrix24 | 6.1 (v3.1) | Medium | 344363 , 344370 , 346755 , 390722 |
| CVE-2020-15038 | Wordpress Plugin Maintenance Mode by SeedProd 5.1.1 - Persistent Cross-Site Scripting | coming soon page, under construction & maintenance mode | 5.4 (v3.1) | Medium | 345493 |
| CVE-2020-9480 | Apache Spark - Authentication Bypass | spark | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2020-13158 | Artica Proxy Community Edition <4.30.000000 - Local File Inclusion | artica proxy | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-13640 | wpDiscuz <= 5.3.5 - SQL Injection | wpdiscuz | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 341155 , 360147 , 360148 , 380026 |
| CVE-2020-14295 | Cacti color filter authenticated SQLi to RCE | cacti | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 344362 , 344370 , 360147 , 360148 , 390572 |
| CVE-2020-14408 | Agentejo Cockpit 0.10.2 - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-13851 | Artica Pandora FMS 7.44 - Remote Code Execution | pandora fms | 8.8 (v3.1) | High | 344360 , 347009 |
| CVE-2020-11798 | Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal | micollab audio, web & video conferencing | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 |
| CVE-2020-12800 | WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution | drag and drop multiple file upload - contact form 7 | 9.8 (v3.1) | Critical | 300018 |
| CVE-2020-11975 | Apache Unomi - Remote Code Execution | unomi | 9.8 (v3.1) | Critical | 337210 |
| CVE-2020-10546 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10547 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10548 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10549 | rConfig <=3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-7012 | Kibana Upgrade Assistant Telemetry Collector Prototype Pollution | kibana | 8.8 (v3.1) | High | 340095 , 345240 , 380026 |
| CVE-2020-13379 | Grafana 3.0.1-7.0.1 - Server-Side Request Forgery | grafana | 8.2 (v3.1) | High | 340165 |
| CVE-2020-5410 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | 7.5 (v3.1) | High | 390709 |
| CVE-2020-8816 | Pi-Hole DHCP MAC OS Command Execution | pi-hole | 7.2 (v3.1) | High | 390763 , 393655 |
| CVE-2020-1106 | Microsoft Office SharePoint XSS Vulnerability | sharepoint enterprise server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13258 | Contentful <=2020-05-21 - Cross-Site Scripting | python example | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13166 | Plesk/myLittleAdmin ViewState .NET Deserialization | mylittleadmin | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2020-13167 | Netsweeper <=6.4.3 - Python Code Injection | netsweeper | 9.8 (v3.1) | Critical | 340087 , 340095 , 390810 |
| CVE-2020-12256 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-12259 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13121 | Submitty <= 20.04.01 - Open Redirect | submitty | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-12832 | WordPress Simple File List - Path Traversal | Simple File List WordPress Plugin | 9.8 (v3.1) | Critical | 382238 |
| CVE-2020-9314 | Oracle iPlanet Web Server 7.0.x - Image Injection | iplanet web server | 4.8 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-11530 | WordPress ChopSlider3 id SQLi Scanner | chop slider | 9.8 (v3.1) | Critical | 340016 , 340145 , 340156 , 341145 , 380026 , 380122 |
| CVE-2020-12720 | vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection | vbulletin | 9.8 (v3.1) | Critical | 331028 , 340016 , 340017 , 340144 , 340145 , 340155 , 340156 , 340157 , 340159 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 , 390572 , 391235 |
| CVE-2020-5741 | Plex Unpickle Dict Windows RCE | media server | 7.2 (v3.1) | High | 344365 |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical | 330791 , 334168 , 340006 , 340007 , 340128 , 340152 , 344360 , 347009 , 360152 , 380018 , 390709 , 390719 , 390801 , 391213 |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical | 330791 , 334168 , 340006 , 340007 , 340128 , 340152 , 344360 , 347009 , 360152 , 380018 , 390709 , 390719 , 390801 , 391213 |
| CVE-2020-4428 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.1 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2020-10973 | WAVLINK - Access Control | wn530hg4 firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2020-8982 | Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read | sharefile storagezones controller | 7.5 (v3.1) | High | 340007 |
| CVE-2020-12707 | LeptonCMS 4.5.0 - Persistent Cross-Site Scripting | lepton cms | 6.1 (v3.1) | Medium | 345493 |
| CVE-2020-12706 | php-fusion 9.03.50 - Persistent Cross-Site Scripting | php-fusion | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 346755 |
| CVE-2020-12641 | Roundcube Webmail - Command Injection | webmail | 9.8 (v3.1) | Critical | 340014 |
| CVE-2020-12109 | TP-Link Cloud Cameras NCXXX Bonjour Command Injection | nc200 firmware | 8.8 (v3.1) | High | 393655 |
| CVE-2020-7351 | TrixBox CE endpoint_devicemap.php Authenticated Command Execution | trixbox | 8.8 (v3.1) | High | 393655 |
| CVE-2020-6010 | Wordpress LearnPress current_items Authenticated SQLi | learnpress | 8.8 (v3.1) | High | 340016 , 340145 , 340156 , 341145 , 341245 , 345493 , 380026 , 380122 |
| CVE-2020-12447 | Onkyo TX-NR585 Web Interface - Directory Traversal | tx-nr585 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2020-12054 | WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting | catch breadcrumb | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-11930 | WordPress GTranslate <2.8.52 - Cross-Site Scripting | translate wordpress with gtranslate | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2020-3243 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344370 , 347009 , 390719 |
| CVE-2020-3250 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344370 , 347009 , 390719 |
| CVE-2020-11738 | WordPress Duplicator File Read Vulnerability | duplicator | 7.5 (v3.1) | High | 323769 , 336461 , 340748 , 344360 , 347006 , 347009 , 381206 , 390709 |
| CVE-2020-10977 | GitLab File Read Remote Code Execution | gitlab | 5.5 (v3.1) | Medium | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2020-6171 | CLink Office 2.0 - Cross-Site Scripting | clink office | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-19699 | Centreon Poller Authenticated Remote Command Execution | centreon | 7.2 (v3.1) | High | 390501 , 390709 |
| CVE-2020-8639 | TestLink 1.9.20 - Unrestricted File Upload (Authenticated) | testlink | 8.8 (v3.1) | High | 345493 |
| CVE-2019-17231 | WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS | onetone | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-11491 | Zen Load Balancer Directory Traversal | zen load balancer | 4.9 (v3.1) | Medium | 330925 , 340007 , 344360 , 347009 , 390709 |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical | 344370 , 344380 , 390614 , 390626 , 390724 |
| CVE-2020-11455 | LimeSurvey Zip Path Traversals | limesurvey | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-10199 | Nexus Repository Manager Java EL Injection RCE | nexus | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2020-1943 | Apache OFBiz <=16.11.07 - Cross-Site Scripting | ofbiz | 6.1 (v3.1) | Medium | 347198 |
| CVE-2020-11456 | LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting | limesurvey | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 342259 , 346755 |
| CVE-2020-11457 | pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting | pfsense | 5.4 (v3.1) | Medium | 333141 , 342259 , 345493 |
| CVE-2020-5723 | Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump | ucm6202 firmware | 9.8 (v3.1) | Critical | 341245 , 392648 |
| CVE-2020-5724 | Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump | ucm6202 firmware | 7.5 (v3.1) | High | 341245 , 392648 |
| CVE-2020-9467 | Piwigo 2.10.1 - Cross Site Scripting | piwigo | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2020-10385 | WordPress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting | contact form | 5.4 (v3.1) | Medium | 345493 , 346755 |
| CVE-2020-5722 | Grandstream UCM62xx IP PBX sendPasswordEmail RCE | ucm6200 firmware | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 344364 , 344366 , 390572 , 393655 |
| CVE-2019-16072 | Enigma NMS < 65.0.0 - Authenticated OS Command Injection | enigma network management solution | 9.8 (v3.1) | Critical | 344364 |
| CVE-2020-9344 | Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting | subversion application lifecycle management | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-5847 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 9.8 (v3.1) | Critical | 340087 , 340128 , 346755 , 380018 , 390801 |
| CVE-2020-5849 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 7.5 (v3.1) | High | 340087 , 340128 , 346755 , 380018 , 390801 |
| CVE-2020-10257 | ThemeREX Addons - Remote Code Execution | themerex | 9.8 (v3.1) | Critical | 377360 |
| CVE-2019-20504 | Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution | kace systems management | 9.8 (v3.1) | Critical | 340014 , 340029 , 344363 |
| CVE-2020-10221 | rConfig <= 3.9.4 - Authenticated OS Command Injection | rconfig | 8.8 (v3.1) | High | 344364 , 344366 |
| CVE-2020-10220 | Rconfig 3.x Chained Remote Code Execution | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 |
| CVE-2020-10189 | ManageEngine Desktop Central Java Deserialization | manageengine desktop central | 9.8 (v3.1) | Critical | 340007 , 344365 , 344380 , 347019 |
| CVE-2020-10173 | Comtrend VR-3033 - Command Injection | vr-3033 firmware | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2019-20499 | DLINK DWL-2600 Authenticated Remote Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2019-20500 | D-Link DWL-2600AP - Multiple OS Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2019-20501 | D-Link DWL-2600AP - Multiple OS Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2020-5405 | Spring Cloud Config - Local File Inclusion | spring cloud config | 6.5 (v3.1) | Medium | 390709 |
| CVE-2020-9054 | Zyxel NAS Firmware 5.21- Remote Code Execution | nas326 firmware | 9.8 (v3.1) | Critical | 312659 , 340023 , 344360 , 344361 , 344363 , 344370 , 347009 |
| CVE-2020-9547 | FasterXML jackson-databind - Deserialization Remote Code Execution | jackson-databind | 9.8 (v3.1) | Critical | 398008 |
| CVE-2020-9548 | FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution | jackson-databind | 9.8 (v3.1) | Critical | 398008 |
| CVE-2020-9465 | EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution | eyesofnetwork | 9.8 (v3.1) | Critical | 340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148 |
| CVE-2019-19134 | WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting | hero maps premium | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2020-8813 | Cacti v1.2.8 - Remote Code Execution | cacti | 8.8 (v3.1) | High | 340014 |
| CVE-2014-9614 | Netsweeper 4.0.5 - Default Weak Account | netsweeper | 9.8 (v3.1) | Critical | 392301 |
| CVE-2014-9606 | Netsweeper 4.0.8 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2014-9607 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-9608 | Netsweeper 4.0.3 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 |
| CVE-2014-9615 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2014-9609 | Netsweeper 4.0.8 - Directory Traversal | netsweeper | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-6970 | Bosch Security Systems Dinion NBN-498 - Web Interface XML Injection | nbn-498 dinion2x day/night ip cameras firmware | 9.8 (v3.1) | Critical | 390726 , 392301 , 392647 , 392648 |
| CVE-2013-2679 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2015-6922 | Kaseya VSA uploader.aspx Arbitrary File Upload | virtual system administrator | 9.8 (v3.1) | Critical | 340128 , 344365 , 360152 , 380018 , 390801 |
| CVE-2020-8518 | Horde CSV import arbitrary PHP code execution | groupware | 9.8 (v3.1) | Critical | 340128 , 344370 , 360152 , 380018 , 380026 , 390801 |
| CVE-2014-7236 | TWiki Debugenableplugins Remote Code Execution | twiki | 9.1 (v3.1) | Critical | 340095 , 340128 , 341245 , 344362 , 344370 , 346755 , 380018 , 380026 , 390801 |
| CVE-2020-9043 | WordPress wpCentral <1.5.1 - Information Disclosure | wpcentral | 8.8 (v3.1) | High | 377360 |
| CVE-2020-7209 | LinuxKI Toolset <= 6.01 - Remote Command Execution | linuxki | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 347009 |
| CVE-2013-2097 | Zpanel Remote Unauthenticated RCE | zpanel | 7.8 (v3.1) | High | 340007 , 344370 , 390709 |
| CVE-2013-0803 | PolarBear CMS PHP File Upload Vulnerability | polarbear cms | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390700 , 390801 |
| CVE-2020-0618 | SQL Server Reporting Services (SSRS) ViewState Deserialization | sql server | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 341245 |
| CVE-2014-8739 | Wordpress Creative Contact Form Upload Vulnerability | creative contact form | 9.8 (v3.1) | Critical | 300016 , 330791 , 334168 , 340152 |
| CVE-2014-7863 | ManageEngine Multiple Products Arbitrary File Download | manageengine applications manager | 7.5 (v3.1) | High | 340006 , 344360 , 347009 , 390709 |
| CVE-2020-8656 | EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution | eyesofnetwork | 9.8 (v3.1) | Critical | 340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148 , 380026 , 380122 |
| CVE-2013-3591 | vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution | vtiger crm | 8.8 (v3.1) | High | 316812 , 330791 , 334168 , 340152 , 390700 |
| CVE-2013-3629 | ISPConfig Authenticated Arbitrary PHP Code Execution | ispconfig | 8.8 (v3.1) | High | 330791 , 334168 , 340152 , 360152 |
| CVE-2014-5468 | Railo Remote File Include | railo | 8.8 (v3.1) | High | 344360 , 347009 |
| CVE-2020-8654 | EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution | eyesofnetwork | 8.8 (v3.1) | High | 340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148 |
| CVE-2020-8655 | EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution | eyesofnetwork | 7.8 (v3.1) | High | 340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148 |
| CVE-2020-8657 | EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution | eyesofnetwork | 9.8 (v3.1) | Critical | 340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148 |
| CVE-2020-8771 | WordPress Time Capsule < 1.21.16 - Authentication Bypass | wp time capsule | 9.8 (v3.1) | Critical | 392301 |
| CVE-2013-3568 | Linksys Devices pingstr Remote Command Injection | linksys wrt110 firmware | 8.8 (v3.1) | High | 330925 |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 8.8 (v3.1) | High | 330791 , 334168 , 340128 , 340133 , 340152 , 343481 , 360152 , 380018 , 390801 |
| CVE-2013-2684 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2013-2683 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 5.3 (v3.1) | Medium | 392301 |
| CVE-2013-2681 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-8644 | PlaySMS index.php Unauthenticated Template Injection Code Execution | playsms | 9.8 (v3.1) | Critical | 340130 , 393655 |
| CVE-2020-8641 | Lotus Core CMS 1.0.1 - Local File Inclusion | lotus core cms | 8.8 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-2680 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 7.5 (v3.1) | High | 392301 |
| CVE-2013-2682 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 4.3 (v3.1) | Medium | 392301 |
| CVE-2012-5686 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2013-2678 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 8.1 (v3.1) | High | 392301 |
| CVE-2020-8615 | Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery | tutor lms | 6.5 (v3.1) | Medium | 345490 , 377360 |
| CVE-2020-8115 | Revive Adserver <=5.0.3 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2013-2621 | Telaen => v1.3.1 - Open Redirect | telaen | 6.1 (v3.1) | Medium | 320007 |
| CVE-2020-8549 | WordPress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting | strong testimonials | 6.1 (v3.1) | Medium | 345493 , 346755 |
| CVE-2020-8515 | Multiple DrayTek Products - Pre-authentication Remote Root Code Execution | vigor2960 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-8512 | IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting | icewarp server | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2019-20215 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-859 firmware | 9.8 (v3.1) | Critical | 381237 , 392648 |
| CVE-2013-4864 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 9.8 (v3.1) | Critical | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4863 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 8.8 (v3.1) | High | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4862 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 8.1 (v3.1) | High | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4861 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 6.5 (v3.1) | Medium | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4865 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 6.5 (v3.1) | Medium | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-7390 | ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload | manageengine desktop central | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390801 |
| CVE-2014-8741 | Lexmark MarkVision Enterprise Arbitrary File Upload | markvision enterprise | 9.8 (v3.1) | Critical | 340006 , 390719 |
| CVE-2019-19824 | TOTOLINK Realtek SD Routers - Remote Command Injection | a3002ru firmware | 8.8 (v3.1) | High | 340014 |
| CVE-2019-19822 | TOTOLINK/Realtek Routers - Information Disclosure | a3002ru firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2019-19823 | TOTOLINK/Realtek Routers - Information Disclosure | a3002ru firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2020-7991 | Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) | framework | 8.8 (v3.1) | High | 340147 , 340148 , 342259 , 345490 , 345493 , 346755 , 350147 , 350148 , 398001 |
| CVE-2020-7980 | Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution | aptus web | 9.8 (v3.1) | Critical | 344360 |
| CVE-2013-6785 | Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal | intelligent platform management interface | 4.3 (v3.1) | Medium | 340006 , 340007 , 344360 |
| CVE-2020-7246 | qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) | qdpm | 8.8 (v3.1) | High | 340006 , 344364 , 344370 , 390719 , 390724 , 390801 |
| CVE-2019-19411 | Huawei Firewall - Local File Inclusion | usg9500 | 3.7 (v3.1) | Low | 347009 , 390709 |
| CVE-2020-7107 | WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting | ultimate faq | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-7108 | WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting | learndash | 5.4 (v3.1) | Medium | 340003 , 341266 , 346755 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-16469 | Adobe Experience Manager - Expression Language Injection | experience manager | 7.5 (v3.1) | High | 393655 |
| CVE-2011-4336 | Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting | tikiwiki cms/groupware | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-2096 | Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting | gitlab hook | 6.1 (v3.1) | Medium | 341266 |
| CVE-2020-0646 | SharePoint Workflows XOML Injection | .net framework | 9.8 (v3.1) | Critical | 344370 |
| CVE-2019-20210 | WordPress CTHthemes - Cross-Site Scripting | citybook | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4561 | Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting | ultimate-weather | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-20224 | Pandora FMS 7.0NG - Remote Command Injection | pandora fms | 8.8 (v3.1) | High | 344363 |
| CVE-2020-5504 | phpMyAdmin 5.0.0 - SQL Injection | phpmyadmin | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 390727 , 392301 , 392648 |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-18859 | Digi AnywhereUSB 14 - Reflective Cross-Site Scripting | anywhereusb/14 firmware | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 , 390727 , 392301 , 392648 |
| CVE-2019-20361 | WordPress Email Subscribers and Newsletter Hash SQLi Scanner | email subscribers & newsletters | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2014-8673 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 9.8 (v3.1) | Critical | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2020-5307 | PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection | dairy farm shop management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2019-19509 | Rconfig 3.x Chained Remote Code Execution | rconfig | 8.8 (v3.1) | High | 340016 , 340145 , 340156 , 341145 , 341245 |
| CVE-2020-5192 | Hospital Management System 4.0 - 'searchdata' SQL Injection | hospital management system | 8.8 (v3.1) | High | 331028 , 340016 , 340017 , 340144 , 340157 , 345493 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2020-5191 | Hospital Management System 4.0 - Persistent Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium | 342259 , 345493 |
| CVE-2014-8674 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.4 (v3.1) | Medium | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2014-8516 | Visual Mining NetCharts Server Remote Code Execution | netcharts server | 9.8 (v3.1) | Critical | 334168 |
| CVE-2019-9553 | Bolt CMS 3.6.4 - Cross-Site Scripting | bolt | 6.1 (v3.1) | Medium | 340148 , 341256 , 346755 |
| CVE-2019-9556 | Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting | an5506-04-f firmware | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2019-17558 | Apache Solr Remote Code Execution via Velocity Template | solr | 7.5 (v3.1) | High | 330791 , 337209 , 337210 , 337211 , 340152 , 344370 , 390722 |
| CVE-2019-20141 | WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting | neon | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 , 350147 , 350148 |
| CVE-2019-19781 | Citrix ADC (NetScaler) Directory Traversal RCE | application delivery controller firmware | 9.8 (v3.1) | Critical | 340006 , 340007 , 344360 , 344370 , 390704 , 390709 , 390716 , 390719 |
| CVE-2014-4535 | Import Legacy Media <= 0.1 - Cross-Site Scripting | import legacy media | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4536 | Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting | infusionsoft gravity forms | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4539 | Movies <= 0.6 - Cross-Site Scripting | movies | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4544 | Podcast Channels < 0.28 - Cross-Site Scripting | podcast channels | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4550 | Shortcode Ninja <= 1.4 - Cross-Site Scripting | ninja | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2014-4558 | WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting | swipehq-payment-gateway-woocommerce | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2014-4592 | WP Planet <= 0.1 - Cross-Site Scripting | wp-planet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2019-10758 | mongo-express Remote Code Execution | mongo-express | 9.9 (v3.1) | Critical | 345240 , 360151 , 380026 |
| CVE-2019-19908 | phpMyChat-Plus 1.98 - Cross-Site Scripting | phpmychat-plus | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-19742 | D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting | dir-615 firmware | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 344370 , 350147 |
| CVE-2019-7481 | SonicWall SRA 4600 VPN - SQL Injection | sma 100 firmware | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2019-19731 | Roxy Fileman 1.4.5 - Directory Traversal | roxy fileman | 7.5 (v3.1) | High | 340007 |
| CVE-2019-19743 | D-Link DIR-615 - Privilege Escalation | dir-615 t1 firmware | 6.5 (v3.1) | Medium | 345493 |
| CVE-2019-19368 | Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting | rumpus | 6.1 (v3.1) | Medium | 342259 , 350147 |
| CVE-2019-19740 | Octeth Oempro 4.8 - 'CampaignID' SQL Injection | oempro | 9.8 (v3.1) | Critical | 392301 |
| CVE-2019-18935 | Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization | ui for asp.net ajax | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2019-17270 | Yachtcontrol Webapplication 1.0 - Remote Command Injection | yachtcontrol | 9.8 (v3.1) | Critical | 344360 , 347009 , 390904 |
| CVE-2019-14251 | T24 Web Server - Local File Inclusion | t24 | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2018-7282 | TITool PrintMonitor - Blind SQL Injection | printmonitor | 9.8 (v3.1) | Critical | 344370 |
| CVE-2019-7192 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-7194 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical | 340007 , 340128 , 344360 , 347009 , 380018 , 380026 , 390709 , 390801 |
| CVE-2019-7195 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-17554 | Apache Olingo OData 4.0 - XML External Entity Injection | olingo | 5.5 (v3.1) | Medium | 344372 , 345493 |
| CVE-2019-18922 | Allied Telesis AT-GS950/8 - Local File Inclusion | at-gs950/8 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2011-3600 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.1) | High | 344372 |
| CVE-2015-9538 | WordPress NextGEN Gallery Directory Read Vulnerability | nextgen gallery | 6.5 (v3.1) | Medium | 340007 , 340748 , 344360 , 347006 , 390709 |
| CVE-2014-8356 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.1) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2019-16758 | Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal | services monitor firmware | 7.5 (v3.1) | High | 346019 |
| CVE-2019-18957 | MicroStrategy Library <11.1.3 - Cross-Site Scripting | microstrategy library | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2012-5193 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380026 |
| CVE-2019-18665 | DOMOS 5.5 - Local File Inclusion | domos | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2011-3923 | Apache Struts ParametersInterceptor Remote Code Execution | struts | 9.8 (v3.1) | Critical | 360152 , 380018 , 390801 |
| CVE-2019-18396 | Technicolor TD5130.2 - Remote Command Execution | td5130v2 firmware | 7.2 (v3.1) | High | 344361 , 344363 |
| CVE-2013-1391 | Multiple DVR Manufacturers Configuration Disclosure | dvr-04ch firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2012-0694 | SugarCRM unserialize() PHP Code Execution | sugarcrm | 9.8 (v3.1) | Critical | 340195 , 380019 |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | 7.5 (v3.1) | High | 340029 , 341256 , 342259 , 344360 , 344372 , 380018 |
| CVE-2010-4239 | Tiki Wiki CMS Groupware 5.2 - Local File Inclusion | tikiwiki cms/groupware | 9.8 (v3.1) | Critical | 340007 , 390109 |
| CVE-2019-11043 | PHP-FPM Path Info Buffer Underflow - Remote Code Execution | php | 9.8 (v3.1) | Critical | 390714 |
| CVE-2019-16662 | rConfig 3.9.2 - Remote Code Execution | rconfig | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 347009 |
| CVE-2019-8086 | Adobe Experience Manager - XML External Entity Injection | experience manager | 7.5 (v3.1) | High | 330925 |
| CVE-2019-18393 | Ignite Realtime Openfire <4.42 - Local File Inclusion | openfire | 5.3 (v3.1) | Medium | 344365 , 347019 |
| CVE-2019-18371 | Xiaomi Mi WiFi R3G Routers - Local file Inclusion | millet router 3g firmware | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2019-10475 | Jenkins build-metrics 1.3 - Cross-Site Scripting | build-metrics | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2015-9499 | WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE | showbiz pro | 9.8 (v3.1) | Critical | 300019 , 300029 |
| CVE-2019-11253 | Kubernetes API Server - YAML Parsing DoS (Billion Laughs) | kubernetes | 7.5 (v3.1) | High | 391213 |
| CVE-2019-17662 | ThinVNC Directory Traversal | thinvnc | 9.8 (v3.1) | Critical | 390716 |
| CVE-2019-13392 | MindPalette NateMail 3.0.15 - Cross-Site Scripting | natemail | 6.1 (v3.1) | Medium | 342259 , 350147 , 350148 |
| CVE-2019-16278 | Nostromo Directory Traversal Remote Command Execution | nostromo nhttpd | 9.8 (v3.1) | Critical | 344360 , 344363 , 344364 , 390709 , 390714 , 390724 , 392301 |
| CVE-2019-17538 | Jiangnan Online Judge 0.8.0 - Local File Inclusion | jiangnan online judge | 7.5 (v3.1) | High | 340007 , 344360 , 347009 |
| CVE-2019-17506 | D-Link DIR-868L/817LW - Information Disclosure | dir-868l b1 firmware | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2019-17508 | DIR-850L (Un)authenticated OS Command Exec | dir-859 a3 firmware | 9.8 (v3.1) | Critical | 330791 , 340152 , 344362 |
| CVE-2019-17504 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 6.1 (v3.1) | Medium | 312863 , 340147 , 340148 , 341266 , 342259 , 344370 , 346755 , 390716 |
| CVE-2019-17503 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 5.3 (v3.1) | Medium | 312863 , 340147 , 340148 , 341266 , 342259 , 344370 , 346755 , 390716 |
| CVE-2015-9480 | WordPress RobotCPA 5 - Directory Traversal | robotcpa | 7.5 (v3.1) | High | 320006 |
| CVE-2019-17418 | MetInfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2019-17199 | WebPageTest Directory Traversal | webpagetest | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-16931 | WordPress Visualizer <3.3.1 - Cross-Site Scripting | visualizer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2019-16932 | Visualizer <3.3.1 - Blind Server-Side Request Forgery | visualizer | 10.0 (v3.1) | Critical | 344362 |
| CVE-2019-16996 | Metinfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2019-16997 | Metinfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2019-16920 | D-Link Routers - Remote Code Execution | dir-655 firmware | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 344365 , 344366 |
| CVE-2015-9414 | WordPress Symposium <=15.8.1 - Cross-Site Scripting | wp-symposium | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-10092 | Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting | http server | 6.1 (v3.1) | Medium | 344365 |
| CVE-2019-16759 | vBulletin 5.0.0-5.5.4 - Remote Command Execution | vbulletin | 9.8 (v3.1) | Critical | 341245 |
| CVE-2019-16383 | MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection | moveit transfer | 9.4 (v3.1) | Critical | 344366 , 361149 , 380026 , 380122 |
| CVE-2019-16693 | phpIPAM 1.4 - SQL-Injection | phpipam | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 |
| CVE-2015-9406 | WordPress Mobile Edition File Read Vulnerability | mtheme-unus | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 347009 , 381206 , 390709 |
| CVE-2019-16525 | WordPress Checklist <1.1.9 - Cross-Site Scripting | checklist | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10976 | Safe Editor Plugin < 1.2 - CSS/JS-injection | safe editor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2016-10993 | ScoreMe Theme - Cross-Site Scripting | scoreme | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10960 | WordPress wSecure Lite < 2.4 - Remote Code Execution | wsecure | 8.8 (v3.1) | High | 392301 |
| CVE-2016-10956 | WordPress Mail Masta 1.0 - Local File Inclusion | mail-masta | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2016-10973 | Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting | brafton | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2019-16332 | WordPress API Bearer Auth <20190907 - Cross-Site Scripting | api bearer auth | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10940 | WordPress zm-gallery plugin 1.0 SQL Injection | zm-gallery | 7.2 (v3.1) | High | 340017 , 340156 , 340157 |
| CVE-2019-3759 | RSA IG&L Aveksa 7.1.1 - Remote Code Execution | rsa identity governance and lifecycle | 8.1 (v3.1) | High | 330791 , 340152 |
| CVE-2017-18598 | WordPress Qards - Cross-Site Scripting | qards | 6.1 (v3.1) | Medium | 393749 |
| CVE-2019-16123 | PilusCart <=1.4.1 - Local File Inclusion | piluscart | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2019-6793 | GitLab Enterprise Edition - Server-Side Request Forgery | gitlab | 7.0 (v3.1) | High | 390616 |
| CVE-2019-15954 | Total.js CMS 12 Widget JavaScript Code Injection | total.js cms | 9.9 (v3.1) | Critical | 340011 , 340128 , 344363 , 344370 , 345240 , 380018 , 390801 |
| CVE-2019-15949 | Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution | nagios xi | 8.8 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2019-15813 | Sentrifugo 3.2 - File Upload Restriction Bypass | sentrifugo | 8.8 (v3.1) | High | 345493 |
| CVE-2019-14470 | WordPress UserPro 4.9.32 - Cross-Site Scripting | instagram-php-api | 6.1 (v3.0) | Medium | 333141 , 347198 |
| CVE-2019-15889 | WordPress Download Manager <2.9.94 - Cross-Site Scripting | wordpress download manager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2019-15829 | Gallery Photoblocks < 1.1.43 - Cross-Site Scripting | gallery photoblocks | 4.8 (v3.0) | Medium | 346755 , 347198 |
| CVE-2019-13608 | Citrix StoreFront Server - XML External Entity | storefront server | 7.5 (v3.1) | High | 344372 , 391213 |
| CVE-2019-15811 | DomainMOD <=4.13.0 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2019-15713 | WordPress My Calendar <= 3.1.9 - Cross-Site Scripting | my calendar | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-18590 | Timesheet Plugin < 0.1.5 - Cross-Site Scripting | timesheet | 6.1 (v3.0) | Medium | 341266 , 346755 , 377360 |
| CVE-2019-13237 | Alkacon OpenCMS 10.5.x - Local File inclusion | opencms apollo template | 4.3 (v3.1) | Medium | 392301 |
| CVE-2019-15642 | Webmin < 1.920 - Authenticated Remote Code Execution | webmin | 8.8 (v3.0) | High | 344362 , 344366 |
| CVE-2019-15501 | L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting | listserv | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-8446 | Jira Improper Authorization | jira server | 5.3 (v3.1) | Medium | 392301 |
| CVE-2017-18580 | WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution | shortcodes ultimate | 9.8 (v3.0) | Critical | 377360 |
| CVE-2018-20985 | WordPress Payeezy Pay <=2.97 - Local File Inclusion | wp payeezy pay | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-10924 | Wordpress Zedna eBook download <1.2 - Local File Inclusion | zedna ebook download | 7.5 (v3.0) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2019-11013 | Nimble Streamer <=3.5.4-9 - Local File Inclusion | nimble streamer | 6.5 (v3.0) | Medium | 347009 |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical | 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical | 344361 , 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High | 344361 , 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2017-18516 | LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | 341266 , 346755 | |
| CVE-2017-18536 | WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting | stop user enumeration | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-18537 | Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting | visitors online | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18556 | Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting | google analytics | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18557 | Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting | google maps | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18558 | Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting | testimonials | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18562 | Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting | error log viewer | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18564 | Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting | sender | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18565 | Updater by BestWebSoft < 1.35 - Cross-Site Scripting | updater | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18517 | Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | 341266 , 346755 | |
| CVE-2017-18518 | SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting | smtp | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18527 | Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting | pagination | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18528 | PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting | pdf & print | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18529 | PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting | promobar | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18530 | Rating by BestWebSoft < 0.2 - Cross-Site Scripting | rating | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18532 | Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting | realty | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18566 | User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting | user role | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14430 | YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection | youphptube | 5.3 (v3.0) | Medium | 392301 |
| CVE-2015-9323 | 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection | 404 to 301 | 9.8 (v3.1) | Critical | 340017 , 380122 |
| CVE-2019-15107 | Webmin <= 1.920 - Unauthenticated Remote Command Execution | webmin | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 |
| CVE-2017-18542 | Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting | zendesk help center | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14789 | Custom 404 Pro < 3.2.8 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2015-9312 | NewStatPress <=1.0.4 - Cross-Site Scripting | newstatpress | 6.1 (v3.0) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2019-14427 | Ultimate Loan Manager 2.0 - Cross-Site Scripting | ultimate loan manager | 6.1 (v3.0) | Medium | 345493 , 390585 |
| CVE-2019-14974 | SugarCRM Enterprise 9.0.0 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium | 340112 , 346755 , 350148 |
| CVE-2019-14530 | OpenEMR <5.0.2 - Local File Inclusion | openemr | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2017-18487 | AdPush < 1.44 - Cross-Site Scripting | google adsense | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18490 | Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting | contact form multi | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18491 | Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting | contact form | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18492 | Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting | contact form to db | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18493 | Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting | custom admin page | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18494 | Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting | custom search | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18496 | Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting | htaccess | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-13462 | Lansweeper Unauthenticated SQL Injection | lansweeper | 9.1 (v3.0) | Critical | 331028 , 340016 , 340155 , 340157 , 341155 , 341245 , 344361 , 360147 , 360148 |
| CVE-2017-18500 | Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting | social buttons pack | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18501 | Social Login by BestWebSoft < 0.2 - Cross-Site Scripting | social login | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18502 | Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting | subscriber | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18505 | BestWebSoft's Twitter < 2.55 - Cross-Site Scripting | twitter button | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14950 | WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting | live chat | 6.1 (v3.0) | Medium | 344370 , 346755 , 380026 |
| CVE-2019-11581 | Atlassian Jira Server-Side Template Injection | jira | 9.8 (v3.1) | Critical | 311299 |
| CVE-2019-14312 | Aptana Jaxer 1.0.3.4547 - Local File inclusion | jaxer | 6.5 (v3.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2019-14750 | osTicket < 1.12.1 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 346755 |
| CVE-2019-14696 | Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting | open-school | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-18570 | Planon <Live Build 41 - Cross-Site Scripting | planon | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2019-14322 | Pallets Werkzeug <0.15.5 - Local File Inclusion | Windows | 7.5 (v3.1) | High | 390716 |
| CVE-2019-10267 | Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload | cloud backup suite | 8.8 (v3.0) | High | 340128 , 360152 , 360153 , 380018 , 390801 |
| CVE-2019-10266 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 7.5 (v3.0) | High | 344372 |
| CVE-2019-10263 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 6.1 (v3.0) | Medium | 344372 |
| CVE-2019-2767 | Oracle Business Intelligence Publisher - XML External Entity Injection | bi publisher | 7.2 (v3.0) | High | 344370 , 380018 |
| CVE-2019-14205 | WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion | adaptive images | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2019-14206 | Nevma Adaptive Images - Arbitrary File Deletion | adaptive images | 7.5 (v3.1) | High | 340007 , 377360 |
| CVE-2019-12725 | Zeroshell 3.9.0 - Remote Command Execution | zeroshell | 9.8 (v3.0) | Critical | 340023 , 340029 , 344360 , 344361 , 344363 , 344370 , 347009 , 390722 |
| CVE-2019-1010287 | Timesheet Next Gen <=1.5.3 - Cross-Site Scripting | timesheet next gen | 6.1 (v3.0) | Medium | 340147 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-1943 | CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities | sg200-50 firmware | 6.1 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2019-12985 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 , 340029 , 344364 , 344366 , 344370 |
| CVE-2019-12986 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 , 340029 , 344364 , 344366 , 344370 |
| CVE-2019-12987 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 |
| CVE-2019-12988 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 393655 |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SD-WAN - SQL Injection | netscaler sd-wan | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2019-13372 | D-Link Central WiFi Manager CWM(100) RCE | central wifimanager | 9.8 (v3.1) | Critical | 340011 , 344370 |
| CVE-2019-13373 | D-Link Central WiFiManager SQL injection | central wifimanager | 9.8 (v3.0) | Critical | 340145 |
| CVE-2018-11686 | FlexPaper/FlowPaper 2.3.6 - Remote Code Execution | flowpaper | 9.8 (v3.0) | Critical | 340029 , 344361 , 344364 |
| CVE-2018-15811 | DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization | dotnetnuke | 7.5 (v3.1) | High | 344365 , 344370 |
| CVE-2018-18325 | DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization | dotnetnuke | 7.5 (v3.1) | High | 344365 , 344370 |
| CVE-2019-10717 | BlogEngine.NET 3.3.6/3.3.7 - 'path' Directory Traversal | blogengine.net | 7.1 (v3.0) | High | 340007 |
| CVE-2018-11227 | Monstra CMS <=3.0.4 - Cross-Site Scripting | monstra cms | 6.1 (v3.0) | Medium | 333141 , 340248 , 342259 , 346755 |
| CVE-2019-7256 | Linear eMerge E3-Series Access Controller Command Injection | linear emerge essential firmware | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 344364 , 344370 , 347009 |
| CVE-2019-7254 | eMerge E3 1.00-06 - Local File Inclusion | linear emerge essential firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2019-7255 | Linear eMerge E3 - Cross-Site Scripting | linear emerge essential firmware | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-14916 | Loytec LGATE-902 <6.4.2 - Local File Inclusion | lgate-902 | 9.1 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-14918 | LOYTEC LGATE-902 6.3.2 - Local File Inclusion | lgate-902 firmware | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-1619 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 344360 , 360152 , 380018 , 390709 , 390801 |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2019-1621 | Cisco Data Center Network Manager Unauthenticated File Download | data center network manager | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2019-12581 | Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting | uag2100 | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2019-1622 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 5.3 (v3.1) | Medium | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2019-12935 | Shopware < 5.5.8 - Cross-Site Scripting | shopware | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2019-2729 | Oracle WebLogic Server Administration Console - Remote Code Execution | communications diameter signaling router | 9.8 (v3.1) | Critical | 344361 , 344370 , 393655 |
| CVE-2018-20470 | Tyto Sahi pro 7.x/8.x - Local File Inclusion | sahi pro | 7.5 (v3.1) | High | 340007 |
| CVE-2019-7315 | Genie Access WIP3BVAF IP Camera - Local File Inclusion | wip3bvaf | 7.5 (v3.0) | High | 347009 |
| CVE-2019-12840 | Webmin Package Updates Remote Command Execution | webmin | 8.8 (v3.0) | High | 340029 , 344362 , 344363 |
| CVE-2019-11269 | Spring Security OAuth - Open Redirector | spring security oauth | 5.4 (v3.1) | Medium | 390703 , 390727 , 392301 , 392648 |
| CVE-2019-12780 | Belkin Wemo UPnP Remote Code Execution | crock-pot smart slow cooker with wemo firmware | 9.8 (v3.0) | Critical | 393655 |
| CVE-2019-9880 | WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure | wpgraphql | 9.1 (v3.0) | Critical | 344361 , 344363 |
| CVE-2019-7671 | Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting | flexair | 9.0 (v3.1) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390726 , 392647 |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | 8.8 (v3.0) | High | 342259 , 344360 , 344363 , 344364 , 344366 , 350147 , 390724 , 390726 , 392647 |
| CVE-2019-12276 | GrandNode 4.40 - Local File Inclusion | grandnode | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2019-12616 | phpMyAdmin 4.8 - Cross-Site Request Forgery | phpmyadmin | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-13379 | Fortinet FortiOS - Credentials Disclosure | fortios | 9.8 (v3.1) | Critical | 340007 |
| CVE-2018-13380 | Fortinet FortiOS - Cross-Site Scripting | fortios | 6.1 (v3.1) | Medium | 333141 , 340147 , 341266 , 342259 , 347198 |
| CVE-2019-11580 | Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE | crowd | 9.8 (v3.1) | Critical | 334168 , 391213 |
| CVE-2018-5406 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 8.8 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2019-12169 | ATutor 2.2.4 - Directory Traversal / Remote Code Execution, | atutor | 8.8 (v3.1) | High | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2019-12593 | IceWarp Mail Server <=10.4.4 - Local File Inclusion | mail server | 7.5 (v3.0) | High | 340007 , 344360 , 344365 , 347019 |
| CVE-2018-5404 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-5405 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 5.4 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2019-11370 | Carel pCOWeb <B1.2.4 - Cross-Site Scripting | pcoweb card firmware | 5.4 (v3.0) | Medium | 342259 |
| CVE-2019-12461 | WebPort 1.19.1 - Cross-Site Scripting | web port | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-9670 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | 9.8 (v3.1) | Critical | 344360 , 344370 , 344372 , 350147 |
| CVE-2019-9858 | Horde Form File Upload Vulnerability | groupware | 8.8 (v3.1) | High | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting | zimbra collaboration suite | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-0221 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350148 |
| CVE-2019-12314 | Deltek Maconomy 2.2.5 - Local File Inclusion | maconomy | 9.8 (v3.0) | Critical | 347009 |
| CVE-2019-10685 | Prinect Archive System 2015 Release 2.6 - Cross-Site Scripting | prinect archiver | 6.1 (v3.0) | Medium | 340147 , 341256 , 341266 , 346755 , 390585 |
| CVE-2018-7841 | Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection | u.motion builder | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2019-3402 | Jira < 8.1.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17179 | OpenEMR 5.0.1 Patch 6 SQLi Dump | openemr | 9.8 (v3.0) | Critical | 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 |
| CVE-2019-8937 | HotelDruid 2.3.0 - Cross-Site Scripting | hoteldruid | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-1821 | Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability | evolved programmable network manager | 9.8 (v3.0) | Critical | 340006 , 390719 |
| CVE-2013-7285 | XStream <1.4.6/1.4.10 - Remote Code Execution | xstream | 9.8 (v3.1) | Critical | 344363 |
| CVE-2018-18800 | PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection | welcome to our resort | 9.8 (v3.0) | Critical | 331028 , 340016 , 340157 , 341245 , 360147 , 380123 |
| CVE-2019-11844 | RICOH SP 4520DN Printer - HTML Injection | sp 4520dn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2019-11845 | RICOH SP 4510DN Printer - HTML Injection | sp 4510dn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2019-11846 | dotCMS 5.1.1 - HTML Injection | dotcms | 6.1 (v3.0) | Medium | 345493 |
| CVE-2019-8390 | qdPM 9.1 - 'search[keywords]' Cross-Site Scripting | qdpm | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 350147 |
| CVE-2019-9618 | WordPress GraceMedia Media Player 1.0 - Local File Inclusion | gracemedia media player | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-12300 | Seagate NAS OS 4.3.15.1 - Open Redirect | nas os | 6.1 (v3.0) | Medium | 340163 |
| CVE-2018-16139 | BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting | bibliopac | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2019-11510 | Pulse Secure VPN Arbitrary File Disclosure | connect secure | 10.0 (v3.1) | Critical | 347009 |
| CVE-2019-11398 | UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting | ulicms | 6.1 (v3.0) | Medium | 340247 , 340248 , 342259 , 344370 , 346755 |
| CVE-2019-11507 | Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected) | connect secure | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 , 390722 |
| CVE-2018-20503 | SirsiDynix e-Library 3.5.x - Cross-Site Scripting | 8100l/8 firmware | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2019-5434 | Revive Adserver 4.2 - Remote Code Execution | revive adserver | 9.8 (v3.0) | Critical | 344362 , 344365 , 344370 |
| CVE-2019-3799 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | 6.5 (v3.1) | Medium | 347009 , 390709 |
| CVE-2018-20824 | Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2017-18368 | TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection | 5200w-t firmware | 9.8 (v3.1) | Critical | 340029 |
| CVE-2017-18369 | TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection | 5200w-t firmware | 9.8 (v3.0) | Critical | 340029 |
| CVE-2017-18371 | TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection | 5200w-t firmware | 9.8 (v3.0) | Critical | 340029 , 344363 , 344364 , 344366 , 344370 |
| CVE-2018-16716 | NCBI ToolBox - Directory Traversal | ncbi toolbox | 9.1 (v3.0) | Critical | 344360 , 347009 , 390709 |
| CVE-2017-18370 | TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection | 5200w-t firmware | 8.8 (v3.0) | High | 340029 , 344363 , 344364 , 344366 , 344370 |
| CVE-2017-18372 | TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection | 5200w-t firmware | 8.8 (v3.0) | High | 340029 |
| CVE-2018-10383 | Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting | securelinx spider firmware | 6.1 (v3.0) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-9621 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | 7.5 (v3.1) | High | 344360 , 344370 , 344372 , 350147 |
| CVE-2019-2725 | Oracle Weblogic Server Deserialization RCE - AsyncResponseService | agile product lifecycle management | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2019-11539 | Pulse Secure VPN Arbitrary Command Execution | connect secure | 7.2 (v3.1) | High | 340007 , 340029 , 344360 , 344370 , 347009 , 390709 |
| CVE-2018-16660 | Imperva SecureSphere PWS Command Injection | securesphere | 8.8 (v3.0) | High | 330791 , 340152 , 393655 |
| CVE-2019-2616 | Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection | business intelligence publisher | 7.2 (v3.1) | High | 330791 , 340152 |
| CVE-2019-2557 | Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal | application testing suite | 6.3 (v3.0) | Medium | 340006 , 340007 , 341256 , 344360 , 347009 , 347019 , 390709 |
| CVE-2019-2588 | Oracle Business Intelligence - Path Traversal | business intelligence publisher | 4.9 (v3.0) | Medium | 340007 , 344365 , 347019 |
| CVE-2019-9955 | Zyxel - Cross-Site Scripting | atp200 firmware | 6.1 (v3.0) | Medium | 346755 |
| CVE-2019-0232 | Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability | tomcat | 8.1 (v3.0) | High | 344365 |
| CVE-2019-7219 | Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting | webaccess | 6.1 (v3.0) | Medium | 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2019-4013 | IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload | bigfix platform | 9.9 (v3.0) | Critical | 392301 |
| CVE-2019-7139 | Magento - SQL Injection | magento | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 |
| CVE-2019-10692 | WordPress Google Maps Plugin SQL Injection | wp go maps | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 390572 |
| CVE-2019-10647 | ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE) | zzzphp | 9.8 (v3.0) | Critical | 340162 , 340163 |
| CVE-2019-9922 | Joomla! Harmis Messenger 1.2.2 - Local File Inclusion | je messenger | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-10232 | Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection | gestionnaire libre de parc informatique | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340155 , 340157 , 341155 , 341245 , 360147 , 360148 |
| CVE-2019-5418 | Rails File Content Disclosure | rails | 7.5 (v3.1) | High | 390719 |
| CVE-2019-10068 | Kentico CMS Staging SyncServer Unserialize Remote Command Execution | xperience | 9.8 (v3.1) | Critical | 341256 , 344370 |
| CVE-2019-9055 | CMS Made Simple Authenticated RCE via object injection | cms made simple | 8.8 (v3.0) | High | 340095 , 340128 , 346755 , 380018 , 390801 |
| CVE-2019-3396 | Atlassian Confluence Widget Connector Macro Velocity Template Injection | confluence server | 9.8 (v3.1) | Critical | 330791 , 340152 , 392301 , 393655 |
| CVE-2019-9960 | LimeSurvey Zip Path Traversals | limesurvey | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-9912 | WP Google Maps < 7.10.43 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2018-18798 | School Attendance Monitoring System 1.0 - SQL Injection | school attendance monitoring system | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2018-19276 | OpenMRS Platform < 2.24.0 - Insecure Object Deserialization | openmrs | 9.8 (v3.1) | Critical | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2018-20526 | Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal | roxy fileman | 9.8 (v3.0) | Critical | 330791 , 340152 |
| CVE-2019-7238 | Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution | nexus | 9.8 (v3.1) | Critical | 344360 , 344363 , 344370 |
| CVE-2019-9083 | SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection | sqlitemanager | 9.8 (v3.0) | Critical | 341145 , 341245 |
| CVE-2018-19365 | Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal | streaming engine | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-20525 | Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal | roxy fileman | 9.1 (v3.1) | Critical | 330791 , 340152 |
| CVE-2018-10093 | AudioCodes 420HD - Remote Code Execution | 420hd ip phone firmware | 8.8 (v3.0) | High | 344360 , 347009 |
| CVE-2018-20323 | Mailcleaner Remote Code Execution | mailcleaner | 8.8 (v3.0) | High | 344364 , 393655 |
| CVE-2018-18762 | SaltOS Erp Crm 3.1 r8126 - Database File Download | saltos | 6.5 (v3.0) | Medium | 390716 |
| CVE-2019-7439 | JioFi 4G M2S 1.0.2 - Denial of Service | jiofi 4g m2s firmware | 6.5 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 350147 , 350148 |
| CVE-2019-7438 | JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting | jiofi 4g m2s firmware | 6.1 (v3.0) | Medium | 340149 , 341256 , 342259 , 344361 , 344364 , 344370 , 350147 |
| CVE-2019-9762 | PHPSHE 1.7 - SQL Injection | phpshe | 9.8 (v3.0) | Critical | 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 360147 , 360148 |
| CVE-2019-1003029 | Jenkins ACL Bypass and Metaprogramming RCE | script security | 9.9 (v3.1) | Critical | 344361 , 344363 |
| CVE-2019-9624 | Webmin Upload Authenticated RCE | webmin | 7.8 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2018-18809 | TIBCO JasperReports Library - Directory Traversal | jasperreports library | 6.5 (v3.1) | Medium | 340007 |
| CVE-2019-3778 | Spring Security OAuth - Open Redirector | spring security oauth | 6.5 (v3.1) | Medium | 390703 , 390727 , 392301 , 392648 |
| CVE-2019-9591 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9592 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9593 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9194 | elFinder PHP Connector exiftran Command Injection | elfinder | 9.8 (v3.0) | Critical | 340006 , 340007 , 344360 , 347009 , 390700 , 390709 , 390719 , 393781 |
| CVE-2019-9082 | ThinkPHP Multiple PHP Injection RCEs | thinkphp | 8.8 (v3.1) | High | 344361 , 393753 |
| CVE-2019-9041 | ZZZCMS 1.6.1 - Remote Code Execution | zzzphp | 7.2 (v3.0) | High | 360153 , 380026 |
| CVE-2019-8982 | Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery | wavemarker studio | 9.6 (v3.0) | Critical | 344360 , 347009 |
| CVE-2019-6340 | Drupal RESTful Web Services unserialize() RCE | drupal | 8.1 (v3.1) | High | 330791 , 340152 , 391213 , 392301 , 392648 |
| CVE-2019-8942 | WordPress Crop-image Shell Upload | WordPress | 8.8 (v3.0) | High | 340006 , 340007 , 340029 , 340152 , 340748 , 344360 , 347006 , 347009 , 390709 , 390719 |
| CVE-2019-8943 | WordPress Crop-image Shell Upload | WordPress | 6.5 (v3.1) | Medium | 340006 , 340007 , 340029 , 340152 , 340748 , 344360 , 347006 , 347009 , 390709 , 390719 |
| CVE-2019-8903 | Totaljs <3.2.3 - Local File Inclusion | total.js | 7.5 (v3.0) | High | 346019 |
| CVE-2019-8394 | ManageEngine ServiceDesk Plus Arbitrary File Upload | manageengine servicedesk plus | 6.5 (v3.1) | Medium | 340007 , 345493 |
| CVE-2019-1003005 | Jenkins ACL Bypass and Metaprogramming RCE | script security | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2018-17431 | Comodo Unified Threat Management Web Console - Remote Code Execution | unified threat management firewall | 9.8 (v3.1) | Critical | 344361 , 344362 , 344364 , 390722 |
| CVE-2019-3911 | LabKey Server Community Edition <18.3.0 - Cross-Site Scripting | labkey server | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-6802 | Pypiserver <1.2.5 - Carriage Return Line Feed Injection | pypiserver | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2019-1003000 | Jenkins ACL Bypass and Metaprogramming RCE | script security | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2019-1003001 | Jenkins ACL Bypass and Metaprogramming RCE | [pipeline](vendors/jenkins/pipeline.md) | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2019-1003002 | Jenkins ACL Bypass and Metaprogramming RCE | [pipeline](vendors/jenkins/pipeline.md) | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2019-5893 | OpenSource ERP 6.3.1. - SQL Injection | open source erp | 9.8 (v3.0) | Critical | 341250 , 344366 |
| CVE-2018-16167 | LogonTracer <=1.2.0 - Remote Command Injection | logontracer | 9.8 (v3.0) | Critical | 340014 , 344364 , 344366 |
| CVE-2018-20463 | WordPress JSmol2WP <=1.07 - Local File Inclusion | jsmol2wp | 7.5 (v3.0) | High | 340007 , 340077 , 340165 , 344360 , 381206 |
| CVE-2018-20462 | WordPress JSmol2WP <=1.07 - Cross-Site Scripting | jsmol2wp | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2018-20418 | Craft CMS 3.0.25 - Cross-Site Scripting | craft cms | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 344365 , 346755 |
| CVE-2018-20367 | WSTMart 2.0.8 - Cross-Site Scripting | wstmart | 6.1 (v3.0) | Medium | 345493 |
| CVE-2018-17246 | Kibana - Local File Inclusion | kibana | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-1000856 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-19933 | Bolt CMS < 3.6.2 - Cross-Site Scripting | bolt cms | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2018-18923 | Ticketly 1.0 - 'kind_id' SQL Injection | ticketly | 9.8 (v3.0) | Critical | 340156 , 380122 |
| CVE-2018-1821 | IBM Operational Decision Manager 8.x - XML External Entity Injection | operational decision manager | 9.1 (v3.0) | Critical | 330791 , 340152 , 345493 |
| CVE-2018-8033 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.0) | High | 341256 , 344370 , 344372 |
| CVE-2018-7690 | Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure | fortify software security center | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-7691 | Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2) | fortify software security center | 6.5 (v3.0) | Medium | 330791 , 340152 |
| CVE-2018-19439 | Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting | secure global desktop | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2018-20062 | ThinkPHP Multiple PHP Injection RCEs | nonecms | 9.8 (v3.1) | Critical | 393753 |
| CVE-2018-1000861 | Jenkins ACL Bypass and Metaprogramming RCE | jenkins | 9.8 (v3.1) | Critical | 344361 , 344363 , 344370 , 390722 |
| CVE-2018-20009 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-20010 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-20011 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19892 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19914 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-19915 | DomainMOD <=4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-1000859 | php imap_open Remote Code Execution | - | N/A | N/A | 344362 , 344363 |
| CVE-2018-19753 | Tarantella Enterprise <3.11 - Local File Inclusion | tarantella enterprise | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-19877 | Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting | loganalyzer | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 , 360030 |
| CVE-2018-1002000 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 7.2 (v3.0) | High | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002001 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002002 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002003 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002004 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002005 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002006 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002007 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002008 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002009 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-19749 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-19751 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19752 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-19518 | php imap_open Remote Code Execution | php | 7.5 (v3.1) | High | 344362 , 344363 |
| CVE-2018-19458 | PHP Proxy 3.0.3 - Local File Inclusion | php-proxy | 7.5 (v3.0) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2018-19422 | Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE | subrion cms | 7.2 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2018-19326 | Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion | vmg1312-b10d firmware | 7.5 (v3.0) | High | 347009 |
| CVE-2018-18755 | K-iwi Framework 1775 - SQL Injection | k-iwi | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 340157 , 341155 , 341245 , 344361 , 360147 , 360148 , 380026 |
| CVE-2018-18761 | SaltOS Erp Crm 3.1 r8126 - SQL Injection | saltos | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 340156 , 340157 , 341155 , 341245 , 360147 , 380026 |
| CVE-2018-18763 | SaltOS Erp Crm 3.1 r8126 - SQL Injection (2) | saltos | 9.8 (v3.0) | Critical | 331028 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 |
| CVE-2018-18795 | School Event Management System 1.0 - SQL Injection | school event management system | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2018-18801 | E-Negosyo System 1.0 - SQL Injection | bsen ordering software | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2018-18760 | RhinOS CMS 3.x - Arbitrary File Download | rhinos | 6.5 (v3.0) | Medium | 334168 , 344360 |
| CVE-2018-19287 | WordPress Ninja Forms <3.3.18 - Cross-Site Scripting | ninja forms | 6.1 (v3.0) | Medium | 333141 , 340099 , 340148 , 341099 , 346755 , 347198 |
| CVE-2018-15708 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical | 340128 , 344370 , 360152 , 380018 , 390720 , 390801 , 390904 |
| CVE-2018-7357 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High | 330791 , 334168 , 340152 |
| CVE-2018-7358 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High | 330791 , 334168 , 340152 |
| CVE-2018-15710 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 7.8 (v3.0) | High | 340128 , 344370 , 360152 , 380018 , 390720 , 390801 , 390904 |
| CVE-2018-19207 | WordPress WP GDPR Compliance Plugin Privilege Escalation | wp-gdpr-compliance | 9.8 (v3.0) | Critical | 347150 |
| CVE-2018-19136 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2018-19137 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2018-18925 | Gogs (Go Git Service) 0.11.66 - Remote Code Execution | gogs | 9.8 (v3.0) | Critical | 344360 |
| CVE-2018-18775 | Microstrategy Web 7 - Cross-Site Scripting | microstrategy web | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-18777 | Microstrategy Web 7 - Local File Inclusion | microstrategy web | 4.3 (v3.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-18850 | Octopus Deploy Authenticated Code Execution | octopus server | 8.8 (v3.0) | High | 330791 , 340152 |
| CVE-2017-18349 | Fastjson Insecure Deserialization - Remote Code Execution | fastjson | 9.8 (v3.0) | Critical | 344380 , 344385 , 398008 |
| CVE-2018-18608 | DedeCMS 5.7 SP2 - Cross-Site Scripting | dedecms | 6.1 (v3.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2015-4632 | Koha 3.20.1 - Directory Traversal | koha | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2018-10823 | D-Link Routers - Remote Command Injection | dwr-116 firmware | 8.8 (v3.1) | High | 347009 |
| CVE-2018-10822 | D-Link Routers - Local File Inclusion | dwr-116 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2018-3238 | Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting | webcenter sites | 6.9 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-3167 | Oracle E-Business Suite - Blind SSRF | application management pack | 5.3 (v3.0) | Medium | 392301 |
| CVE-2018-18308 | BigTree CMS 4.2.23 - Cross-Site Scripting | bigtree cms | 6.1 (v3.0) | Medium | 345493 |
| CVE-2018-18323 | Centos Web Panel 0.9.8.480 - Local File Inclusion | webpanel | 7.5 (v3.0) | High | 344360 , 347009 |
| CVE-2018-10141 | Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting | pan-os | 6.1 (v3.0) | Medium | 346755 |
| CVE-2018-12596 | Ektron CMS 9.20 SP2 - Improper Access Restrictions | ektron cms | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-12455 | Intelbras NPLUG 1.0.0.14 - Authentication Bypass | nplug | 8.1 (v3.0) | High | 390716 |
| CVE-2018-8006 | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting | activemq | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-17440 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 9.8 (v3.0) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17442 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 8.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17441 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17443 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-18069 | WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting | wpml | 6.1 (v3.0) | Medium | 392301 |
| CVE-2018-17552 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 9.8 (v3.0) | Critical | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2018-17553 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 8.8 (v3.0) | High | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2018-17587 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5750 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17588 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5021 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17590 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5442 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17591 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5343v2 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17593 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5453 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17310 | RICOH MP C1803 JPN Printer - Cross-Site Scripting | mp c1803 jpn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2018-17313 | RICOH MP C1803 JPN Printer - Cross-Site Scripting | mp c307 firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2018-15961 | Adobe ColdFusion CKEditor unrestricted file upload | coldfusion | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2018-16283 | WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion | wechat brodcast | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-16299 | WordPress Localize My Post 1.0 - Local File Inclusion | localize my post | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-17173 | LG Supersign EZ CMS - Remote Code Execution | supersign cms | 9.8 (v3.0) | Critical | 340014 , 340029 , 344361 , 344363 , 344370 |
| CVE-2018-16833 | ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting | manageengine desktop central | 6.1 (v3.0) | Medium | 333141 , 342259 , 350147 , 350148 |
| CVE-2018-17254 | Joomla! JCK Editor SQL Injection | jck editor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2018-17207 | Snap Creek Duplicator WordPress plugin code injection | duplicator | 9.8 (v3.1) | Critical | 381206 |
| CVE-2018-17153 | Western Digital MyCloud unauthenticated command injection | my cloud wdbctl0020hwt firmware | 9.8 (v3.0) | Critical | 344363 |
| CVE-2018-17082 | Apache2 - Transfer-Encoding Chunked XSS | php | 6.1 (v3.0) | Medium | 392301 |
| CVE-2018-16288 | LG SuperSign EZ CMS 2.5 - Local File Inclusion | supersign cms | 8.6 (v3.0) | High | 347009 |
| CVE-2018-16979 | Monstra CMS 3.0.4 - HTTP Header Injection | monstra | 6.1 (v3.0) | Medium | 330708 , 390722 |
| CVE-2018-16836 | Rubedo CMS <=3.4.0 - Directory Traversal | rubedo | 9.8 (v3.1) | Critical | 347009 |
| CVE-2018-16763 | FUEL CMS 1.4.1 - Remote Code Execution | fuel cms | 9.8 (v3.1) | Critical | 340023 , 344360 , 344370 , 347009 , 380026 |
| CVE-2018-16736 | Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting | rcfilters | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2018-16363 | WordPress File Manager < 3.0 - Cross-Site Scripting | file manager | 5.4 (v3.0) | Medium | 341266 , 346755 , 377360 |
| CVE-2018-16059 | WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion | wirelesshart fieldgate swg70 firmware | 5.3 (v3.0) | Medium | 392301 |
| CVE-2015-9266 | Ubiquiti airOS Arbitrary File Upload | airmax ac firmware | 9.8 (v3.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2018-15917 | Jorani Leave Management System 0.6.5 - Cross-Site Scripting | jorani | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-16159 | WordPress Gift Voucher <4.1.8 - Blind SQL Injection | gift vouchers | 9.8 (v3.0) | Critical | 380122 |
| CVE-2018-15745 | Argus Surveillance DVR 4.0.0.0 - Directory Traversal | dvr | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-17762 | Episerver 7 - Blind XML External Entity Injection | episerver | 7.5 (v3.0) | High | 344372 |
| CVE-2018-16134 | Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting | cybrohttpserver | 6.1 (v3.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2018-16133 | Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal | cybrohttpserver | 5.3 (v3.0) | Medium | 340006 , 344365 , 347019 , 390716 |
| CVE-2018-15884 | RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin) | mp c4504ex firmware | 8.8 (v3.0) | High | 350147 |
| CVE-2018-15877 | Wordpress Plainview Activity Monitor RCE | plainview activity monitor | 8.8 (v3.1) | High | 344361 , 344364 , 344366 |
| CVE-2018-15535 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 7.5 (v3.0) | High | 340007 , 344360 , 344370 , 345493 , 347009 , 390709 , 390720 , 390727 , 392301 , 392648 |
| CVE-2018-15536 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 5.5 (v3.0) | Medium | 340007 , 344360 , 344370 , 345493 , 347009 , 390709 , 390720 , 390727 , 392301 , 392648 |
| CVE-2018-11776 | Apache Struts2 S2-057 - Remote Code Execution | struts | 8.1 (v3.1) | High | 337209 , 337211 , 340193 , 347009 |
| CVE-2018-15534 | Geutebrueck re_porter 7.8.974.20 - Credential Disclosure | re porter 16 firmware | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-14058 | Pimcore Gather Credentials via SQL Injection | pimcore | 6.5 (v3.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 |
| CVE-2018-11511 | ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection | asustor data master | 9.8 (v3.0) | Critical | 341245 , 380026 , 380122 |
| CVE-2018-15138 | LG-Ericsson iPECS NMS 30M - Local File Inclusion | ipecs nms | 7.5 (v3.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2016-4975 | Apache mod_userdir CRLF injection | http server | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2018-15142 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 8.8 (v3.0) | High | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2018-15140 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2018-15141 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2018-11770 | Apache Spark Unauthenticated Command Execution | spark | 4.2 (v3.1) | Medium | 330791 , 340152 , 340162 , 340163 |
| CVE-2018-15133 | PHP Laravel Framework token Unserialize Remote Command Execution | laravel | 8.1 (v3.1) | High | 390709 |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 8.8 (v3.0) | High | 333141 , 341256 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2018-14933 | NUUO NVRmini upgrade_handle.php Remote Command Execution | nvrmini firmware | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390801 |
| CVE-2018-14728 | Responsive filemanager 9.13.1 Server-Side Request Forgery | responsive filemanager | 9.8 (v3.0) | Critical | 392301 |
| CVE-2018-14912 | cgit Directory Traversal | cgit | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-1612 | IBM QRadar SIEM Unauthenticated Remote Code Execution | qradar security information and event manager | 5.8 (v3.0) | Medium | 330791 , 340152 |
| CVE-2018-13980 | Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion | zeta producer | 5.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-14064 | VelotiSmart Wifi - Directory Traversal | velotismart wifi firmware | 9.8 (v3.0) | Critical | 347009 |
| CVE-2016-6563 | Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow | dir-823 firmware | 9.8 (v3.0) | Critical | 381237 |
| CVE-2018-12463 | Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection | fortify software security center | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2018-8024 | Apache Spark UI - Cross-Site Scripting | spark | 5.4 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-7765 | Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection | u.motion builder | 8.8 (v3.0) | High | 341245 , 344364 , 344366 |
| CVE-2018-12998 | Zoho manageengine - Cross-Site Scripting | firewall analyzer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-12909 | Webgrind <= 1.5 - Local File Inclusion | webgrind | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2018-1306 | Apache Portals Pluto 3.0.0 - Remote Code Execution | pluto | 7.5 (v3.0) | High | 390727 , 392648 |
| CVE-2018-12895 | Wordpress Arbitrary File Deletion | WordPress | 8.8 (v3.1) | High | 336461 , 340007 , 340748 , 344360 , 347006 , 381206 , 390709 |
| CVE-2018-3760 | Ruby On Rails - Local File Inclusion | cloudforms | 7.5 (v3.0) | High | 347009 |
| CVE-2018-10956 | IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion | orchid core vms | 7.5 (v3.0) | High | 347009 |
| CVE-2018-12613 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 8.8 (v3.1) | High | 340007 , 340087 , 344360 , 347009 , 390709 , 390728 , 390801 |
| CVE-2018-8727 | Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion | dvms workstation | 7.5 (v3.0) | High | 390716 |
| CVE-2015-4664 | Xceedium Xsuite - Multiple Vulnerabilities | privileged access manager | 9.8 (v3.0) | Critical | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2018-11222 | Pandora FMS <=7.0NG.722 - Remote Code Execution | pandora fms | 7.5 (v3.0) | High | 390726 , 392647 |
| CVE-2018-6671 | McAfee ePO 5.9.1 - Registered Executable Local Access Bypass | epolicy orchestrator | 6.5 (v3.0) | Medium | 344364 , 344365 , 344366 |
| CVE-2018-6961 | VMware NSX SD-WAN Edge - Command Injection | nsx sd-wan edge | 8.1 (v3.1) | High | 344363 , 393655 |
| CVE-2018-12111 | Canon PrintMe EFI - Cross-Site Scripting | efi printme | 6.1 (v3.0) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2018-12095 | OEcms 3.1 - Cross-Site Scripting | oecms | 5.4 (v3.0) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2018-12054 | Schools Alert Management Script - Arbitrary File Read | schools alert management script | 7.5 (v3.0) | High | 344360 |
| CVE-2018-12031 | Eaton Intelligent Power Manager 1.6 - Directory Traversal | intelligent power manager | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-3714 | node-srv - Local File Inclusion | node-srv | 6.5 (v3.1) | Medium | 347009 |
| CVE-2018-11709 | WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting | wpforo forum | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-11133 | Quest KACE SMA /common/run_cross_report.php 'fmt' XSS | kace system management appliance | 6.1 (v3.0) | Medium | 346755 |
| CVE-2018-11535 | Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection | slac | 9.8 (v3.0) | Critical | 331028 , 340016 , 340155 , 340157 , 340159 , 341155 , 341245 , 342259 , 344370 , 345493 , 360147 , 360148 , 380026 |
| CVE-2018-11442 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High | 340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147 |
| CVE-2018-11445 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High | 340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147 |
| CVE-2018-11231 | Opencart Divido - Sql Injection | divido | 8.1 (v3.0) | High | 392301 |
| CVE-2018-10094 | Dolibarr Gather Credentials via SQL Injection | dolibarr | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2018-10095 | Dolibarr <7.0.2 - Cross-Site Scripting | dolibarr | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2018-10735 | NagiosXI <= 5.4.12 commandline.php SQL injection | nagios xi | 7.2 (v3.0) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2018-10736 | NagiosXI <= 5.4.12 - SQL injection | nagios xi | 7.2 (v3.0) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2018-10737 | NagiosXI <= 5.4.12 logbook.php SQL injection | nagios xi | 7.2 (v3.0) | High | 331028 , 340155 , 341155 , 341245 |
| CVE-2018-10738 | NagiosXI <= 5.4.12 menuaccess.php - SQL injection | nagios xi | 7.2 (v3.0) | High | 331028 , 340016 , 340155 , 340157 , 340159 , 341155 , 341245 , 360147 , 360148 , 380026 |
| CVE-2018-5230 | Atlassian Jira Confluence - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 340112 , 340147 , 346755 |
| CVE-2015-1503 | IceWarp Mail Server < 11.1.1 - Directory Traversal | mail server | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 , 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2018-1247 | RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting | authentication manager | 7.1 (v3.0) | High | 392301 |
| CVE-2018-10562 | Dasan GPON Devices - Remote Code Execution | gpon router firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2018-9302 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-1418 | IBM QRadar SIEM Unauthenticated Remote Code Execution | qradar security information and event manager | 8.8 (v3.0) | High | 330791 , 340152 |
| CVE-2018-1335 | Apache Tika Header Command Injection | tika | 8.1 (v3.0) | High | 340138 , 391213 |
| CVE-2018-10201 | Ncomputing vSPace Pro 10 and 11 - Directory Traversal | vspace pro | 7.5 (v3.0) | High | 344365 , 390716 |
| CVE-2018-10230 | Zend Server <9.13 - Cross-Site Scripting | zend server | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-8733 | Nagios XI Chained Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical | 331028 , 334168 , 340016 , 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344361 , 344363 , 344364 , 344370 , 360147 , 360148 , 380026 , 390700 , 390703 |
| CVE-2018-8734 | Nagios XI Chained Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical | 331028 , 334168 , 340016 , 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344361 , 344363 , 344364 , 344370 , 360147 , 360148 , 380026 , 390700 , 390703 |
| CVE-2018-8735 | Nagios XI Chained Remote Code Execution | nagios xi | 8.8 (v3.0) | High | 331028 , 334168 , 340016 , 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344361 , 344363 , 344364 , 344370 , 360147 , 360148 , 380026 , 390700 , 390703 |
| CVE-2018-8736 | Nagios XI Chained Remote Code Execution | nagios xi | 8.8 (v3.0) | High | 331028 , 334168 , 340016 , 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344361 , 344363 , 344364 , 344370 , 360147 , 360148 , 380026 , 390700 , 390703 |
| CVE-2017-0372 | MediaWiki SyntaxHighlight extension option injection vulnerability | mediawiki | 9.8 (v3.0) | Critical | 344370 |
| CVE-2018-9118 | WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion | wp background takeover advertisements | 7.5 (v3.0) | High | 336461 , 344360 , 381206 |
| CVE-2018-1273 | Spring Data Commons - Remote Code Execution | spring data commons | 9.8 (v3.1) | Critical | 344360 , 344370 |
| CVE-2018-10054 | H2 Web Interface Create Alias RCE | datomic | 8.8 (v3.1) | High | 337209 , 337211 , 340014 , 344370 |
| CVE-2017-14611 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-9038 | Monstra CMS 3.0.4 - Arbitrary Folder Deletion | monstra | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-1217 | Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control | emc avamar | 9.8 (v3.0) | Critical | 391213 |
| CVE-2018-1271 | Spring MVC Framework - Local File Inclusion | spring framework | 5.9 (v3.1) | Medium | 390716 |
| CVE-2018-9205 | Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion | avatar uploader | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-9238 | Yahei PHP Prober 0.4.7 - Cross-Site Scripting | yahei php prober | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-9160 | SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response | sickrage | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-7171 | TwonkyMedia Server 7.0.11-8.5 - Directory Traversal | twonky server | 7.5 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2018-7203 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting | twonky server | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-7600 | Drupal Drupalgeddon 2 Forms API Property Injection | drupal | 9.8 (v3.1) | Critical | 330791 , 340095 , 340152 , 390755 |
| CVE-2018-7700 | DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution | dedecms | 8.8 (v3.0) | High | 344370 |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-7192 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 344361 , 344364 , 346755 , 347198 |
| CVE-2018-7193 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-7196 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-1213 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 8.8 (v3.0) | High | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2017-15715 | Apache httpd <=2.4.29 - Arbitrary File Upload | http server | 8.1 (v3.0) | High | 344365 |
| CVE-2018-1203 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1204 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-7543 | WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting | duplicator | 6.1 (v3.1) | Medium | 333140 , 340148 , 346755 , 380026 |
| CVE-2018-1186 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1187 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1188 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1189 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1201 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1202 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-7719 | Acrolinx Server <5.2.5 - Local File Inclusion | acrolinx server | 7.5 (v3.0) | High | 347019 |
| CVE-2018-7422 | WordPress Site Editor <=1.1.1 - Local File Inclusion | site editor | 7.5 (v3.0) | High | 336461 , 344360 , 347009 , 381206 , 390709 , 393771 |
| CVE-2018-5233 | Grav CMS <1.3.0 - Cross-Site Scripting | grav cms | 6.1 (v3.0) | Medium | 341266 |
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6328 | Unitrends UEB http api remote code execution | unitrends backup | 9.8 (v3.0) | Critical | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2018-1000130 | Jolokia Agent - JNDI Code Injection | webarchive agent | 8.1 (v3.0) | High | 344362 , 390724 |
| CVE-2018-1000129 | Jolokia 1.3.7 - Cross-Site Scripting | jolokia | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | 7.2 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2018-7538 | Tuleap 9.17.99.189 - Blind SQL Injection | tuleap | 9.8 (v3.0) | Critical | 341245 , 344370 , 380026 , 380122 |
| CVE-2018-6530 | D-Link - Unauthenticated Remote Code Execution | dir-860l firmware | 9.8 (v3.1) | Critical | 330791 , 340152 , 344363 |
| CVE-2018-7653 | YzmCMS v3.6 - Cross-Site Scripting | yzmcms | 6.1 (v3.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2015-4117 | Vesta Control Panel 0.9.8 - OS Command Injection | control panel | 8.8 (v3.0) | High | 344370 |
| CVE-2018-7448 | CMS Made Simple 2.1.6 - Remote Code Execution | cms made simple | 7.5 (v3.0) | High | 344363 , 360152 , 390704 , 390724 |
| CVE-2018-7490 | uWSGI PHP Plugin Local File Inclusion | uwsgi | 7.5 (v3.0) | High | 347009 |
| CVE-2014-3206 | Seagate BlackArmor NAS - Command Injection | blackarmor nas 220 firmware | 9.8 (v3.0) | Critical | 311235 , 340014 , 340193 , 344364 , 344366 |
| CVE-2018-7314 | Joomla! Component PrayerCenter 3.0.2 - SQL Injection | prayercenter | 9.8 (v3.0) | Critical | 340157 , 341245 , 360147 , 360148 |
| CVE-2015-6544 | Combodo iTop <2.2.0-2459 - Cross-Site Scripting | itop | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390703 |
| CVE-2018-7251 | Anchor CMS 0.12.3 - Error Log Exposure | anchor | 9.8 (v3.0) | Critical | 390716 |
| CVE-2017-14535 | Trixbox - 2.8.0.4 OS Command Injection | trixbox | 8.8 (v3.1) | High | 340023 , 344360 , 344361 , 344363 , 347009 |
| CVE-2017-14537 | Trixbox 2.8.0 - Path Traversal | trixbox | 6.5 (v3.1) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2017-12542 | HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation | integrated lights-out 4 firmware | 10.0 (v3.0) | Critical | 330791 , 340152 |
| CVE-2017-5799 | HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion | opencall media platform | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-5798 | HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion | opencall media platform | 6.1 (v3.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-12544 | HPE System Management - Cross-Site Scripting | system management homepage | 5.4 (v3.0) | Medium | 344366 |
| CVE-2018-2392 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High | 330791 , 334168 , 340152 , 344372 , 344373 , 390719 |
| CVE-2018-2393 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High | 330791 , 334168 , 340152 , 344372 , 344373 , 390719 |
| CVE-2018-0127 | Cisco RV132W/RV134W Router - Information Disclosure | rv132w firmware | 9.8 (v3.1) | Critical | 312863 , 390716 |
| CVE-2018-6605 | Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection | zh baidumap | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2018-6008 | Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion | jtag members directory | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-17976 | PerfexCRM 1.9.7 - Arbitrary File Upload | perfex crm | 9.8 (v3.0) | Critical | 392301 |
| CVE-2017-14523 | Wonder CMS 2.3.1 - 'Host' Header Injection | wondercms | 7.5 (v3.0) | High | 392301 |
| CVE-2018-6184 | Zeit Next.js < 4.2.3 - Local File Inclusion | next.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-17999 | RISE 1.9 - 'search' SQL Injection | rise ultimate project manager | 9.8 (v3.0) | Critical | 341245 , 380026 , 380122 , 390724 |
| CVE-2017-18048 | Monstra CMS Authenticated Arbitrary File Upload | monstra | 8.8 (v3.0) | High | 390700 |
| CVE-2018-5999 | AsusWRT LAN Unauthenticated Remote Code Execution | asuswrt | 9.8 (v3.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2018-6000 | AsusWRT LAN Unauthenticated Remote Code Execution | asuswrt | 9.8 (v3.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2016-10709 | pfSense authenticated graph status RCE | pfsense | 8.8 (v3.0) | High | 344361 , 344364 , 344366 |
| CVE-2017-14094 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 9.8 (v3.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2017-14097 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 9.8 (v3.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2017-11398 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 8.8 (v3.0) | High | 330791 , 340007 , 340152 |
| CVE-2017-14095 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 8.1 (v3.0) | High | 330791 , 340007 , 340152 |
| CVE-2017-14096 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 6.1 (v3.0) | Medium | 330791 , 340007 , 340152 |
| CVE-2018-5715 | SugarCRM 3.5.1 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium | 340147 , 340148 , 341245 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-17970 | Muviko 1.1 - SQL Injection | muviko | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340156 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2017-18024 | AvantFAX 3.3.3 - Cross-Site Scripting | avantfax | 6.1 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2016-9722 | IBM QRadar SIEM Unauthenticated Remote Code Execution | qradar security information and event manager | 4.2 (v3.0) | Medium | 330791 , 340152 |
| CVE-2018-5316 | WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting | sagepay server gateway for woocommerce | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-16666 | Xplico Remote Code Execution | xplico | 8.8 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 380018 , 390801 |
| CVE-2017-9965 | Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal | pelco videoxpert | 5.8 (v3.0) | Medium | 344365 , 390716 |
| CVE-2018-3810 | Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass | smart google code inserter | 9.8 (v3.0) | Critical | 380026 |
| CVE-2017-18001 | Trustwave SWG 11.8.0.27 - SSH Unauthorized Access | secure web gateway | 9.8 (v3.0) | Critical | 330039 , 330791 , 340152 |
| CVE-2017-5254 | Cambium ePMP 1000 Account Password Reset | epmp 1000 firmware | 8.8 (v3.0) | High | 340362 |
| CVE-2017-5261 | Cambium cnPilot r200/r201 File Path Traversal | cnpilot r190v firmware | 8.8 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-16949 | Accesspress Anonymous Post Pro < 3.2.0 - Arbitrary File Upload | anonymous post pro | 9.8 (v3.0) | Critical | 345493 |
| CVE-2017-17105 | Zivif Camera iptest.cgi Blind Remote Command Execution | pr115-204-p-rs firmware | 9.8 (v3.0) | Critical | 393655 |
| CVE-2017-17731 | DedeCMS 5.7 - SQL Injection | dedecms | 9.8 (v3.0) | Critical | 344370 |
| CVE-2017-17672 | vBulletin 5.x - 'cacheTemplates' Remote Arbitrary File Deletion | vbulletin | 9.8 (v3.0) | Critical | 344370 , 390614 |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | 9.8 (v3.0) | Critical | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2017-17562 | GoAhead Web Server LD_PRELOAD Arbitrary Module Load | goahead | 8.1 (v3.1) | High | 344360 |
| CVE-2017-17451 | WordPress Mailster <=1.5.4 - Cross-Site Scripting | wp mailster | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2017-17092 | WordPress < 4.9.1 - Authenticated JavaScript File Upload | WordPress | 5.4 (v3.0) | Medium | 377360 |
| CVE-2017-17059 | WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting | amtythumb | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 , 392301 |
| CVE-2017-14186 | FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium | 346755 , 350148 |
| CVE-2017-17043 | WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting | emag marketplace connector | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-16935 | Ametys CMS 4.0.2 - Password Reset | ametys | 9.8 (v3.0) | Critical | 345493 , 390724 |
| CVE-2015-3934 | Fiyo CMS 2.0_1.9.1 - SQL Injection | fiyo cms | 9.8 (v3.0) | Critical | 341245 , 344366 , 380026 , 380122 |
| CVE-2017-16894 | PHP Laravel Framework token Unserialize Remote Command Execution | laravel | 7.5 (v3.0) | High | 390709 |
| CVE-2017-1000170 | WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion | jqueryfiletree | 7.5 (v3.1) | High | 392301 |
| CVE-2017-16877 | Nextjs <2.4.1 - Local File Inclusion | next.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-1000163 | Phoenix Framework - Open Redirect | phoenix | 6.1 (v3.0) | Medium | 344365 |
| CVE-2017-12635 | CouchDB Enum Utility | couchdb | 9.8 (v3.0) | Critical | 341245 , 391213 , 392301 |
| CVE-2017-12636 | Apache CouchDB Arbitrary Command Execution | couchdb | 7.2 (v3.0) | High | 341245 |
| CVE-2017-16806 | Ulterius Server File Download Vulnerability | ulterius server | 7.5 (v3.0) | High | 347009 , 390709 , 390716 |
| CVE-2015-7501 | Red Hat JBoss - Insecure Deserialization | jboss enterprise application platform | 9.8 (v3.0) | Critical | 344380 |
| CVE-2017-16651 | Roundcube TimeZone Authenticated File Disclosure | webmail | 7.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2015-3933 | GeniXCMS 0.0.3 - 'register.php' SQL Injection | genixcms | 9.8 (v3.0) | Critical | 331028 , 331702 , 340016 , 340017 , 340155 , 340157 , 340159 , 341155 , 341245 , 344365 , 360147 , 360148 , 360152 , 380026 , 390720 , 390724 , 390726 , 392647 |
| CVE-2017-11512 | ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval | servicedesk | 7.5 (v3.0) | High | 340007 , 344365 , 347019 |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.8 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2012-5357 | Ektron 8.02 XSLT Transform Remote Code Execution | ektron content management system | 9.8 (v3.0) | Critical | 341256 , 342259 , 344370 , 360151 |
| CVE-2017-7411 | Tuleap 9.6 Second-Order PHP Object Injection | tuleap | 8.8 (v3.0) | High | 340011 , 340128 , 380018 , 390801 |
| CVE-2014-1203 | Eyou E-Mail <3.6 - Remote Code Execution | eyou | 9.8 (v3.1) | Critical | 340023 , 341245 , 344360 , 344361 , 344363 , 344370 |
| CVE-2014-3744 | Node.js st module Directory Traversal | node.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-15687 | Logitech Media Server - Cross-Site Scripting | media server | 6.1 (v3.0) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2017-10366 | Oracle PeopleSoft 8.5x - Remote Code Execution | peoplesoft enterprise peopletools | 9.8 (v3.0) | Critical | 390703 , 392301 |
| CVE-2017-10271 | Oracle WebLogic Server - Remote Command Execution | weblogic server | 7.5 (v3.1) | High | 344362 , 344363 , 344364 , 344366 |
| CVE-2017-15647 | FiberHome Routers - Local File Inclusion | routerfiberhome firmware | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2017-15643 | Ikraus Anti Virus 2.16.7 - Remote Code Execution | ikarus antivirus | 7.4 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2014-8357 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9118 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9148 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 9.8 (v3.0) | Critical | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-9147 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 7.5 (v3.0) | High | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2017-15363 | Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion | restler | 7.5 (v3.1) | High | 340007 |
| CVE-2017-15287 | Dreambox WebControl 2.0.0 - Cross-Site Scripting | bouqueteditor | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-1000119 | October CMS Upload Protection Bypass Code Execution | october | 7.2 (v3.0) | High | 390700 |
| CVE-2017-12149 | JBoss Vulnerability Scanner | jboss enterprise application platform | 9.8 (v3.1) | Critical | 330925 |
| CVE-2017-12617 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High | 345493 , 392301 |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | 8.8 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 391746 |
| CVE-2017-14955 | Check_MK 1.2.8p25 - Information Disclosure | checkmk | 5.9 (v3.1) | Medium | 330791 , 340152 |
| CVE-2017-14942 | Intelbras WRN 150 - Authentication Bypass | wrn150 | 9.8 (v3.0) | Critical | 390716 |
| CVE-2017-14849 | Node.js <8.6.0 - Directory Traversal | node.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-14622 | WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting | 2kb amazon affiliates store | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2015-4667 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 9.8 (v3.0) | Critical | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4669 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 7.8 (v3.0) | High | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4668 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 6.1 (v3.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2017-14725 | WordPress < 4.8.2 - Authenticated Open Redirect | WordPress | 5.4 (v3.0) | Medium | 377360 |
| CVE-2015-1187 | D-Link/TRENDnet NCC Service Command Injection | dir-626l firmware | 9.8 (v3.1) | Critical | 344363 , 344364 , 393655 |
| CVE-2017-14651 | WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting | api manager | 4.8 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2017-12611 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.0) | Critical | 337207 , 337209 , 337211 , 337218 , 340014 , 340029 , 340193 , 344360 , 344362 , 344363 , 344370 , 347009 |
| CVE-2015-4074 | Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion | helpdesk pro | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2015-2826 | WordPress Plugin Simple Ads Manager - Information Disclosure | simple ads manager | 5.3 (v3.0) | Medium | 344370 , 390904 |
| CVE-2014-8684 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical | 340095 , 340128 , 344370 , 346755 , 380018 , 390801 |
| CVE-2014-8686 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical | 340095 , 340128 , 344370 , 346755 , 380018 , 390801 |
| CVE-2015-4683 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 9.8 (v3.0) | Critical | 330791 , 340152 , 392301 |
| CVE-2017-12615 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High | 337209 , 337210 , 337211 , 340095 , 340128 , 344360 , 345493 , 347009 , 380018 , 380026 , 390904 , 392301 |
| CVE-2015-4681 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 7.8 (v3.0) | High | 330791 , 340152 , 392301 |
| CVE-2015-4685 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 7.0 (v3.0) | High | 330791 , 340152 , 392301 |
| CVE-2015-4682 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 6.5 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2015-4684 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 6.5 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9805 | Apache Struts 2 REST Plugin XStream RCE | struts | 8.1 (v3.1) | High | 344360 , 344361 , 344363 , 344364 , 344366 |
| CVE-2017-14335 | Hanbanggaoke IP Camera - Arbitrary Password Change | hb7024xt firmware | 7.5 (v3.0) | High | 345493 |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2015-8349 | SourceBans <2.0 - Cross-Site Scripting | sourcebans | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-8350 | WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS | call to action | 6.1 (v3.0) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2017-9834 | WordPress Plugin WatuPRO 5.5.1 - SQL Injection | watupro | 9.8 (v3.0) | Critical | 340156 , 380122 |
| CVE-2017-12794 | Django Debug Page - Cross-Site Scripting | django | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2017-14135 | OpenDreambox 2.0.0 - Remote Code Execution | opendreambox | 9.8 (v3.0) | Critical | 344364 |
| CVE-2014-8675 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 7.5 (v3.0) | High | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2017-7855 | IceWarp WebMail 11.3.1.5 - Cross-Site Scripting | server | 6.1 (v3.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2014-8676 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.3 (v3.0) | Medium | 331028 , 340007 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344360 , 344363 , 344370 , 347009 , 360147 , 360148 , 360153 , 390709 , 390726 , 392647 |
| CVE-2014-8677 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.3 (v3.0) | Medium | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2014-9312 | WordPress Photo Gallery Unrestricted File Upload | photo gallery | 8.8 (v3.0) | High | 330791 , 334168 , 340152 , 382238 |
| CVE-2017-9979 | QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities | quantastor | 6.1 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9978 | QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities | quantastor | 5.3 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9640 | Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write | i-vu | 6.3 (v3.0) | Medium | 390727 , 390904 , 392301 , 392648 |
| CVE-2017-11317 | Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization | ui for asp.net ajax | 9.8 (v3.1) | Critical | 330791 , 334168 , 340152 |
| CVE-2017-11610 | XML-RPC Server - Remote Code Execution | supervisor | 8.8 (v3.0) | High | 344364 |
| CVE-2017-9506 | Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery | oauth | 6.1 (v3.0) | Medium | 382291 |
| CVE-2015-2857 | Accellion FTA getStatus verify_oauth_token Command Execution | file transfer appliance | 9.8 (v3.1) | Critical | 340128 , 360152 , 380018 , 390801 |
| CVE-2017-10075 | Oracle Content Server - Cross-Site Scripting | webcenter content | 8.2 (v3.0) | High | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2017-12478 | Unitrends UEB http api remote code execution | unitrends backup | 9.8 (v3.1) | Critical | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2017-12583 | DokuWiki - Cross-Site Scripting | dokuwiki | 6.1 (v3.0) | Medium | 333141 , 346755 , 347198 |
| CVE-2017-11629 | FineCMS <=5.0.10 - Cross-Site Scripting | finecms | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2017-9413 | Subsonic 6.1.1 - Server-Side Request Forgery | subsonic | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-11467 | OrientDB 2.2.x Remote Code Execution | orientdb | 9.8 (v3.0) | Critical | 340095 |
| CVE-2017-9822 | DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution | dotnetnuke | 8.8 (v3.1) | High | 344365 , 344370 |
| CVE-2017-11444 | Subrion CMS <4.1.5.10 - SQL Injection | subrion cms | 9.8 (v3.0) | Critical | 341245 |
| CVE-2017-11456 | Geneko Routers - Path Traversal | gwr352 3g router firmware | 7.5 (v3.0) | High | 346019 |
| CVE-2017-1000002 | ATutor 2.2.1 Directory Traversal / Remote Code Execution | atutor | 9.8 (v3.0) | Critical | 320464 , 320465 , 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2017-9811 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 9.8 (v3.0) | Critical | 390704 , 390724 |
| CVE-2017-9810 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 8.8 (v3.0) | High | 390704 , 390724 |
| CVE-2017-1000028 | Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High | 347009 , 390716 |
| CVE-2017-1000029 | Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High | 347009 |
| CVE-2017-9812 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 7.5 (v3.0) | High | 390704 , 390724 |
| CVE-2017-9813 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 6.1 (v3.0) | Medium | 390704 , 390724 |
| CVE-2017-11165 | DataTaker DT80 dEX 1.50.012 - Information Disclosure | dt80 dex firmware | 9.8 (v3.1) | Critical | 390716 |
| CVE-2017-9791 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.1) | Critical | 337207 |
| CVE-2017-11107 | phpLDAPadmin <= 1.2.3 - Reflected XSS | phpldapadmin | 6.1 (v3.1) | Medium | 340147 , 341256 , 341266 , 342259 , 350148 |
| CVE-2017-10974 | Yaws 1.91 - Local File Inclusion | yaws | 7.5 (v3.0) | High | 350591 |
| CVE-2017-9841 | PHPUnit - Remote Code Execution | phpunit | 9.8 (v3.1) | Critical | 392648 , 393782 |
| CVE-2017-9833 | BOA Web Server 0.94.14 - Arbitrary File Access | boa | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2014-8687 | Seagate Business NAS Unauthenticated Remote Command Execution | business nas firmware | 9.8 (v3.0) | Critical | 340095 , 340128 , 344370 , 346755 , 380018 , 390801 |
| CVE-2017-9355 | Subsonic 6.1.1 - XML External Entity Injection | subsonic | 7.4 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-8835 | Peplink Balance routers SQLi | b305hw2 firmware | 9.8 (v3.0) | Critical | 340016 , 340145 , 340156 , 341145 , 341245 |
| CVE-2017-9416 | Odoo 8.0/9.0/10.0 - Local File Inclusion | odoo | 6.5 (v3.0) | Medium | 347009 , 390716 |
| CVE-2017-9288 | WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting | raygun4wp | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-6256 | SAP Business One for Android 1.2.3 - XML External Entity Injection | business one | 9.6 (v3.0) | Critical | 344372 |
| CVE-2017-5868 | OpenVPN Access Server 2.1.4 - CRLF Injection | openvpn access server | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2016-4977 | Spring Security OAuth2 Remote Command Execution | spring security oauth | 8.8 (v3.0) | High | 393655 |
| CVE-2015-4455 | WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload | aviary image editor add-on for gravity forms | 9.8 (v3.0) | Critical | 340007 , 391742 , 391743 |
| CVE-2015-5469 | WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion | mdc youtube downloader | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2017-1092 | IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution | informix open admin tool | 9.8 (v3.0) | Critical | 344363 , 360152 |
| CVE-2017-9140 | Reflected XSS - Telerik Reporting Module | telerik reporting | 6.1 (v3.0) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2017-9101 | PlaySMS import.php Authenticated CSV File Upload Code Execution | playsms | 9.8 (v3.0) | Critical | 330791 , 334168 , 340152 |
| CVE-2017-9080 | PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution | playsms | 8.8 (v3.0) | High | 330791 , 334168 , 340152 , 390700 |
| CVE-2017-9072 | RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting | flatcalendarxp | 6.1 (v3.0) | Medium | 392301 |
| CVE-2017-8917 | Joomla Component Fields SQLi Remote Code Execution | joomla! | 9.8 (v3.0) | Critical | 331028 , 340016 , 340145 , 340155 , 340156 , 340157 , 340159 , 341145 , 341155 , 341245 , 344370 , 360147 , 360148 |
| CVE-2017-8295 | WordPress Core < 4.7.4 - Unauthorized Password Reset | WordPress | 5.9 (v3.0) | Medium | 377360 |
| CVE-2016-10367 | Opsview Monitor Pro - Local File Inclusion | opsview | 7.5 (v3.0) | High | 390709 |
| CVE-2017-5689 | Intel Active Management Technology - System Privileges | proliant ml10 gen9 server firmware | 9.8 (v3.1) | Critical | 390726 , 392647 |
| CVE-2017-5631 | KMCIS CaseAware - Cross-Site Scripting | caseaware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2017-8225 | GoAhead Camera - Credential Disclosure | wireless ip camera (p2p) firmware | 9.8 (v3.0) | Critical | 390716 |
| CVE-2015-0104 | IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution | change and configuration management database | 8.8 (v3.0) | High | 392301 |
| CVE-2015-7245 | D-Link DVG-N5402SP - Local File Inclusion | dvg-n5402sp firmware | 7.5 (v3.0) | High | 392301 |
| CVE-2017-3546 | Oracle PeopleSoft - Server-Side Request Forgery | peoplesoft enterprise peopletools | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2017-3548 | Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE | peoplesoft enterprise peopletools | 6.5 (v3.0) | Medium | 330791 , 340152 |
| CVE-2017-3528 | Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect | applications framework | 5.4 (v3.0) | Medium | 344365 |
| CVE-2016-1555 | Netgear Devices Unauthenticated Remote Command Execution | wnap320 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 392647 |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 7.3 (v3.0) | High | 330791 , 334168 , 340128 , 340133 , 340152 , 343481 , 360152 , 380018 , 390801 |
| CVE-2016-2555 | ATutor 2.2.1 SQL Injection / Remote Code Execution | atutor | 9.8 (v3.0) | Critical | 320464 , 320465 , 334168 , 340006 , 340007 , 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 344360 , 344370 , 347009 , 360147 , 360148 , 390572 , 390709 , 390719 |
| CVE-2016-4337 | Ktools Photostore 4.7.5 - Blind SQL Injection | photostore | 9.8 (v3.0) | Critical | 390726 , 392647 |
| CVE-2016-7547 | Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution | threat discovery appliance | 9.8 (v3.0) | Critical | 340006 , 340014 , 340193 , 344363 , 344364 , 344366 , 344370 |
| CVE-2016-7552 | Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution | threat discovery appliance | 9.8 (v3.0) | Critical | 340006 , 340014 , 340193 , 344363 , 344364 , 344366 , 344370 |
| CVE-2017-7462 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 9.8 (v3.0) | Critical | 330925 , 344360 , 347009 |
| CVE-2017-7461 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 4.9 (v3.0) | Medium | 330925 , 344360 , 347009 |
| CVE-2017-6190 | D-Link DWR-116 / DWR-116A1 - Arbitrary File Download | dwr-116 firmware | 7.5 (v3.0) | High | 347009 , 390727 , 392648 |
| CVE-2017-7185 | Cesanta Mongoose OS - Use-After-Free | mongoose embedded web server library | 7.5 (v3.0) | High | 330791 , 340152 |
| CVE-2017-7581 | TYPO3 News Module SQL Injection | news system | 9.8 (v3.0) | Critical | 340145 , 340156 , 341145 , 360147 , 360148 , 380026 |
| CVE-2017-6884 | Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection | emg2926 firmware | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-7402 | Pixie 1.0.4 - Arbitrary File Upload | pixie | 9.8 (v3.0) | Critical | 345493 |
| CVE-2017-1001000 | WordPress REST API Content Injection | WordPress | 7.5 (v3.0) | High | 390751 , 390753 |
| CVE-2017-7391 | Magmi 0.7.22 - Cross-Site Scripting | magmi | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-5850 | OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service | openbsd | 7.5 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2015-3884 | qdPM v7 Arbitrary PHP File Upload Vulnerability | qdpm | 8.8 (v3.1) | High | 330791 , 334168 , 340133 , 340152 |
| CVE-2017-6443 | EPSON TMNet WebConfig 1.00 - Cross-Site Scripting | tmnet webconfig | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2017-6398 | Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution | interscan messaging security virtual appliance | 8.8 (v3.0) | High | 344364 , 344366 |
| CVE-2017-6823 | Fiyo CMS 2.0.6.1 - Privilege Escalation | fiyo cms | 8.8 (v3.0) | High | 345493 , 390724 |
| CVE-2017-5638 | Apache Struts Jakarta Multipart Parser OGNL Injection | struts | 9.8 (v3.1) | Critical | 332791 , 334168 , 390719 |
| CVE-2017-6527 | DnaLIMS Directory Traversal | dnalims | 7.5 (v3.0) | High | 340007 , 340029 , 344360 , 347009 , 390614 , 390709 |
| CVE-2017-6478 | MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting | mangoswebv4 | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2017-5982 | Kodi 17.0 Local File Inclusion Vulnerability | kodi | 7.5 (v3.0) | High | 347009 |
| CVE-2016-9682 | Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection | sonicwall secure remote access server | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-9269 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 9.9 (v3.0) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9315 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 8.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9314 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 7.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9316 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-10134 | Zabbix toggle_ids SQL Injection | zabbix | 9.8 (v3.0) | Critical | 331028 , 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2017-5146 | Carlo Gavazzi Energy Meters - Login Brute Force, Extract Info and Dump Plant Database | vmu-c em firmware | 7.5 (v3.0) | High | 390716 |
| CVE-2016-10043 | Radisys MRF - Command Injection | web panel | 10.0 (v3.0) | Critical | 341245 |
| CVE-2016-4010 | Magento 2.0.6 Unserialize Remote Code Execution | magento | 9.8 (v3.0) | Critical | 330791 , 340152 , 344365 , 344370 , 390614 |
| CVE-2016-6600 | WebNMS Framework Server Arbitrary File Upload | webnms framework | 9.8 (v3.0) | Critical | 344360 , 347009 , 390709 , 390727 , 392301 , 392648 |
| CVE-2016-6602 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-6603 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-6601 | WebNMS Framework Server Arbitrary Text File Download | webnms framework | 7.5 (v3.0) | High | 344360 , 347009 , 390709 , 390727 , 392301 , 392648 |
| CVE-2016-6897 | WordPress Traversal Directory DoS | WordPress | 6.5 (v3.0) | Medium | 340748 , 344360 , 347006 |
| CVE-2016-7981 | SPIP <3.1.2 - Cross-Site Scripting | spip | 6.1 (v3.0) | Medium | 341256 , 341266 , 346755 |
| CVE-2016-9299 | Jenkins CLI HTTP Java Deserialization Vulnerability | jenkins | 9.8 (v3.0) | Critical | 392648 |
| CVE-2016-4808 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 8.8 (v3.0) | High | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-4806 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 7.5 (v3.0) | High | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-4807 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 4.8 (v3.0) | Medium | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-10108 | Western Digital MyCloud unauthenticated command injection | mycloud nas | 9.8 (v3.0) | Critical | 344363 , 344364 , 344366 |
| CVE-2016-6277 | NETGEAR Routers - Remote Code Execution | d6220 firmware | 8.8 (v3.1) | High | 347009 |
| CVE-2016-3473 | Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection | business intelligence publisher | 7.7 (v3.0) | High | 330791 , 340152 , 344370 , 344372 , 380018 , 390704 , 392301 |
| CVE-2016-1000126 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | admin-font-editor | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000127 | WordPress AJAX Random Post <=2.00 - Cross-Site Scripting | ajax-random-post | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000128 | WordPress anti-plagiarism <=3.60 - Cross-Site Scripting | anti-plagiarism | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000129 | WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting | defa-online-image-protector | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000130 | WordPress e-search <=1.0 - Cross-Site Scripting | e-search | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000131 | WordPress e-search <=1.0 - Cross-Site Scripting | esearch | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000132 | WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting | tooltip glossary | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000133 | WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting | forget about shortcode buttons | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000134 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000135 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000136 | WordPress heat-trackr 1.0 - Cross-Site Scripting | heat-trackr | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000137 | WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting | hero-maps-pro | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000138 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | indexisto | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000139 | WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting | infusionsoft | 6.1 (v3.0) | Medium | 340147 , 341256 , 341266 , 342259 |
| CVE-2016-1000140 | WordPress New Year Firework <=1.1.9 - Cross-Site Scripting | new-year-firework | 6.1 (v3.0) | Medium | 340147 , 341266 |
| CVE-2016-1000141 | WordPress Page Layout builder v1.9.3 - Cross-Site Scripting | page-layout-builder | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000142 | WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting | parsi-font | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000143 | WordPress Photoxhibit 2.1.8 - Cross-Site Scripting | photoxhibit | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000146 | WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting | pondol-formmail | 6.1 (v3.0) | Medium | 322100 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000148 | WordPress S3 Video <=0.983 - Cross-Site Scripting | s3-video | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000149 | WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting | simpel-reserveren | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2016-1000152 | WordPress Tidio-form <=1.0 - Cross-Site Scripting | tidio-form | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2016-1000153 | WordPress Tidio Gallery <=1.1 - Cross-Site Scripting | tidio-gallery | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000154 | WordPress WHIZZ <=1.0.7 - Cross-Site Scripting | whizz | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000155 | WordPress WPSOLR <=8.6 - Cross-Site Scripting | wpsolr-search-engine | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2015-2080 | Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers | fedora | 7.5 (v3.0) | High | 344361 , 344363 , 344364 , 344365 , 390724 |
| CVE-2015-1000005 | WordPress Candidate Application Form <= 1.3 - Local File Inclusion | candidate-application-form | 7.5 (v3.0) | High | 337473 , 344360 , 347009 , 390709 |
| CVE-2015-1000010 | WordPress Simple Image Manipulator < 1.0 - Local File Inclusion | simple-image-manipulator | 7.5 (v3.0) | High | 337473 , 344360 , 347009 , 390709 |
| CVE-2015-1000012 | WordPress MyPixs <=0.3 - Local File Inclusion | mypixs | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2016-6435 | Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion | secure firewall management center | 6.5 (v3.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2016-5674 | NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution | readynas surveillance | 9.8 (v3.0) | Critical | 344361 , 344363 , 392301 |
| CVE-2016-5675 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-5678 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-5679 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 8.8 (v3.0) | High | 392301 |
| CVE-2016-5680 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 8.8 (v3.0) | High | 392301 |
| CVE-2016-5676 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 7.5 (v3.0) | High | 392301 |
| CVE-2016-5677 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 7.5 (v3.0) | High | 392301 |
| CVE-2016-5771 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.1) | Critical | 344365 |
| CVE-2016-5773 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.0) | Critical | 344365 |
| CVE-2016-5734 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 9.8 (v3.0) | Critical | 340095 , 340128 , 344370 , 346755 , 380018 , 390614 , 390801 |
| CVE-2016-1337 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 8.1 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-1328 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-1336 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-4309 | Symphony CMS 2.6.7 - Session Fixation | symphony | 7.5 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2016-3087 | Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution | struts | 9.8 (v3.0) | Critical | 340014 , 340128 , 340193 , 344370 , 360152 , 380018 , 390801 |
| CVE-2016-3088 | ActiveMQ web shell upload | activemq | 9.8 (v3.1) | Critical | 330925 , 340128 , 360152 , 360153 , 380018 , 380026 , 390704 , 390801 , 392301 |
| CVE-2015-6834 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.0) | Critical | 344365 |
| CVE-2016-1209 | WordPress Ninja Forms Unauthenticated File Upload | ninja forms | 9.8 (v3.0) | Critical | 330791 , 334168 , 340152 , 382238 |
| CVE-2016-3081 | Apache Struts Dynamic Method Invocation Remote Code Execution | struts | 8.1 (v3.1) | High | 337209 , 337211 , 340014 , 344360 , 344370 , 347009 , 360152 , 380018 , 390801 , 390904 |
| CVE-2016-2203 | Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability | messaging gateway | 7.8 (v3.0) | High | 392647 |
| CVE-2016-0710 | Apache Jetspeed Arbitrary File Upload | jetspeed | 8.8 (v3.0) | High | 340007 , 344360 , 390709 , 390724 |
| CVE-2016-0709 | Apache Jetspeed Arbitrary File Upload | jetspeed | 7.2 (v3.0) | High | 340007 , 344360 , 390709 , 390724 |
| CVE-2016-0792 | Jenkins XStream Groovy classpath Deserialization Vulnerability | jenkins | 8.8 (v3.0) | High | 344366 |
| CVE-2016-2098 | Ruby on Rails ActionPack Inline ERB Code Execution | debian linux | 7.3 (v3.0) | High | 330791 , 340095 , 340128 , 340152 , 346755 , 380018 , 392648 |
| CVE-2016-2386 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver application server java | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2016-0752 | Ruby on Rails Dynamic Render File Upload Remote Code Execution | rails | 7.5 (v3.1) | High | 330791 , 334168 , 340152 |
| CVE-2016-2389 | SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion | netweaver | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2016-2388 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver application server java | 5.3 (v3.1) | Medium | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2016-1525 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management software 300 | 8.6 (v3.0) | High | 334168 , 340156 , 390700 |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.6 (v3.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2016-1910 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver | 5.3 (v3.0) | Medium | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2015-5471 | Swim Team <= v1.44.10777 - Local File Inclusion | swim team | 5.3 (v3.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2015-4694 | WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval | zip attachments | 8.6 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-6018 | ZYXEL PMG5318-B20A - OS Command Injection | pmg5318-b20a firmware | 9.8 (v3.0) | Critical | 330791 , 340152 |
| CVE-2015-4027 | Acunetix WVS 10 - Local Privilege Escalation | web vulnerability scanner | 7.2 (v2.0) | High | 330791 , 340152 , 390726 , 392647 |
| CVE-2015-6401 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 7.5 (v2.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-6402 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 4.3 (v2.0) | Medium | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-8103 | Jenkins-CI Unauthenticated Script-Console Scanner | openshift container platform | 9.8 (v3.1) | Critical | 340014 , 340193 , 344370 , 390722 |
| CVE-2015-7808 | vBulletin 5.1.2 Unserialize Code Execution | vbulletin | 7.5 (v2.0) | High | 376476 |
| CVE-2015-7297 | Joomla com_contenthistory Error-Based SQL Injection | joomla! | 7.5 (v2.0) | High | 331028 , 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2015-5285 | Kallithea 0.2.9 - 'came_from' HTTP Response Splitting | kallithea | 5.0 (v2.0) | Medium | 390722 , 390727 , 392648 |
| CVE-2015-6477 | Nordex NC2 - Cross-Site Scripting | nordex control 2 scada | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-7765 | ManageEngine OpManager Remote Code Execution | manageengine opmanager | 9.0 (v2.0) | High | 340145 , 340156 , 341245 , 344370 |
| CVE-2015-7766 | ManageEngine OpManager Remote Code Execution | manageengine opmanager | 9.0 (v2.0) | High | 340145 , 340156 , 341245 , 344370 |
| CVE-2015-5082 | Endian Firewall Proxy Password Change Command Injection | endian firewall | 10.0 (v2.0) | High | 330791 , 340152 |
| CVE-2015-7387 | ManageEngine EventLog Analyzer Remote Code Execution | manageengine eventlog analyzer | 7.5 (v2.0) | High | 340007 , 340145 , 341250 , 344370 |
| CVE-2015-7309 | CMS Bolt File Upload Vulnerability | bolt | 6.5 (v2.0) | Medium | 330791 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2015-4040 | F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal | enterprise manager | 4.0 (v2.0) | Medium | 344370 , 390724 |
| CVE-2015-6967 | Nibbleblog File Upload Vulnerability | nibbleblog | 6.5 (v2.0) | Medium | 390700 |
| CVE-2015-6920 | WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting | sourceafrica | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148 |
| CVE-2015-5688 | Geddy <13.0.8 - Local File Inclusion | geddy | 5.0 (v2.0) | Medium | 347009 |
| CVE-2015-2807 | Navis DocumentCloud <0.1.1 - Cross-Site Scripting | navis documentcloud | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148 |
| CVE-2015-5161 | Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection | zend framework | 6.8 (v2.0) | Medium | 344372 , 390727 , 392301 , 392648 |
| CVE-2015-6522 | WordPress Symposium Plugin SQL Injection | wp symposium | 7.5 (v2.0) | High | 341245 , 347475 |
| CVE-2015-1830 | Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload | activemq | 5.0 (v2.0) | Medium | 330925 , 340006 , 344360 , 390709 , 390719 |
| CVE-2015-4425 | Pimcore CMS Build 3450 - Directory Traversal | pimcore | 4.9 (v2.0) | Medium | 390726 , 392647 |
| CVE-2015-5531 | ElasticSearch <1.6.1 - Local File Inclusion | elasticsearch | 5.0 (v2.0) | Medium | 347009 , 392301 |
| CVE-2015-4666 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 5.0 (v2.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347009 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4665 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 4.3 (v2.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-1489 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 8.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 , 392301 |
| CVE-2015-1486 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 , 392301 |
| CVE-2015-1487 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 5.5 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 , 392301 |
| CVE-2015-5453 | Watchguard XCS Remote Command Execution | xcs | 6.5 (v2.0) | Medium | 340029 , 340145 , 340156 , 341145 , 341245 , 344363 , 344370 |
| CVE-2015-5371 | SolarWinds Storage Manager Authentication Bypass | storage manager | 10.0 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2014-9735 | WordPress RevSlider File Upload and Execute Vulnerability | showbiz pro | 7.5 (v2.0) | High | 330791 , 337469 , 340152 |
| CVE-2015-3897 | Bonita BPM Portal <6.5.3 - Local File Inclusion | bonita bpm portal | 5.0 (v2.0) | Medium | 340007 , 344360 |
| CVE-2015-4420 | Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities | opsview | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2015-4414 | WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal | se html5 album audio player | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-3648 | ResourceSpace - Local File inclusion | resourcespace | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-2996 | SysAid Help Desk Arbitrary File Download | sysaid | 8.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-2994 | SysAid Help Desk Administrator Portal Arbitrary File Upload | sysaid | 6.5 (v2.0) | Medium | 340006 , 390719 |
| CVE-2015-2997 | SysAid Help Desk Arbitrary File Download | sysaid | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-5324 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High | 340128 , 344370 , 360152 , 380018 , 390801 |
| CVE-2015-0779 | Novell ZENworks Configuration Management Arbitrary File Upload | zenworks configuration management | 10.0 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-4133 | Wordpress Reflex Gallery Upload Vulnerability | reflex gallery | 7.5 (v2.0) | High | 382238 |
| CVE-2015-1389 | Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting | clearpass policy manager | 4.3 (v2.0) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-4127 | WordPress Church Admin <0.810 - Cross-Site Scripting | church admin | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-4062 | WordPress NewStatPress 0.9.8 - SQL Injection | newstatpress | 6.5 (v2.0) | Medium | 341245 , 380122 |
| CVE-2015-4063 | NewStatPress <0.9.9 - Cross-Site Scripting | newstatpress | 3.5 (v2.0) | Low | 341266 , 346755 |
| CVE-2015-1880 | Fortinet FortiOS <=5.2.3 - Cross-Site Scripting | fortios | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-8361 | D-Link Devices UPnP SOAP Command Execution | dir-905l firmware | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2015-3337 | Elasticsearch - Local File Inclusion | elasticsearch | 4.3 (v2.0) | Medium | 347009 |
| CVE-2012-5451 | TVMOBiLi 2.1.0.3557 - Denial of Service | tvmobili | 5.0 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2015-3035 | Archer C7 Directory Traversal Vulnerability | tl-wr741nd firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2015-1635 | MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure | Windows 7 | 9.8 (v3.1) | Critical | 353012 , 353013 , 363434 |
| CVE-2014-9145 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 7.5 (v2.0) | High | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-9146 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 4.3 (v2.0) | Medium | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2015-2824 | WordPress Plugin Simple Ads Manager - Multiple SQL Injections | simple ads manager | 7.5 (v2.0) | High | 344361 , 344363 , 344364 , 344366 , 344370 , 360152 , 360153 , 380026 , 390720 , 390724 , 390726 , 390904 , 392647 |
| CVE-2015-2166 | Ericsson Drutt MSDP - Local File Inclusion | drutt mobile service delivery platform | 5.0 (v2.0) | Medium | 347009 |
| CVE-2015-2755 | WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting | ab google map travel | 6.8 (v2.0) | Medium | 346755 , 377360 |
| CVE-2014-9707 | Embedthis GoAhead Embedded Web Server Directory Traversal | goahead | 7.5 (v2.0) | High | 347009 |
| CVE-2015-2562 | Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner | ecommerce wd | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 |
| CVE-2014-7884 | ArcSight Logger - Arbitrary File Upload / Code Execution | arcsight logger | 9.0 (v2.0) | High | 390726 , 392647 |
| CVE-2015-2208 | PHPMoAdmin 1.1.2 Remote Code Execution | phpmoadmin | 7.5 (v2.0) | High | 340095 , 340128 , 344363 , 346755 , 380018 , 390801 |
| CVE-2015-2275 | WoltLab Community Gallery - Persistent Cross-Site Scripting | community gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 342259 , 344365 , 344370 , 346755 , 390726 , 392647 |
| CVE-2014-9566 | Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation | orion ip address manager | 7.5 (v2.0) | High | 340145 , 340156 , 341145 , 341245 , 344370 |
| CVE-2015-2196 | WordPress Spider Calendar <=1.4.9 - SQL Injection | spider calendar | 7.5 (v2.0) | High | 340016 , 340156 , 380122 |
| CVE-2015-2065 | WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner | wordpress video gallery | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 |
| CVE-2015-2067 | Magento Server MAGMI - Directory Traversal | magmi | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-2068 | Magento Server Mass Importer - Cross-Site Scripting | magmi | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2015-2049 | D-Link DCS-931L File Upload | dcs-931l firmware | 9.0 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2015-2051 | D-Link Devices HNAP SOAPAction-Header Command Execution | dir-645 firmware | 8.8 (v3.1) | High | 381237 |
| CVE-2015-1587 | Maarch LetterBox Unrestricted File Upload | gec/ged | 7.5 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2015-1592 | SixApart MovableType Storable Perl Code Execution | debian linux | 7.5 (v2.0) | High | 340007 , 344360 , 344362 , 344366 , 344370 , 347009 , 380026 , 390709 , 390722 |
| CVE-2015-1427 | ElasticSearch Search Groovy Sandbox Bypass | elasticsearch | 9.8 (v3.1) | Critical | 330791 , 340152 , 344360 , 380026 , 390724 |
| CVE-2015-0923 | Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution | ektron content management system | 5.0 (v2.0) | Medium | 344360 , 344372 , 360151 |
| CVE-2015-1172 | WordPress Holding Pattern Theme Arbitrary File Upload | holding pattern | 7.5 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2015-1518 | RedaxScript CMS 2.2.0 - SQL Injection | redaxscript | 7.5 (v2.0) | High | 334073 , 341245 , 344363 , 344364 , 344365 , 344370 , 350147 , 360152 , 360153 , 380026 , 390724 , 390726 , 392647 |
| CVE-2015-1579 | WordPress Slider Revolution - Local File Disclosure | divi | 5.0 (v2.0) | Medium | 336461 , 337479 , 344360 , 381206 |
| CVE-2015-1400 | NPDS CMS REvolution-13 - SQL Injection | revolution | 7.5 (v2.0) | High | 334168 , 390726 , 391213 , 392647 |
| CVE-2015-1428 | Sefrengo CMS 1.6.1 - Multiple SQL Injections | sefrengo | 7.5 (v2.0) | High | 390704 |
| CVE-2015-1376 | WordPress Pixabay Images PHP Code Upload | pixabay images | 4.0 (v2.0) | Medium | 340007 , 344360 , 382238 , 390709 |
| CVE-2015-0231 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-0191 | eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection | fusion middleware | 4.3 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2014-9308 | WordPress WP EasyCart Unrestricted File Upload | wp easycart | 6.5 (v2.0) | Medium | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2014-100005 | D-Link DIR-645 / DIR-815 diagnostic.php Command Execution | dir-600 firmware | 8.0 (v3.1) | High | 340014 , 340029 , 340193 , 344363 , 344364 , 344366 , 344370 |
| CVE-2014-10021 | WordPress WP Symposium 14.11 Shell Upload | wp symposium | 7.5 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2014-10037 | DomPHP 0.83 - Directory Traversal | domphp | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2014-100004 | Sitecore CMS - Cross-Site Scripting | sitecore.net | 4.3 (v2.0) | Medium | 333141 , 347198 |
| CVE-2015-0922 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 5.0 (v2.0) | Medium | 341256 , 344360 , 344370 , 344372 , 347009 , 350147 , 380018 |
| CVE-2015-0921 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 4.0 (v2.0) | Medium | 341256 , 344360 , 344370 , 344372 , 347009 , 350147 , 380018 |
| CVE-2014-9567 | ProjectSend Arbitrary File Upload | projectsend | 7.5 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2014-9464 | Microweber CMS 0.95 - SQL Injection | microweber | 7.5 (v2.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9444 | Frontend Uploader <= 0.9.2 - Cross-Site Scripting | frontend uploader | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2014-9119 | WordPress DB Backup <=4.5 - Local File Inclusion | db backup | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 , 393759 |
| CVE-2013-6041 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 7.5 (v2.0) | High | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2013-6043 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 5.0 (v2.0) | Medium | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2014-8142 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-5462 | OpenEMR 4.1.2(7) - Multiple SQL Injections | openemr | 6.5 (v2.0) | Medium | 392301 |
| CVE-2014-8877 | WordPress Plugin CM Download Manager 2.0.0 - Code Injection | cm download manager | 10.0 (v2.0) | High | 340087 , 340095 , 390726 , 392301 , 392647 , 392648 |
| CVE-2014-3996 | ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection | it360 | 7.5 (v2.0) | High | 340016 , 340145 , 340155 , 340156 , 341145 , 341155 , 341245 , 344366 , 390716 |
| CVE-2014-9215 | PBBoard CMS 3.0.1 - SQL Injection | pbboard | 7.5 (v2.0) | High | 340095 , 340213 , 344363 , 344370 , 360153 , 380026 , 390724 , 390726 , 392647 |
| CVE-2014-5445 | ManageEngine NetFlow Analyzer Arbitrary File Download | manageengine it360 | 5.0 (v2.0) | Medium | 344365 |
| CVE-2014-6034 | ManageEngine OpManager and Social IT Arbitrary File Upload | manageengine social it plus | 5.0 (v2.0) | Medium | 330791 , 340007 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2014-8791 | Tuleap PHP Unserialize Code Execution | tuleap | 6.0 (v2.0) | Medium | 340011 , 344363 , 346755 , 390801 |
| CVE-2014-7816 | WildFly Directory Traversal | undertow | 5.0 (v2.0) | Medium | 344365 |
| CVE-2014-8423 | Arris VAP2500 tools_command.php Command Execution | vap2500 firmware | 10.0 (v2.0) | High | 344363 |
| CVE-2014-8424 | Arris VAP2500 tools_command.php Command Execution | vap2500 firmware | 7.8 (v2.0) | High | 344363 |
| CVE-2014-8799 | WordPress DukaPress Plugin File Read Vulnerability | dukapress | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 347009 , 381206 , 390709 |
| CVE-2014-9094 | WordPress DZS-VideoGallery Plugin Cross-Site Scripting | video gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2014-8682 | Gogs (Go Git Service) - SQL Injection | gogs | 7.5 (v2.0) | High | 340016 , 340017 , 340157 , 360147 , 360148 , 380026 |
| CVE-2014-8998 | X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution | x7 chat | 6.5 (v2.0) | Medium | 340011 , 340087 , 340128 , 344363 , 380018 , 390801 |
| CVE-2014-7146 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 7.5 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2014-8598 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 6.4 (v2.0) | Medium | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2014-8499 | ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection | password manager pro | 6.5 (v2.0) | Medium | 340145 , 340156 , 341145 , 341245 |
| CVE-2014-8727 | F5 BIG-IP 10.1.0 - Directory Traversal | big-ip local traffic manager | 6.2 (v2.0) | Medium | 340006 , 340007 , 344360 , 390709 |
| CVE-2014-2268 | Vtiger Install Unauthenticated Remote Command Execution | vtiger crm | 5.0 (v2.0) | Medium | 341245 , 344370 , 360152 , 380026 |
| CVE-2014-5258 | webEdition 6.3.8.0 - Directory Traversal | webedition cms | 4.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-8586 | WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner | cp multi view event calendar | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 |
| CVE-2014-7176 | Enalean Tuleap 7.4.99.5 - Blind SQL Injection | tuleap | 6.5 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-6037 | ManageEngine Eventlog Analyzer Arbitrary File Upload | manageengine eventlog analyzer | 7.5 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2014-3828 | Centreon SQL and Command Injection | centreon | 10.0 (v2.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 341145 , 341245 , 344370 , 360147 , 360148 |
| CVE-2014-3829 | Centreon SQL and Command Injection | centreon | 10.0 (v2.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 341145 , 341245 , 344370 , 360147 , 360148 |
| CVE-2014-5005 | ManageEngine Desktop Central StatusUpdate Arbitrary File Upload | manageengine desktop central | 7.5 (v2.0) | High | 340128 , 360152 , 380018 , 390801 |
| CVE-2014-2531 | InterWorx Control Panel 5.0.13 build 574 - 'xhr.php?i' SQL Injection | web control panel | 6.5 (v2.0) | Medium | 392301 |
| CVE-2014-4577 | WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion | wp amasin - the amazon affiliate shop | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-6308 | Osclass Security Advisory 3.4.1 - Local File Inclusion | osclass | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-3704 | Drupal HTTP Parameter Key/Value SQL Injection | drupal | 7.5 (v2.0) | High | 334168 , 340016 , 340095 , 340128 , 340145 , 340156 , 341145 , 341245 , 344366 , 346755 , 380018 , 380026 , 380122 , 390801 , 392301 |
| CVE-2014-7205 | Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution | bassmaster | 10.0 (v2.0) | High | 330791 , 340152 |
| CVE-2014-5308 | TestLink 1.9.11 - Multiple SQL Injections | testlink | 9.0 (v2.0) | High | 350147 , 390726 , 392647 |
| CVE-2014-7981 | Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read | joomla! | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 |
| CVE-2014-6287 | HTTP File Server <2.3c - Remote Command Execution | http file server | 9.8 (v3.1) | Critical | 390613 , 390614 |
| CVE-2014-6389 | PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution | phpcompta/noalyss | 7.5 (v2.0) | High | 340128 , 344363 , 350147 , 380018 , 390726 , 392301 , 392647 , 392648 |
| CVE-2011-4624 | GRAND FlAGallery 1.57 - Cross-Site Scripting | grand flagallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-6278 | CUPS Filter Bash Environment Variable Code Injection (Shellshock) | bash | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2013-3632 | OpenMediaVault rpc.php Authenticated Cron Remote Code Execution | openmediavault | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2014-6446 | Wordpress InfusionSoft Upload Vulnerability | infusionsoft gravity forms | 7.5 (v2.0) | High | 340128 , 360152 , 380018 , 390801 |
| CVE-2014-6271 | CUPS Filter Bash Environment Variable Code Injection (Shellshock) | bash | 9.8 (v3.1) | Critical | 330701 , 330791 , 340152 , 344360 , 390719 , 393134 |
| CVE-2014-5519 | Phpwiki Ploticus Remote Code Execution | phpwiki | 7.5 (v2.0) | High | 344363 , 390801 |
| CVE-2012-4240 | Group Office Calendar - '/calendar/json.php' SQL Injection | groupoffice | 6.5 (v2.0) | Medium | 340016 , 340157 , 341245 , 360147 , 360148 |
| CVE-2014-5460 | Wordpress SlideShow Gallery Authenticated File Upload | tibulant slideshow gallery | 6.5 (v2.0) | Medium | 330791 , 334168 , 340152 , 382238 |
| CVE-2012-4768 | WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting | download monitor | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-5368 | WordPress Plugin WP Content Source Control - Directory Traversal | wp content source control | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2014-5266 | Wordpress XMLRPC DoS | WordPress | 5.0 (v2.0) | Medium | 330791 , 340152 , 344372 |
| CVE-2012-5685 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 7.5 (v2.0) | High | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2012-5683 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 6.8 (v2.0) | Medium | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2012-5684 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 4.3 (v2.0) | Medium | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2014-1222 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | vtiger crm | 4.0 (v2.0) | Medium | 340007 , 340156 , 341145 , 344360 , 345493 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-3914 | Rocket Servergraph Admin Center fileRequestor Remote Code Execution | rocket servergraph | 10.0 (v2.0) | High | 340007 , 344360 , 390709 |
| CVE-2014-5181 | Last.fm Rotation 1.0 - Path Traversal | lastfm-rotation plugin | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-5187 | Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal | tom-m8te plugin | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2013-5758 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | sip-t38g | 9.0 (v2.0) | High | 330925 , 344360 , 344370 , 390724 , 390726 , 392647 |
| CVE-2013-5759 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | - | N/A | N/A | 330925 , 344360 , 390724 , 390726 , 392647 |
| CVE-2014-3120 | ElasticSearch Dynamic Script Arbitrary Java Execution | elasticsearch | 8.1 (v3.1) | High | 330791 , 340152 , 344360 , 344370 , 380026 , 390724 |
| CVE-2014-5111 | Fonality trixbox - Local File Inclusion | trixbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2014-4725 | Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload | mailpoet newsletters | 7.5 (v2.0) | High | 330791 , 340152 , 382238 |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium | 333141 , 340156 , 341245 , 341256 , 342259 , 346755 , 390724 |
| CVE-2013-5755 | Yealink VoIP Phone SIP-T38G - Remote Command Execution | sip-t38g | 10.0 (v2.0) | High | 344370 , 390724 , 390726 , 392647 |
| CVE-2014-4977 | Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection | scrutinizer | 6.5 (v2.0) | Medium | 334168 , 340007 , 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344370 , 360147 , 360148 |
| CVE-2014-4940 | WordPress Plugin Tera Charts - Local File Inclusion | tera-charts | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-4941 | Cross RSS 1.7 - Local File Inclusion | wp-cross-rss | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-3515 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-0864 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 6.8 (v2.0) | Medium | 392301 |
| CVE-2014-0867 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 5.8 (v2.0) | Medium | 392301 |
| CVE-2014-0865 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.9 (v2.0) | Medium | 392301 |
| CVE-2014-0868 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.9 (v2.0) | Medium | 392301 |
| CVE-2014-0866 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0869 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0870 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0871 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0894 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 3.5 (v2.0) | Low | 392301 |
| CVE-2014-4513 | ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting | activehelper livehelp live chat | 4.3 (v2.0) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2014-2962 | Belkin N150 Router 1.00.08/1.00.09 - Path Traversal | n150 f9k1009 firmware | 7.8 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2013-6221 | HP AutoPass License Server File Upload | service virtualization | 10.0 (v2.0) | High | 340006 , 390719 |
| CVE-2014-3804 | AlienVault OSSIM av-centerd Command Injection | open source security information management | 10.0 (v2.0) | High | 330791 , 340152 |
| CVE-2014-3936 | D-Link HNAP Request Remote Buffer Overflow | dir505 shareport mobile companion firmware | 10.0 (v2.0) | High | 381237 |
| CVE-2013-1412 | DataLife Engine preview.php PHP Code Injection | datalife engine | 7.5 (v2.0) | High | 340095 , 340128 , 344363 , 344370 , 346755 , 380018 , 390801 |
| CVE-2012-5876 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium | 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2012-5877 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium | 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2012-4915 | WordPress Plugin Google Document Embedder Arbitrary File Disclosure | google doc embedder | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 344370 , 381206 |
| CVE-2013-5036 | Squash YAML Code Execution | square squash | 7.5 (v2.0) | High | 330791 , 340128 , 340152 , 380018 , 390801 |
| CVE-2013-4468 | VICIdial Manager Send OS Command Injection | vicidial | 6.5 (v2.0) | Medium | 340145 , 340156 , 341145 , 341245 , 344361 , 344363 |
| CVE-2013-4490 | Gitlab-shell Code Execution | gitlab | 6.5 (v2.0) | Medium | 344361 , 344362 , 344363 , 344365 |
| CVE-2014-0114 | Apache Struts ClassLoader Manipulation Remote Code Execution | commons beanutils | 7.5 (v2.0) | High | 392648 |
| CVE-2014-0112 | Apache Struts ClassLoader Manipulation Remote Code Execution | struts | 7.5 (v2.0) | High | 392648 |
| CVE-2014-2846 | WD Arkeia Virtual Appliance 10.2.9 - Local File Inclusion | arkeia virtual appliance firmware | 7.5 (v2.0) | High | 344360 |
| CVE-2014-2383 | Dompdf < v0.6.0 - Local File Inclusion | dompdf | 6.8 (v2.0) | Medium | 340077 , 340165 , 344360 , 347009 |
| CVE-2014-2908 | Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting | simatic s7 cpu 1200 firmware | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-0644 | EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read | cloud tiering appliance software | 7.8 (v2.0) | High | 344360 , 344372 , 390724 |
| CVE-2014-2424 | Oracle Event Processing FileUploadServlet Arbitrary File Upload | fusion middleware | 4.0 (v2.0) | Medium | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2014-0763 | Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection | advantech webaccess | 7.5 (v2.0) | High | 340016 , 340122 , 340145 , 340156 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2014-2849 | Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution | web appliance firmware | 8.5 (v2.0) | High | 344361 , 344363 |
| CVE-2014-2850 | Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution | web appliance firmware | 8.5 (v2.0) | High | 344361 , 344363 |
| CVE-2013-2287 | WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting | uploader | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2013-5640 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High | 340006 , 344360 , 390727 , 392301 , 392648 |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High | 340011 , 340095 , 340128 , 344365 , 346755 , 360152 , 380018 , 380026 , 390614 , 390801 |
| CVE-2013-2642 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 9.3 (v2.0) | High | 344362 , 344364 , 344366 |
| CVE-2013-2641 | Sophos Web Protection Appliance patience.cgi Directory Traversal | web appliance firmware | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 344362 , 344364 , 344366 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-2643 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 4.3 (v2.0) | Medium | 344362 , 344364 , 344366 |
| CVE-2013-5639 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High | 340006 , 344360 , 390727 , 392301 , 392648 |
| CVE-2013-4467 | VICIdial Manager Send OS Command Injection | vicidial | 6.5 (v2.0) | Medium | 340145 , 340156 , 341145 , 341245 , 344361 , 344363 |
| CVE-2014-0094 | Apache Struts ClassLoader Manipulation Remote Code Execution | struts | 5.0 (v2.0) | Medium | 392648 |
| CVE-2014-1944 | Ilch CMS 2.0 - Persistent Cross-Site Scripting | ilch cms | 4.3 (v2.0) | Medium | 344370 |
| CVE-2013-5014 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 7.5 (v2.0) | High | 330791 , 334168 , 340152 , 344370 , 344372 , 390719 |
| CVE-2013-5015 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 6.5 (v2.0) | Medium | 330791 , 334168 , 340152 , 344370 , 344372 , 390719 |
| CVE-2014-1610 | MediaWiki Thumb.php Remote Command Execution | mediawiki | 6.0 (v2.0) | Medium | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2012-5192 | Bitweaver overlay_type Directory Traversal | bitweaver | 5.0 (v2.0) | Medium | 340007 , 340029 , 340147 , 340148 , 341256 , 342259 , 344360 , 346755 , 347009 , 350147 , 350148 , 380026 , 390613 , 390614 , 390709 |
| CVE-2013-7137 | Burden 1.8 - Authentication Bypass | burden | 9.8 (v3.1) | Critical | 390727 , 392301 , 392648 |
| CVE-2014-1206 | Open Web Analytics 1.5.4 - 'owa_email_address' SQL Injection | open web analytics | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2013-5877 | Oracle Demantra Arbitrary File Retrieval with Authentication Bypass | supply chain products suite | 5.0 (v2.0) | Medium | 390613 , 390614 |
| CVE-2013-5880 | Oracle Demantra Arbitrary File Retrieval with Authentication Bypass | supply chain products suite | 5.0 (v2.0) | Medium | 390613 , 390614 |
| CVE-2013-2050 | Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection | cloudforms management engine | 7.5 (v2.0) | High | 340145 , 340156 , 341145 , 341245 , 344362 , 390572 |
| CVE-2013-7240 | WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal | advanced dewplayer | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2013-7102 | WordPress OptimizePress Theme File Upload Vulnerability | optimizepress | 6.8 (v2.0) | Medium | 340133 , 390700 |
| CVE-2013-7091 | Zimbra Collaboration Server LFI | zimbra collaboration suite | 5.0 (v2.0) | Medium | 340006 , 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-2751 | NETGEAR ReadyNAS Perl Code Evaluation | raidiator | 10.0 (v2.0) | High | 340087 , 340095 , 340128 , 341245 , 380018 , 390801 |
| CVE-2013-4212 | Apache Roller OGNL Injection | roller | 6.8 (v2.0) | Medium | 337208 , 393655 |
| CVE-2013-6042 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 4.3 (v2.0) | Medium | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High | 340011 , 340095 , 340128 , 346755 , 360152 , 380018 , 390801 |
| CVE-2013-6164 | Project'Or RIA 3.4.0 - 'objectDetail.php?objectId' SQL Injection | projeqtor | 7.5 (v2.0) | High | 392301 |
| CVE-2013-5694 | Opsview pre 4.4.1 - Blind SQL Injection | opsview | 7.5 (v2.0) | High | 344370 , 390704 , 390726 , 392647 |
| CVE-2013-4837 | HP LoadRunner EmulationAdmin Web Service Directory Traversal | loadrunner | 10.0 (v2.0) | High | 344360 |
| CVE-2013-3631 | NAS4Free Arbitrary Remote Code Execution | nas4free | 6.0 (v2.0) | Medium | 340006 , 340007 , 344360 , 390709 , 390719 |
| CVE-2013-3617 | Openbravo ERP XXE Arbitrary File Read | openbravo erp | 3.5 (v2.0) | Low | 330791 , 340152 |
| CVE-2013-3630 | Moodle Authenticated Spelling Binary RCE | moodle | 4.6 (v2.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 , 390585 |
| CVE-2013-6281 | WordPress Spreadsheet - Cross-Site Scripting | dhtmlxspreadsheet | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2013-6129 | vBulletin Administrator Account Creation | vbulletin | 7.5 (v2.0) | High | 331358 |
| CVE-2013-4822 | HP Intelligent Management Center BIMS UploadServlet Directory Traversal | imc branch intelligent management system software module | 10.0 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2013-4824 | HP Intelligent Management SOM Account Creation | imc service operation management software module | 7.5 (v2.0) | High | 391213 |
| CVE-2013-4823 | HP Intelligent Management BIMS DownloadServlet Directory Traversal | intelligent management center | 5.0 (v2.0) | Medium | 344360 , 344365 , 347009 , 390709 |
| CVE-2013-4826 | HP Intelligent Management SOM FileDownloadServlet Arbitrary Download | imc service operation management software module | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2013-2578 | TP-Link SC2020n Authenticated Telnet Injection | tl-sc3130 | 10.0 (v2.0) | High | 340029 |
| CVE-2013-5528 | Cisco Unified Communications Manager 7/8/9 - Directory Traversal | unified communications manager | 4.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2013-5979 | Xibo 1.2.2/1.4.1 - Directory Traversal | xibo | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-5093 | Graphite Web Unsafe Pickle Handling | graphite | 6.8 (v2.0) | Medium | 344361 , 344363 , 390724 |
| CVE-2013-5486 | Cisco Prime Data Center Network Manager Arbitrary File Upload | prime data center network manager | 10.0 (v2.0) | High | 340007 , 340029 , 344360 , 390614 , 390709 |
| CVE-2013-5696 | GLPI install.php Remote Command Execution | glpi | 6.8 (v2.0) | Medium | 344370 |
| CVE-2013-4811 | HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload | identity driven manager | 10.0 (v2.0) | High | 340006 , 390719 |
| CVE-2013-4812 | HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload | identity driven manager | 10.0 (v2.0) | High | 340006 , 390719 |
| CVE-2013-4341 | Moodle Authenticated Spelling Binary RCE | moodle | 4.3 (v2.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 , 390585 |
| CVE-2013-4625 | WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting | duplicator | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-2367 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High | 344361 , 344363 , 344366 |
| CVE-2013-2121 | Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection | openstack | 6.0 (v2.0) | Medium | 340011 , 340095 , 340128 , 346755 , 380018 , 390801 |
| CVE-2013-2251 | Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution | archiva | 9.8 (v3.1) | Critical | 337209 , 337211 , 340193 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 , 360148 , 393655 |
| CVE-2013-4117 | WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting | category-grid-view-gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-1965 | Apache Struts2 S2-012 RCE | struts | 9.3 (v2.0) | High | 337207 , 337209 , 337211 , 344360 |
| CVE-2013-4615 | Canon Wireless Printer Denial Of Service | mg3100 printer | 5.0 (v2.0) | Medium | 340147 , 341256 , 342259 , 346755 |
| CVE-2013-3520 | VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload | vcenter chargeback manager | 7.5 (v2.0) | High | 330791 , 334168 , 340152 , 360152 , 390700 |
| CVE-2013-3576 | HP System Management Homepage JustGetSNMPQueue Command Injection | system management homepage | 9.0 (v2.0) | High | 340087 , 380026 |
| CVE-2013-0136 | Mutiny 5 Arbitrary File Upload | mutiny | 8.5 (v2.0) | High | 340006 , 340007 , 340029 , 344360 , 390614 , 390709 , 390719 |
| CVE-2012-6554 | Active Collab "chat module" Remote PHP Code Injection Exploit | activecollab chat module | 6.5 (v2.0) | Medium | 344363 , 346755 |
| CVE-2013-3522 | vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection | vbulletin | 6.5 (v2.0) | Medium | 331028 , 334168 , 340016 , 340145 , 340155 , 340156 , 340157 , 340159 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 |
| CVE-2013-3526 | WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting | trafficanalyzer | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2013-3238 | phpMyAdmin Authenticated Remote Code Execution via preg_replace() | phpmyadmin | 6.0 (v2.0) | Medium | 340128 , 380018 , 390614 , 390801 |
| CVE-2013-0233 | Ruby on Rails Devise Authentication Password Reset | devise | 6.8 (v2.0) | Medium | 330791 , 340152 |
| CVE-2013-1080 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High | 330791 , 340006 , 340152 , 390719 |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High | 340006 , 340007 , 340011 , 340016 , 340029 , 340087 , 340095 , 340128 , 344360 , 344363 , 344370 , 347009 , 380018 , 380026 , 390109 , 390709 , 390715 , 390801 |
| CVE-2012-5201 | HP Intelligent Management Center Arbitrary File Upload | intelligent management center | 10.0 (v2.0) | High | 330791 , 334168 , 340152 , 360152 |
| CVE-2012-5202 | HP Intelligent Management FaultDownloadServlet Directory Traversal | intelligent management center | 7.5 (v2.0) | High | 344360 , 344365 , 347009 , 390709 |
| CVE-2012-5203 | HP Intelligent Management ReportImgServlt Directory Traversal | intelligent management center for automated network manager | 7.5 (v2.0) | High | 340007 , 344360 , 344365 , 347009 , 390709 |
| CVE-2012-5204 | HP Intelligent Management IctDownloadServlet Directory Traversal | intelligent management center | 7.5 (v2.0) | High | 344360 , 344365 , 347009 , 390709 |
| CVE-2013-0249 | cURL - Buffer Overflow (PoC) | curl | 7.5 (v2.0) | High | 390727 , 392301 , 392648 |
| CVE-2011-5265 | Featurific For WordPress 1.6.2 - Cross-Site Scripting | featurific-for-wordpress | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-0333 | Ruby on Rails JSON Processor YAML Deserialization Code Execution | rails | 7.5 (v2.0) | High | 330791 , 340152 |
| CVE-2011-4618 | Advanced Text Widget < 2.0.2 - Cross-Site Scripting | advanced text widget plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2013-0209 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | movable type | 7.5 (v2.0) | High | 340128 , 380018 , 390801 |
| CVE-2012-6315 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | - | N/A | N/A | 340128 , 380018 , 390801 |
| CVE-2012-5875 | FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference | firefly media server | 5.0 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2013-0156 | Ruby on Rails XML Processor YAML Deserialization Code Execution | rails | 7.5 (v2.0) | High | 340121 , 344363 , 344370 , 390635 |
| CVE-2012-6499 | WordPress Plugin Age Verification v0.4 - Open Redirect | age verification | 5.8 (v2.0) | Medium | 392301 |
| CVE-2012-6329 | TWiki MAKETEXT Remote Command Execution | perl | 7.5 (v2.0) | High | 340011 , 340128 , 380018 , 390801 |
| CVE-2012-6081 | MoinMoin twikidraw Action Traversal File Upload | moinmoin | 6.0 (v2.0) | Medium | 340006 , 340007 , 344360 , 344363 , 344365 , 346755 , 347009 , 390709 , 390719 |
| CVE-2012-4982 | Forescout CounterACT 6.3.4.1 - Open Redirect | counteract | 5.8 (v2.0) | Medium | 340162 , 340163 |
| CVE-2012-4347 | Symantec Messaging Gateway 9.5 Log File Download Vulnerability | messaging gateway | 5.0 (v2.0) | Medium | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2010-5286 | Joomla! Component Jstore - 'Controller' Local File Inclusion | com jstore | 10.0 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-4959 | NFR Agent FSFUI Record File Upload RCE | file reporter | 10.0 (v2.0) | High | 330791 , 340152 |
| CVE-2012-4957 | NFR Agent SRS Record Arbitrary Remote File Access | file reporter | 7.8 (v2.0) | High | 330791 , 340152 |
| CVE-2012-4958 | NFR Agent FSFUI Record Arbitrary Remote File Access | file reporter | 7.8 (v2.0) | High | 330791 , 340152 |
| CVE-2012-5913 | WordPress Integrator 1.32 - Cross-Site Scripting | wordpress integrator | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-5692 | Invision IP.Board unserialize() PHP Code Execution | invision power board | 10.0 (v2.0) | High | 360152 |
| CVE-2012-4940 | Axigen Arbitrary File Read and Delete | axigen free mail server | 6.4 (v2.0) | Medium | 340006 , 340007 , 344360 , 344365 , 347009 , 347019 , 390709 |
| CVE-2012-4547 | AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting | awstats | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2012-4933 | Novell ZENworks Asset Management 7.5 Remote File Access | zenworks asset management | 7.8 (v2.0) | High | 340007 , 344360 , 344365 , 390709 |
| CVE-2012-3152 | Oracle Forms and Reports Remote Code Execution | fusion middleware | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2012-3153 | Oracle Forms and Reports Remote Code Execution | fusion middleware | 6.4 (v2.0) | Medium | 340007 , 340165 , 344360 , 347009 , 390709 |
| CVE-2011-4640 | WebTitan < 3.60 - Local File Inclusion | webtitan | 4.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-5278 | MODx manager - Local File Inclusion | modx revolution | 4.3 (v2.0) | Medium | 340007 , 390613 , 390614 |
| CVE-2012-5223 | vBSEO proc_deutf() Remote PHP Code Injection | vbseo | 7.5 (v2.0) | High | 331702 , 340011 , 340095 , 344363 , 346755 , 360152 , 380026 , 390801 , 393655 |
| CVE-2012-4242 | WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting | mf gig calendar | 4.3 (v2.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-0419 | Novell Groupwise Agents HTTP Directory Traversal | groupwise | 5.0 (v2.0) | Medium | 344365 , 390716 |
| CVE-2012-3260 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High | 330791 , 334168 , 340007 , 340128 , 340152 , 344370 , 347019 , 360152 , 380018 , 390801 |
| CVE-2012-3261 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High | 330791 , 334168 , 340007 , 340128 , 340152 , 344370 , 347019 , 360152 , 380018 , 390801 |
| CVE-2011-5179 | Skysa App Bar 1.04 - Cross-Site Scripting | skysa app bar integration plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2011-5181 | ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting | clickdesk live support-live chat plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2012-2983 | Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access | webmin | 5.0 (v2.0) | Medium | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2012-4889 | ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting | firewall analyzer | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-4869 | FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution | freepbx | 7.5 (v2.0) | High | 390722 |
| CVE-2011-4448 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 7.5 (v2.0) | High | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4449 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4452 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4450 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.4 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4451 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 4.3 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-5130 | Family Connections less.php Remote Command Execution | family connections cms | 6.8 (v2.0) | Medium | 344363 |
| CVE-2011-4926 | Adminimize 1.7.22 - Cross-Site Scripting | adminimize | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2011-5106 | WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting | flexible custom post type | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2011-5107 | Alert Before Your Post <= 0.1.1 - Cross-Site Scripting | alert before you post | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2012-1835 | WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting | all-in-one event calendar | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2012-2371 | WP-FaceThumb 0.1 - Cross-Site Scripting | wp-facethumb | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-4253 | MySQLDumper 1.24.4 - Directory Traversal | mysqldumper | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-4273 | 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting | 2-click-social-media-buttons | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-4031 | WANGKONGBAO CNS-1000 and 1100 UTM Directory Traversal | cns-1000 | 5.0 (v2.0) | Medium | 340006 , 344360 , 392647 |
| CVE-2012-0911 | Tiki Wiki unserialize() PHP Code Execution | tikiwiki cms/groupware | 9.8 (v3.1) | Critical | 340095 , 340128 , 360152 , 380018 , 390614 , 390801 |
| CVE-2012-3350 | Webmatic 3.1.1 - Blind SQL Injection | webmatic | 6.8 (v2.0) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2012-3811 | Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution | ip office customer call reporter | 10.0 (v2.0) | High | 330791 , 340006 , 340152 , 390719 |
| CVE-2012-2926 | Atlassian Crowd XML Entity Expansion Remote File Access | bamboo | 9.1 (v3.1) | Critical | 330791 , 340152 , 344372 |
| CVE-2012-1823 | PHP CGI Argument Injection | php | 9.8 (v3.1) | Critical | 340165 , 378491 |
| CVE-2009-5114 | WebGlimpse 2.18.7 - Directory Traversal | webglimpse | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2012-1465 | NetDecision NOCVision Server Directory Traversal | netdecision | 4.3 (v2.0) | Medium | 344365 , 390716 |
| CVE-2012-0996 | 11in1 CMS 1.2.1 - Local File Inclusion (LFI) | 11in1 | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-1226 | Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities | dolibarr erp/crm | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2012-0991 | OpenEMR 4.1 - Local File Inclusion | openemr | 3.5 (v2.0) | Low | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-0981 | phpShowtime 2.0 - Directory Traversal | phpshowtime | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-4899 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 7.5 (v2.0) | High | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2011-4898 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 5.0 (v2.0) | Medium | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2012-0782 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 4.3 (v2.0) | Medium | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2011-3833 | Support Incident Tracker Remote Command Execution | support incident tracker | 6.0 (v2.0) | Medium | 334168 , 340128 , 360152 , 380018 , 390501 , 390801 , 391213 |
| CVE-2011-3829 | Support Incident Tracker Remote Command Execution | support incident tracker | 4.0 (v2.0) | Medium | 334168 , 340128 , 360152 , 380018 , 390501 , 390801 , 391213 |
| CVE-2012-0286 | stoneware webnetwork6 - Multiple Vulnerabilities | webnetwork | 6.8 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2012-0285 | stoneware webnetwork6 - Multiple Vulnerabilities | webnetwork | 4.3 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2012-0896 | Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access | count per day | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2012-0901 | YouSayToo auto-publishing 1.0 - Cross-Site Scripting | yousaytoo | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2012-0391 | Apache Struts Remote Command Execution | struts | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 344370 |
| CVE-2012-0392 | Apache Struts2 S2-008 RCE | struts | 6.8 (v2.0) | Medium | 337207 , 337209 , 337210 , 337211 , 344360 , 344370 , 347009 |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium | 340011 , 340087 , 340095 , 340128 , 346755 , 380018 , 390801 |
| CVE-2011-4166 | HP Managed Printing Administration jobAcct Remote Command Execution | managed printing administration | 7.5 (v2.0) | High | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2011-4453 | PmWiki pagelist.php Remote PHP Code Injection Exploit | pmwiki | 7.5 (v2.0) | High | 340011 , 340128 , 344363 , 380018 , 390801 |
| CVE-2011-4828 | V-CMS PHP File Upload and Execute | v-cms | 7.5 (v2.0) | High | 330791 , 340152 |
| CVE-2011-4804 | Joomla! Component com_kp - 'Controller' Local File Inclusion | com obsuggest | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-2653 | Novell ZENworks Asset Management Remote Execution | zenworks asset management | 10.0 (v2.0) | High | 330791 , 340006 , 340007 , 340029 , 340152 , 344360 , 344365 , 390709 , 390719 |
| CVE-2011-3167 | HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow | openview network node manager | 10.0 (v2.0) | High | 340006 , 340007 , 340029 , 344360 , 390709 |
| CVE-2010-5028 | Joomla! Component JE Job 1.0 - Local File Inclusion | com jejob | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-4075 | phpLDAPadmin query_engine Remote PHP Code Injection | phpldapadmin | 7.5 (v2.0) | High | 340011 , 340095 , 344363 , 346755 , 360152 , 390501 , 390801 |
| CVE-2010-4977 | Joomla! Component Canteen 1.0 - Local File Inclusion | com canteen | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-3315 | Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal | unified ip interactive voice response | 7.8 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-3305 | Cisco Network Access Manager Directory Traversal Vulnerability | nac manager | 7.8 (v2.0) | High | 344360 , 347009 |
| CVE-2011-2763 | LifeSize Room Command Injection | lifesize room appliance software | 7.5 (v2.0) | High | 344365 |
| CVE-2011-3011 | CA Arcserve D2D GWT RPC Credential Information Disclosure | arcserve d2d | 5.0 (v2.0) | Medium | 391213 |
| CVE-2011-2744 | Chyrp 2.x - Local File Inclusion | chyrp | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-2780 | Chyrp 2.x - Local File Inclusion | chyrp | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-2750 | Novell File Reporter Agent Arbitrary File Delete | file reporter | 5.0 (v2.0) | Medium | 330791 , 340152 |
| CVE-2011-2474 | Sybase Easerver 6.3 Directory Traversal | easerver | 5.0 (v2.0) | Medium | 347019 |
| CVE-2011-1900 | Indusoft WebStudio NTWebServer Remote File Access | web studio | 10.0 (v2.0) | High | 344365 , 390716 |
| CVE-2011-0807 | Sun/Oracle GlassFish Server Authenticated Code Execution | glassfish server | 10.0 (v2.0) | High | 392647 |
| CVE-2011-1653 | CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection | total defense | 10.0 (v2.0) | High | 340145 , 340155 , 340156 , 341155 , 344370 |
| CVE-2011-1669 | WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) | wp custom pages | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-4769 | Joomla! Component Jimtawl 1.0.2 - Local File Inclusion | com jimtawl | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-0063 | Majordomo2 _list_file_get() Directory Traversal | majordomo 2 | 5.0 (v2.0) | Medium | 340007 |
| CVE-2011-0049 | Majordomo2 _list_file_get() Directory Traversal | majordomo 2 | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-0276 | HP OpenView Performance Insight Server Backdoor Account Code Execution | openview performance insight | 10.0 (v2.0) | High | 330791 , 334168 , 340152 |
| CVE-2010-4719 | Joomla! Component JRadio - Local File Inclusion | com jradio | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-0518 | LotusCMS 3.0 eval() Remote Command Execution | fraise | 5.1 (v2.0) | Medium | 340095 , 340128 , 380018 , 390801 , 393655 |
| CVE-2010-3600 | Oracle Database Client System Analyzer Arbitrary File Upload | database server | 7.5 (v2.0) | High | 340007 , 340016 , 340017 , 340148 , 344360 , 344361 , 344365 , 344366 , 344370 , 390614 , 390709 |
| CVE-2010-4617 | Joomla! Component JotLoader 2.2.1 - Local File Inclusion | com jotloader | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-4275 | Radius Manager 3.8.0 - Multiple Cross-Site Scripting Vulnerabilities | radius manager | 3.5 (v2.0) | Low | 346755 |
| CVE-2010-3964 | MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution | sharepoint server | 7.5 (v2.0) | High | 330791 , 340152 , 344360 |
| CVE-2010-4297 | VMware Tools - Update OS Command Injection | workstation | 7.2 (v2.0) | High | 392301 |
| CVE-2010-4282 | Pandora Fms < 3.1.1 - Directory Traversal | pandora fms | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-4231 | Camtron CMNC-200 IP Camera - Directory Traversal | cmnc-200 firmware | 7.8 (v2.0) | High | 347009 |
| CVE-2010-4094 | Apache Tomcat Manager Authenticated Upload Code Execution | rational quality manager | 5.0 (v2.0) | Medium | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2010-3714 | TYPO3 sa-2010-020 Remote File Disclosure | typo3 | 7.1 (v2.0) | High | 344360 , 390613 , 390614 |
| CVE-2010-0219 | Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP) | axis2 | 10.0 (v2.0) | High | 330791 , 334168 , 340152 , 360152 , 391213 |
| CVE-2010-3585 | Oracle VM Server Virtual Server Agent Command Injection | vm | 9.0 (v2.0) | High | 344370 |
| CVE-2010-3486 | SmarterMail < 7.2.3925 - Persistent Cross-Site Scripting | smartermail | 5.0 (v2.0) | Medium | 392301 |
| CVE-2010-3426 | Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion | com jphone | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-3203 | Joomla! Component PicSell 1.0 - Arbitrary File Retrieval | com picsell | 5.0 (v2.0) | Medium | 340007 , 344360 |
| CVE-2010-1870 | Apache Struts Remote Command Execution | struts | 5.0 (v2.0) | Medium | 340087 , 360151 , 380026 |
| CVE-2010-2861 | ColdFusion Server Check | coldfusion | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390613 , 390614 , 390704 , 390709 , 392647 |
| CVE-2010-1871 | JBoss Seam 2 File Upload and Execute | jboss enterprise application platform | 8.8 (v3.1) | High | 337206 , 337210 , 340128 , 344370 , 360152 , 360153 , 380018 , 390801 |
| CVE-2010-2918 | Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion | com joomla visites | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-2920 | Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion | com foobla suggestions | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2857 | Joomla! Component Music Manager - Local File Inclusion | com music | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0904 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 5.0 (v2.0) | Medium | 340014 , 340193 , 344362 , 344365 |
| CVE-2010-2682 | Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion | com realtyna | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2680 | Joomla! Component jesectionfinder - Local File Inclusion | com jesectionfinder | 6.8 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-2507 | Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion | com picasa2gallery | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2333 | LiteSpeed Source Code Disclosure/Download | litespeed web server | 5.0 (v2.0) | Medium | 344365 |
| CVE-2010-2307 | Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal | surfboard sbv6120e | 5.0 (v2.0) | Medium | 347009 |
| CVE-2010-2259 | Joomla! Component com_bfsurvey - Local File Inclusion | com bfsurvey profree | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2128 | Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion | com jequoteform | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2122 | Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval | com simpledownload | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2033 | Joomla! Percha Categories Tree 0.6 - Local File Inclusion | com perchacategoriestree | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2034 | Joomla! Component Percha Image Attach 1.1 - Directory Traversal | com perchaimageattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2035 | Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal | com perchagallery | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2036 | Joomla! Component Percha Fields Attach 1.0 - Directory Traversal | com perchafieldsattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2037 | Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal | com perchadownloadsattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2045 | Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion | com dioneformwizard | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2050 | Joomla! Component MS Comment 0.8.0b - Local File Inclusion | com mscomment | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2018 | Lokomedia CMS - Local File Inclusion | lokomedia cms | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-1952 | Joomla! Component BeeHeard 1.0 - Local File Inclusion | com beeheard | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1953 | Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion | com multimap | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1954 | Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion | com multiroot | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1955 | Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion | com blogfactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1956 | Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion | com gadgetfactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1957 | Joomla! Component Love Factory 1.3.4 - Local File Inclusion | com lovefactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1977 | Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion | com jwhmcs | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1980 | Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion | com joomlaflickr | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1983 | Joomla! Component redTWITTER 1.0 - Local File Inclusion | com redtwitter | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1979 | Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion | com datafeeds | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1981 | Joomla! Component Fabrik 2.0 - Local File Inclusion | fabrik | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1982 | Joomla! Component JA Voice 2.0 - Local File Inclusion | com javoice | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1875 | Joomla! Component Property - Local File Inclusion | com properties | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1878 | Joomla! Component OrgChart 1.0.0 - Local File Inclusion | com orgchart | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1858 | Joomla! Component SMEStorage - Local File Inclusion | com smestorage | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1717 | Joomla! Component iF surfALERT 1.2 - Local File Inclusion | if surfalert | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1715 | Joomla! Component Online Exam 1.5.0 - Local File Inclusion | com onlineexam | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1718 | Joomla! Component Archery Scores 1.0.6 - Local File Inclusion | com archeryscores | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1719 | Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion | com mtfireeagle | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1722 | Joomla! Component Online Market 2.x - Local File Inclusion | com market | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1723 | Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion | com drawroot | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1714 | Joomla! Component Arcade Games 1.0 - Local File Inclusion | com arcadegames | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1653 | Joomla! Component Graphics 1.0.6 - Local File Inclusion | com graphics | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1657 | Joomla! Component SmartSite 1.0.0 - Local File Inclusion | com smartsite | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1658 | Joomla! Component NoticeBoard 1.3 - Local File Inclusion | com noticeboard | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1659 | Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion | com ultimateportfolio | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1602 | Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion | com zimbcomment | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1603 | Joomla! Component ZiMBCore 0.1 - Local File Inclusion | com zimbcore | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1607 | Joomla! Component WMI 1.5.0 - Local File Inclusion | com wmi | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1601 | Joomla! Component JA Comment - Local File Inclusion | com jacomment | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1428 | JBoss Vulnerability Scanner | jboss enterprise application platform | 7.5 (v3.1) | High | 330925 |
| CVE-2010-0738 | JBoss Vulnerability Scanner | jboss enterprise application platform | 5.3 (v3.1) | Medium | 330925 , 340128 , 360152 , 380018 , 390801 , 392648 |
| CVE-2010-1429 | JBoss Vulnerability Scanner | jboss enterprise application platform | 5.0 (v2.0) | Medium | 330925 , 382240 |
| CVE-2010-1587 | Apache ActiveMQ Directory Traversal | activemq | 5.0 (v2.0) | Medium | 344365 , 390716 |
| CVE-2010-1531 | Joomla! Component redSHOP 1.0 - Local File Inclusion | com redshop | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1533 | Joomla! Component TweetLA 1.0.1 - Local File Inclusion | com tweetla | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1535 | Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion | com travelbook | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1532 | Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion | com powermail | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1534 | Joomla! Component Shoutbox Pro - Local File Inclusion | com shoutbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1540 | Joomla! Component com_blog - Directory Traversal | com myblog | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1495 | Joomla! Component Matamko 1.01 - Local File Inclusion | com matamko | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1491 | Joomla! Component MMS Blog 2.3.0 - Local File Inclusion | com mmsblog | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1494 | Joomla! Component AWDwall 1.5.4 - Local File Inclusion | com awdwall | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1470 | Joomla! Component Web TV 1.0 - Local File Inclusion | com webtv | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1471 | Joomla! Component Address Book 1.5.0 - Local File Inclusion | com addressbook | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1472 | Joomla! Component Horoscope 1.5.0 - Local File Inclusion | com horoscope | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1469 | Joomla! Component JProject Manager 1.0 - Local File Inclusion | com jprojectmanager | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1473 | Joomla! Component Advertising 0.25 - Local File Inclusion | com advertising | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1474 | Joomla! Component Sweetykeeper 1.5 - Local File Inclusion | com sweetykeeper | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1475 | Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion | com preventive | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1476 | Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion | com alphauserpoints | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1478 | Joomla! Component Jfeedback 1.2 - Local File Inclusion | com jfeedback | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1461 | Joomla! Component Photo Battle 1.0.1 - Local File Inclusion | com photobattle | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1352 | Joomla! Component Juke Box 1.7 - Local File Inclusion | com jukebox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1353 | Joomla! Component LoginBox - Local File Inclusion | com loginbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1354 | Joomla! Component VJDEO 1.0 - Local File Inclusion | com vjdeo | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1340 | Joomla! Component com_jresearch - 'Controller' Local File Inclusion | com jresearch | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1345 | Joomla! Component Cookex Agency CKForms - Local File Inclusion | com ckforms | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1306 | Joomla! Component Picasa 2.0 - Local File Inclusion | com joomlapicasa2 | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1304 | Joomla! Component User Status - Local File Inclusion | com userstatus | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1305 | Joomla! Component JInventory 1.23.02 - Local File Inclusion | com jinventory | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1307 | Joomla! Component Magic Updater - Local File Inclusion | com joomlaupdater | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1308 | Joomla! Component SVMap 1.1.1 - Local File Inclusion | com svmap | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1312 | Joomla! Component News Portal 1.5.x - Local File Inclusion | com news portal | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1314 | Joomla! Component Highslide 1.5 - Local File Inclusion | com hsconfig | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1315 | Joomla! Component webERPcustomer - Local File Inclusion | com weberpcustomer | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1313 | Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion | com sebercart | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1302 | Joomla! Component DW Graph - Local File Inclusion | com dwgraphs | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1219 | Joomla! Component com_janews - Local File Inclusion | com janews | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1217 | Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion | je form creator | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1056 | Joomla! Component com_rokdownloads - Local File Inclusion | com rokdownloads | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1081 | Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion | com communitypolls | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0972 | Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion | com gcalendar | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0985 | Joomla! Component com_abbrev - Local File Inclusion | com abbrev | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0982 | Joomla! Component com_cartweberp - Local File Inclusion | com cartweberp | 4.3 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-4679 | Joomla! Portfolio Nexus - Remote File Inclusion | com if nexus | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-0942 | Joomla! Component com_jvideodirect - Directory Traversal | com jvideodirect | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0943 | Joomla! Component com_jashowcase - Directory Traversal | com jashowcase | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0944 | Joomla! Component com_jcollection - Directory Traversal | com jcollection | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0759 | Joomla! Plugin Core Design Scriptegrator - Local File Inclusion | scriptegrator plugin | 7.5 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2010-0696 | Joomla! Component Jw_allVideos - Arbitrary File Retrieval | jw allvideos | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-0557 | Apache Tomcat Manager Authenticated Upload Code Execution | cognos express | 7.5 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2010-0467 | Joomla! Component CCNewsLetter - Local File Inclusion | com ccnewsletter | 5.8 (v3.1) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0157 | Joomla! Component com_biblestudy - Local File Inclusion | joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-3849 | HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow | openview network node manager | 10.0 (v2.0) | High | 392648 |
| CVE-2009-4223 | KR-Web <=1.1b2 - Remote File Inclusion | kr-php web content server | 7.5 (v2.0) | High | 340162 , 340163 |
| CVE-2009-4202 | Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion | joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-4188 | Apache Tomcat Manager Authenticated Upload Code Execution | operations dashboard | 10.0 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2009-4189 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2009-4098 | OpenX banner-edit.php File Upload PHP Code Execution | openx | 6.0 (v2.0) | Medium | 330791 , 334168 , 340152 , 360152 |
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2009-3548 | Apache Tomcat Manager Authenticated Upload Code Execution | tomcat | 7.5 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2009-1479 | boxalino 09.05.25-0421 - Directory Traversal | boxalino | 7.5 (v2.0) | High | 340007 , 344360 , 390709 |
| CVE-2009-3318 | Joomla! Roland Breedveld Album 1.14 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | 9.3 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 391213 |
| CVE-2009-3053 | Joomla! Agora 3.0.0b - Local File Inclusion | Joomla! | 6.8 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6982 | Devalcms 1.4a - Cross-Site Scripting | devalcms | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2009-1872 | Adobe Coldfusion <=8.0.1 - Cross-Site Scripting | coldfusion | 4.3 (v2.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2009-1977 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 10.0 (v2.0) | High | 340014 , 340193 , 344362 , 344365 |
| CVE-2009-1978 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 9.0 (v2.0) | High | 340014 , 340193 , 344362 , 344365 |
| CVE-2009-2265 | ColdFusion 8.0.1 Arbitrary File Upload and Execute | fckeditor | 7.5 (v2.0) | High | 390613 , 390614 , 390700 |
| CVE-2009-2100 | Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-2015 | Joomla! MooFAQ 1.0 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6825 | Trixbox langChoice PHP Local File Inclusion | trixbox | 6.8 (v2.0) | Medium | 340007 , 340011 , 340128 , 344370 , 380018 , 390614 , 390801 |
| CVE-2009-1558 | Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion | wvc54gca | 7.8 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2009-1496 | Joomla! Cmimarketplace 0.1 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6668 | nweb2fax <=0.2.7 - Local File Inclusion | nweb2fax | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-1151 | PhpMyAdmin Scripts - Remote Code Execution | phpmyadmin | 9.8 (v3.1) | Critical | 340029 , 344360 |
| CVE-2008-6508 | Openfire Admin Console Authentication Bypass | openfire | 7.5 (v2.0) | High | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 391213 |
| CVE-2009-0932 | Horde/Horde Groupware - Local File Inclusion | horde | 6.4 (v2.0) | Medium | 340007 , 340029 , 344360 , 390613 , 390614 , 390709 |
| CVE-2008-6465 | Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting | h-sphere | 4.3 (v2.0) | Medium | 333141 , 340149 , 342259 , 346755 , 347198 , 360030 |
| CVE-2009-0880 | IBM System Director Agent DLL Injection | director | 6.8 (v2.0) | Medium | 390716 |
| CVE-2009-0815 | Typo3 sa-2009-002 File Disclosure | typo3 | 5.0 (v2.0) | Medium | 344360 |
| CVE-2008-6222 | Joomla! ProDesk 1.0/1.2 - Local File Inclusion | pro desk support center | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6172 | Joomla! Component RWCards 3.0.11 - Local File Inclusion | rwcards | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2008-6132 | phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection | phpscheduleit | 6.8 (v2.0) | Medium | 340011 , 340128 , 340133 , 380018 , 390801 |
| CVE-2009-0545 | ZeroShell <= 1.0beta11 Remote Code Execution | zeroshell | 10.0 (v2.0) | High | 312657 , 340007 , 340029 , 344360 , 344370 , 347009 , 390709 |
| CVE-2008-6080 | Joomla! ionFiles 4.4.2 - Local File Inclusion | com ionfiles | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-0255 | TYPO3 sa-2009-001 Weak Encryption Key File Disclosure | typo3 | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-5448 | Oracle Secure Backup exec_qr() Command Injection Vulnerability | secure backup | 10.0 (v2.0) | High | 340014 , 340193 , 344365 |
| CVE-2008-5587 | phpPgAdmin <=4.2.1 - Local File Inclusion | phppgadmin | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2008-4764 | Joomla! <=2.0.0 RC2 - Local File Inclusion | com extplorer | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-4668 | Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion | com imagebrowser | 9.0 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High | 340011 , 340095 , 344362 , 344363 , 346755 , 360152 , 380026 , 390801 |
| CVE-2008-1547 | Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection | exchange server | 4.3 (v2.0) | Medium | 390716 |
| CVE-2008-4193 | Alt-N SecurityGateway username Buffer Overflow | securitygateway | 10.0 (v2.0) | High | 390716 |
| CVE-2008-2938 | toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities | tomcat | 4.3 (v2.0) | Medium | 392301 |
| CVE-2008-3273 | JBoss Vulnerability Scanner | enterprise application platform | 5.0 (v2.0) | Medium | 330925 |
| CVE-2008-3257 | Oracle Weblogic Apache Connector POST Request Buffer Overflow | weblogic server | 10.0 (v2.0) | High | 390724 |
| CVE-2008-2650 | CMSimple 3.1 - Local File Inclusion | cmsimple | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2008-2398 | AppServ Open Project <=2.5.10 - Cross-Site Scripting | appserv | 4.3 (v2.0) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2008-1059 | WordPress Sniplets 1.1.2 - Local File Inclusion | sniplets plugin | 7.5 (v2.0) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2008-1061 | WordPress Sniplets <=1.2.2 - Cross-Site Scripting | sniplets plugin | 4.3 (v2.0) | Medium | 340147 , 341266 |
| CVE-2008-0506 | Coppermine Photo Gallery picEditor.php Command Execution | coppermine photo gallery | 6.8 (v2.0) | Medium | 340007 , 344361 , 344363 |
| CVE-2007-6377 | BadBlue 2.72b PassThru Buffer Overflow | badblue | 7.5 (v2.0) | High | 390716 |
| CVE-2007-5728 | phpPgAdmin <=4.1.1 - Cross-Site Scripting | phppgadmin | 4.3 (v2.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2007-4556 | OpenSymphony XWork/Apache Struts2 - Remote Code Execution | xwork | 6.8 (v2.0) | Medium | 337207 , 337209 , 337211 , 344360 |
| CVE-2007-4504 | Joomla! RSfiles <=1.0.2 - Local File Inclusion | rsfiles | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2007-3385 | Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure | tomcat | 4.3 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2007-2449 | Apache Tomcat 4.x-7.x - Cross-Site Scripting | tomcat | 4.3 (v2.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2007-1036 | JBoss JMX Console Deployer Upload and Execute | jboss application server | 7.5 (v2.0) | High | 340128 , 360152 , 380018 , 390801 , 392648 |
| CVE-2007-0977 | Lotus Domino Password Hash Collector | lotus domino | 7.1 (v2.0) | High | 310189 |
| CVE-2007-0885 | Jira Rainbow.Zen - Cross-Site Scripting | rainbow.zen | 6.8 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2006-4602 | TikiWiki jhot Remote Command Execution | tikiwiki cms/groupware | 7.5 (v2.0) | High | 340133 |
| CVE-2006-3835 | toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities | tomcat | 5.0 (v2.0) | Medium | 392301 |
| CVE-2006-3392 | Webmin File Disclosure | usermin | 5.0 (v2.0) | Medium | 347009 |
| CVE-2006-2842 | Squirrelmail <=1.4.6 - Local File Inclusion | squirrelmail | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2006-2826 | PHPLib < 7.4 - SQL Injection | phplib | 7.5 (v2.0) | High | 340017 , 340181 , 341245 , 344370 , 360147 , 360148 |
| CVE-2006-1551 | PAJAX Remote Command Execution | pajax | 7.5 (v2.0) | High | 391213 |
| CVE-2006-1681 | Cherokee HTTPD <=0.5 - Cross-Site Scripting | cherokee httpd | 4.3 (v2.0) | Medium | 341266 |
| CVE-2006-0887 | PHPLib < 7.4 - SQL Injection | phplib | 7.5 (v2.0) | High | 340017 , 340181 , 341245 , 344370 , 360147 , 360148 |
| CVE-2005-4734 | Microsoft IIS ISAPI RSA WebAgent Redirect Overflow | authentication agent for web | 6.4 (v2.0) | Medium | 310529 , 390716 |
| CVE-2005-4385 | Cofax <=2.0RC3 - Cross-Site Scripting | cofax | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2005-3757 | Google Appliance ProxyStyleSheet Command Execution | mini search appliance | 7.5 (v2.0) | High | 340162 , 340163 , 340165 |
| CVE-2005-3398 | HTTP Cross-Site Tracing Detection | solaris | 4.3 (v2.0) | Medium | 340002 , 341266 |
| CVE-2005-3128 | SquirrelMail Address Add 1.4.2 - Cross-Site Scripting | address add plugin | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2005-2799 | Linksys WRT54GL apply.cgi Command Execution | wrt54g | 7.5 (v2.0) | High | 340014 , 340029 , 344363 , 344364 , 344366 , 344370 |
| CVE-2005-2847 | Barracuda IMG.PL Remote Command Execution | barracuda spam firewall | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 344363 , 344370 , 390709 |
| CVE-2005-2773 | HP Openview connectedNodes.ovpl Remote Command Execution | openview network node manager | 9.8 (v3.1) | Critical | 344363 |
| CVE-2005-2733 | Simple PHP Blog Remote Command Execution | simple php blog | 7.5 (v2.0) | High | 334168 , 340128 , 360152 , 380018 , 390700 , 390801 , 391213 |
| CVE-2005-1921 | PHP XML-RPC Arbitrary Code Execution | xml rpc | 7.5 (v2.0) | High | 344370 , 380026 |
| CVE-2005-2086 | phpBB viewtopic.php Arbitrary Code Execution | phpbb | 7.5 (v2.0) | High | 340087 , 340095 , 390761 |
| CVE-2005-0595 | BadBlue 2.5 EXT.dll Buffer Overflow | badblue | 7.5 (v2.0) | High | 390716 |
| CVE-2004-1037 | TWiki Search Function Arbitrary Command Execution | twiki | 10.0 (v2.0) | High | 344361 , 393655 |
| CVE-2005-0511 | vBulletin misc.php Template Name Arbitrary Code Execution | vbulletin | 7.5 (v2.0) | High | 340087 , 393655 |
| CVE-2004-1134 | Microsoft IIS ISAPI w3who.dll Query String Overflow | w3who.dll | 10.0 (v2.0) | High | 390716 |
| CVE-2004-1315 | phpBB viewtopic.php Arbitrary Code Execution | phpbb | 7.5 (v2.0) | High | 340087 , 340095 , 390761 |
| CVE-2004-0798 | Ipswitch WhatsUp Gold 8.03 Buffer Overflow | whatsup gold | 7.5 (v2.0) | High | 310040 , 310152 |
| CVE-2004-0519 | SquirrelMail 1.4.x - Folder Name Cross-Site Scripting | propack | 6.8 (v2.0) | Medium | 341266 , 346755 |
| CVE-2003-0822 | MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow | frontpage server extensions | 7.5 (v2.0) | High | 310226 , 390716 , 390724 |
| CVE-2003-0471 | Alt-N WebAdmin USER Buffer Overflow | webadmin | 7.5 (v2.0) | High | 310712 , 390716 |
| CVE-2003-0349 | MS03-022 Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow | Windows 2000 | 7.5 (v2.0) | High | 390716 |
| CVE-2003-0050 | QuickTime Streaming Server parse_xml.cgi Remote Execution | darwin streaming server | 7.5 (v2.0) | High | 340128 , 360152 , 380018 , 390801 |
| CVE-2002-1142 | MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow | data access components | 7.5 (v2.0) | High | 310710 |
| CVE-2002-1131 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | squirrelmail | 7.5 (v2.0) | High | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2001-0241 | MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow | Windows 2000 | 10.0 (v2.0) | High | 390716 |
| CVE-2001-0333 | MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution | internet information server | 7.5 (v2.0) | High | 340193 |
| CVE-2001-1341 | Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities | ipc at chip embedded-webserver | 5.0 (v2.0) | Medium | 390716 , 392301 |
| CVE-2000-1089 | MS00-094 Microsoft IIS Phone Book Service Overflow | Windows 2000 | 10.0 (v2.0) | High | 310728 , 390716 |
| CVE-2000-1024 | ewave servletexec Security Vulnerability | ewave servletexec | 10.0 (v2.0) | High | 351000 |
| CVE-2000-0760 | Jakarta Tomcat 3.1 and 3.0 - Information Disclosure | tomcat | 6.4 (v2.0) | Medium | 310094 |
| CVE-2000-0114 | Microsoft FrontPage Extensions - Information Disclosure | internet information server | 5.0 (v2.0) | Medium | 310226 , 392301 |
| CVE-1999-1011 | MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution | data access components | 10.0 (v2.0) | High | 310710 , 334168 , 340145 , 340156 , 341145 , 341245 , 390724 , 391213 , 392647 |
| CVE-2024-23167 | GestSup - Cross-Site Scripting | gestsup | 8.6 | High | 333141 |
| CVE-2026-57582 | GeoNetwork - Reflected Cross-Site Scripting | core-geonetwork | 8.2 (v3.1) | High | 346755 |
| CVE-2024-25669 | CaseAware a360inc - Cross-Site Scripting | caseaware | 6.1 | Medium | 347198 |
| CVE-2013-1625 | Titan FTP Administrative Password Disclosure | - | N/A | N/A | 350147 , 390716 |
| CVE-2015-0975 | OpenNMS Authenticated XXE | - | N/A | N/A | 344360 , 344372 |
| CVE-2018-10818 | LG NAS Devices - Remote Code Execution | - | N/A | N/A | 340014 |
| CVE-2019-8962 | FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) | - | N/A | N/A | 345490 |
| CVE-2023-1434 | Odoo - Cross-Site Scripting | odoo | N/A | N/A | 341266 |
| CVE-2023-46391 | WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS) | - | N/A | N/A | 340147 , 340148 , 346755 , 390585 |
| CVE-2025-32101 | UNA CMS <= 14.0.0-RC4 - PHP Object Injection | - | N/A | N/A | 390501 , 390614 |
| CVE-2026-59774 | Forgejo Arbitrary File Read via Org-mode Include | - | N/A | N/A | 340029 , 347009 |