Atomicorp WAF Research Notes

Atomicorp WAF Research Notes

Selected CVE-related research notes documenting testing results, engineering observations, attack-pattern analysis, and WAF rule interactions.

These notes are not a CVE coverage matrix, completeness claim, certification list, or list of all vulnerabilities mitigated by Atomicorp products.

A published CVE research note documents a positive research finding for that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

Last updated: 2026-07-29

CVENameProductCVSSSeverityRules Observed
CVE-2009-0545ZeroShell <= 1.0beta11 Remote Code Executionzeroshell10.0HIGH347009
CVE-2010-5286Joomla! Component Jstore - 'Controller' Local File Inclusioncom_jstore10.0critical347009
CVE-2011-0518LotusCMS 3.0 - Remote Code Executioncore/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled10.0critical393655
CVE-2013-5755Yealink VoIP Phone SIP-T38G - Remote Command Executionsip-t38g10.0HIGH344370, 390726, 392647
CVE-2014-8877WordPress Plugin CM Download Manager 2.0.0 - Code Injectioncm download manager10.0HIGH390726, 392301, 392647
CVE-2017-5638Apache Struts 2 - Remote Command Executionstruts10.0critical390719
CVE-2019-11510Pulse Connect Secure SSL VPN Arbitrary File Readconnect_secure10.0critical347009
CVE-2019-16932Visualizer <3.3.1 - Blind Server-Side Request Forgeryvisualizer10.0CRITICAL344362
CVE-2019-7256eMerge E3 1.00-06 - Remote Code Executionlinear_emerge_essential_firmware10.0critical347009
CVE-2021-44228Apache Log4j2 Remote Code Injectionlog4j10.0critical345115
CVE-2022-22536SAP Memory Pipes (MPI) Desynchronizationcontent_server10.0CRITICAL392301
CVE-2024-10081CodeChecker <= 6.24.1 - Authentication BypassCodeChecker10.0critical392301
CVE-2024-21650XWiki < 4.10.20 - Remote code executionxwiki10.0critical340130
CVE-2024-22476Intel Neural Compressor <2.5.0 - SQL Injection-10.0CRITICAL341245
CVE-2024-2389Progress Kemp Flowmon - Command Injection-10.0critical344363
CVE-2024-4040CrushFTP VFS - Sandbox Escape LFRcrushftp10.0critical392301
CVE-2024-50603Aviatrix Controller - Remote Code Executioncontroller10.0critical344360
CVE-2025-20281Cisco ISE - Remote Code Executionidentity_services_engine10.0critical392301
CVE-2025-2473Company Visitor Management System 1.0 - SQL Injection-10.0critical340145
CVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader - Deserialization-10.0critical330791
CVE-2025-34030sar2html <=3.2.2 Plot Parameter - Remote Code Executionsar2html10.0critical340014
CVE-2025-34035EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Executionesr300 firmware10.0CRITICAL341245
CVE-2025-34040Zhiyuan OA - arbitrary file upload leading-10.0CRITICAL330791, 340007
CVE-2025-45854JEHC-BPM - Remote Code Executejehc-bpm10.0CRITICAL390724
CVE-2025-48828vBulletin replaceAdTemplate - Remote Code Executionvbulletin10.0critical344370
CVE-2025-49132Pterodactyl Panel - Remote Code Executionpanel10.0critical340007
CVE-2025-53833LaRecipe < 2.8.1 Remote Code Execution via SSTIlarecipe10.0critical340087
CVE-2025-55182React Server Components - Remote Code Execution-10.0critical393655
CVE-2025-59528Flowise - Remote Code Executionflowise10.0CRITICAL380026
CVE-2025-7160Zoo Management System 1.0 - SQL Injection-10.0critical340145
CVE-2025-9744Loan Management System 1.0 - SQL Injection-10.0critical340156
CVE-2026-22557UniFi Network Application - Path Traversalunifi_network_application10.0CRITICAL340007
CVE-2026-48907Joomla! JCE extension < 2.9.99.5 unauthenticated RCEjce10.0CRITICAL333360, 383871
CVE-2026-8054dotCMS Core Publish Audit API - Unauthenticated SQL Injectiondotcms10.0CRITICAL340145
CVE-2019-10758mongo-express Remote Code Executionmongo-express9.9critical380026
CVE-2019-4013IBM Bigfix Platform 9.5.9.62 - Arbitrary File Uploadbigfix platform9.9CRITICAL392301
CVE-2021-21345XStream < 1.4.16 - Remote Code Executionxstream9.9critical344363
CVE-2021-21881Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injectionpremierwave_2050_firmware9.9critical340014
CVE-2021-33690SAP NetWeaver Development Infrastructure - Server Side Request Forgerynetweaver_development_infrastructure9.9critical340162
CVE-2022-45808LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLilearnpress9.9critical380122
CVE-2023-6825WordPress File Manager <= 7.2.1 - Directory Traversalfile-manager9.9CRITICAL377360
CVE-2024-27956WordPress Automatic Plugin <= 3.92.0 - SQL InjectionValvePress Automatic9.9critical390614
CVE-2024-51482ZoneMinder v1.37.* <= 1.37.64 - SQL Injectionzoneminder9.9CRITICAL380122
CVE-2024-9463PaloAlto Networks Expedition - Remote Code Executionexpedition9.9critical344363
CVE-2009-1151PhpMyAdmin Scripts - Remote Code Executionphpmyadmin9.8CRITICAL344360
CVE-2010-2861Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFIcoldfusion9.8CRITICAL390614
CVE-2010-4239Tiki Wiki CMS Groupware 5.2 - Local File Inclusiontikiwiki_cms/groupware9.8CRITICAL340007
CVE-2012-1259Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilitiesscrutinizer netflow &amp; sflow analyzer9.8CRITICAL341266, 390727, 392301, 392648
CVE-2013-2681Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware9.8CRITICAL392301
CVE-2013-4864MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware9.8CRITICAL390726, 392647
CVE-2013-7137Burden 1.8 - Authentication Bypassburden9.8CRITICAL390727, 392301, 392648
CVE-2013-7285XStream <1.4.6/1.4.10 - Remote Code Executionxstream9.8critical344363
CVE-2014-1203Eyou E-Mail <3.6 - Remote Code Executioneyou9.8critical344360
CVE-2014-3206Seagate BlackArmor NAS - Command Injectionblackarmor_nas_220_firmware9.8critical340014
CVE-2014-6271ShellShock - Remote Code Executionbash9.8critical330701
CVE-2014-6287HTTP File Server <2.3c - Remote Command Executionhttp_file_server9.8critical390614
CVE-2014-8673SO Planning 1.32 - Multiple Vulnerabilitiessoplanning9.8CRITICAL340155, 390726, 392647
CVE-2014-9148Fiyo CMS 2.0.1.8 - Multiple Vulnerabilitiesfiyo cms9.8CRITICAL344360, 390720, 390726, 392647
CVE-2014-9614Netsweeper 4.0.5 - Default Weak Accountnetsweeper9.8critical392301
CVE-2015-1635Microsoft Windows 'HTTP.sys' - Remote Code Executionwindows_79.8CRITICAL363434
CVE-2015-3933GeniXCMS 0.0.3 - 'register.php' SQL Injectiongenixcms9.8CRITICAL390720, 390726, 392647
CVE-2015-4455WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Uploadaviary_image_editor_add-on_for_gravity_forms9.8critical340007
CVE-2015-4664Xceedium Xsuite - Multiple Vulnerabilitiesprivileged access manager9.8CRITICAL344360, 347198, 390726, 392647
CVE-2015-4667Xceedium Xsuite - Multiple Vulnerabilitiesxsuite9.8CRITICAL344360, 347198, 390726, 392647
CVE-2015-6970Bosch Security Systems Dinion NBN-498 - Web Interface XML Injectionnbn-498 dinion2x day/night ip cameras firmware9.8CRITICAL390726, 392301, 392647
CVE-2015-9323404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection404_to_3019.8critical380122
CVE-2016-10108Western Digital MyCloud NAS - Command Injectionmycloud_nas9.8critical344364
CVE-2016-10134Zabbix - SQL Injectionzabbix9.8critical340159
CVE-2016-15042WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Uploadfrontend_file_manager9.8critical382238
CVE-2016-15043WP Mobile Detector <= 3.5 - Unrestricted File Upload-9.8critical340162
CVE-2016-1555NETGEAR WNAP320 Access Point Firmware - Remote Command Injectionwnap320_firmware9.8critical340014
CVE-2016-3088Apache ActiveMQ Fileserver - Arbitrary File Writeactivemq9.8critical392301
CVE-2016-4337Ktools Photostore 4.7.5 - Blind SQL Injectionphotostore9.8CRITICAL390726, 392647
CVE-2016-5674NUUO NVR camera debugging_center_utils_.php - Command Executionreadynas_surveillance9.8CRITICAL344363
CVE-2016-6600WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilitieswebnms framework9.8CRITICAL390727, 392301, 392648
CVE-2016-6602WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilitieswebnms framework9.8CRITICAL390727, 392301, 392648
CVE-2016-6603WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilitieswebnms framework9.8CRITICAL390727, 392301, 392648
CVE-2016-9682Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injectionsonicwall secure remote access server9.8CRITICAL390727, 392301, 392648
CVE-2017-11165DataTaker DT80 dEX 1.50.012 - Information Disclosuredt80_dex_firmware9.8critical390716
CVE-2017-11444Subrion CMS <4.1.5.10 - SQL Injectionsubrion_cms9.8CRITICAL341245
CVE-2017-12611Apache Struts2 S2-053 - Remote Code Executionstruts9.8critical347009
CVE-2017-12635Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalationcouchdb9.8critical392301
CVE-2017-14094Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Controlsmart protection server9.8CRITICAL330791
CVE-2017-14097Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Controlsmart protection server9.8CRITICAL330791
CVE-2017-14135OpenDreambox 2.0.0 - Remote Code Executionopendreambox9.8critical344364
CVE-2017-14942Intelbras WRN 150 - Authentication Bypasswrn1509.8critical390716
CVE-2017-16935Ametys CMS 4.0.2 - Password Resetametys9.8CRITICAL390724
CVE-2017-17731DedeCMS 5.7 - SQL Injectiondedecms9.8critical344370
CVE-2017-17970Muviko 1.1 - SQL Injectionmuviko9.8CRITICAL390727, 392301, 392648
CVE-2017-17976PerfexCRM 1.9.7 - Arbitrary File Uploadperfex crm9.8CRITICAL392301
CVE-2017-17999RISE 1.9 - 'search' SQL Injectionrise ultimate project manager9.8CRITICAL380122, 390724
CVE-2017-18001Trustwave SWG 11.8.0.27 - SSH Unauthorized Accesssecure web gateway9.8CRITICAL330791
CVE-2017-18580WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Executionshortcodes-ultimate9.8CRITICAL377360
CVE-2017-5689Intel Active Management Technology - System Privilegesproliant ml10 gen9 server firmware9.8CRITICAL390726, 392647
CVE-2017-8917Joomla! <3.7.1 - SQL Injectionjoomla!9.8critical340159
CVE-2017-9791Apache Struts2 S2-053 - Remote Code Executionstruts9.8critical337207
CVE-2017-9841PHPUnit - Remote Code Executionphpunit9.8critical393782
CVE-2018-0127Cisco RV132W/RV134W Router - Information Disclosurerv132w_firmware9.8critical312863
CVE-2018-1000861Jenkins - Remote Command Injectionjenkins9.8critical390722
CVE-2018-10562Dasan GPON Devices - Remote Code Executiongpon_router_firmware9.8critical392301
CVE-2018-11511ASUSTOR ADM 3.1.0.RFQ3 - SQL Injectionasustor-data-master9.8critical380122
CVE-2018-11535Sitemakin SLAC 1.0 - 'my_item_search' SQL Injectionslac9.8CRITICAL340155
CVE-2018-11686FlexPaper/FlowPaper 2.3.6 - Remote Code Executionflowpaper9.8critical340029
CVE-2018-12031Eaton Intelligent Power Manager 1.6 - Directory Traversalintelligent_power_manager9.8critical340007, 347009
CVE-2018-12596Ektron CMS 9.20 SP2 - Improper Access Restrictionsektron cms9.8CRITICAL390727, 392301, 392648
CVE-2018-1273Spring Data Commons - Remote Code Executionspring_data_commons9.8critical344360
CVE-2018-13379Fortinet FortiOS - Credentials Disclosurefortios9.8critical340007
CVE-2018-14064VelotiSmart Wifi - Directory Traversalvelotismart_wifi_firmware9.8critical347009
CVE-2018-14728Responsive filemanager 9.13.1 Server-Side Request Forgeryresponsive_filemanager9.8critical392301
CVE-2018-15534Geutebrueck re_porter 7.8.974.20 - Credential Disclosurere porter 16 firmware9.8CRITICAL390727, 392301, 392648
CVE-2018-16159WordPress Gift Voucher <4.1.8 - Blind SQL Injectiongift_vouchers9.8critical380122
CVE-2018-16167LogonTracer <=1.2.0 - Remote Command Injectionlogontracer9.8critical340014
CVE-2018-16283WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusionwechat_brodcast9.8critical347009
CVE-2018-16763FUEL CMS 1.4.1 - Remote Code Executionfuel_cms9.8critical347009
CVE-2018-16836Rubedo CMS <=3.4.0 - Directory Traversalrubedo9.8critical347009
CVE-2018-17153Western Digital MyCloud NAS - Authentication Bypassmy_cloud_wdbctl0020hwt_firmware9.8critical344363
CVE-2018-17173LG Supersign EZ CMS - Remote Code Executionsupersign_cms9.8critical340014
CVE-2018-17246Kibana - Local File Inclusionkibana9.8critical347009
CVE-2018-17254Joomla! JCK Editor SQL Injectionjck_editor9.8critical340016
CVE-2018-17431Comodo Unified Threat Management Web Console - Remote Code Executionunified_threat_management_firewall9.8critical390722
CVE-2018-18923Ticketly 1.0 - 'kind_id' SQL Injectionticketly9.8CRITICAL380122
CVE-2018-18925Gogs (Go Git Service) 0.11.66 - Remote Code Executiongogs9.8critical344360
CVE-2018-19276OpenMRS Platform < 2.24.0 - Insecure Object Deserializationopenmrs9.8CRITICAL344366
CVE-2018-20985WordPress Payeezy Pay <=2.97 - Local File Inclusionwp_payeezy_pay9.8critical392301
CVE-2018-3810Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypasssmart_google_code_inserter9.8critical380026
CVE-2018-6605Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injectionzh_baidumap9.8critical340016
CVE-2018-7251Anchor CMS 0.12.3 - Error Log Exposureanchor9.8critical390716
CVE-2018-7282TITool PrintMonitor - Blind SQL Injectionprintmonitor9.8critical344370
CVE-2018-7314Joomla! Component PrayerCenter 3.0.2 - SQL Injectionprayercenter9.8critical340157
CVE-2018-7538Tuleap 9.17.99.189 - Blind SQL Injectiontuleap9.8CRITICAL380122
CVE-2018-7841Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injectionu.motion builder9.8CRITICAL344364
CVE-2018-9160SickRage < v2018.03.09 - Clear-Text Credentials HTTP Responsesickrage9.8CRITICAL390727, 392301, 392648
CVE-2019-10068Kentico CMS Insecure Deserialization Remote Code Executionkentico9.8critical341256
CVE-2019-10232Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injectiongestionnaire_libre_de_parc_informatique9.8critical340155
CVE-2019-10647ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)zzzphp9.8critical340162
CVE-2019-11581Atlassian Jira Server-Side Template Injectionjira9.8critical311299
CVE-2019-12314Deltek Maconomy 2.2.5 - Local File Inclusionmaconomy9.8critical347009
CVE-2019-12725Zeroshell 3.9.0 - Remote Command Executionzeroshell9.8critical347009
CVE-2019-12985Citrix SD-WAN Center - Remote Command Injectionnetscaler_sd-wan9.8critical340014
CVE-2019-12986Citrix SD-WAN Center - Remote Command Injectionnetscaler_sd-wan9.8critical340014
CVE-2019-12987Citrix SD-WAN Center - Remote Command Injectionnetscaler_sd-wan9.8critical340014
CVE-2019-12988Citrix SD-WAN Center - Remote Command Injectionnetscaler_sd-wan9.8critical393655
CVE-2019-12989Citrix SD-WAN and NetScaler SD-WAN - SQL Injectionnetscaler_sd-wan9.8CRITICAL340016
CVE-2019-13372D-Link Central WiFi Manager CWM(100) - Remote Code Executioncentral_wifimanager9.8critical344370
CVE-2019-15107Webmin <= 1.920 - Unauthenticated Remote Command Executionwebmin9.8critical344360
CVE-2019-16072Enigma NMS < 65.0.0 - Authenticated OS Command Injectionenigma_network_management_solution9.8CRITICAL344364
CVE-2019-16278nostromo 1.9.6 - Remote Code Executionnostromo_nhttpd9.8critical392301
CVE-2019-16662rConfig 3.9.2 - Remote Code Executionrconfig9.8critical347009
CVE-2019-16693phpIPAM 1.4 - SQL-Injectionphpipam9.8CRITICAL340016
CVE-2019-16759vBulletin 5.0.0-5.5.4 - Remote Command Executionvbulletin9.8CRITICAL341245
CVE-2019-16920D-Link Routers - Remote Code Executiondir-655_firmware9.8critical344360
CVE-2019-17270Yachtcontrol Webapplication 1.0 - Remote Command Injectionyachtcontrol9.8critical347009
CVE-2019-17564Apache Dubbo 2.5.x-2.7.4 - Insecure Deserializationdubbo9.8critical390626
CVE-2019-1935Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilitiesintegrated management controller supervisor9.8CRITICAL350147, 390724, 390727, 392301, 392648
CVE-2019-1937Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilitiesintegrated management controller supervisor9.8CRITICAL350147, 390724, 390727, 392301, 392648
CVE-2019-19740Octeth Oempro 4.8 - 'CampaignID' SQL Injectionoempro9.8CRITICAL392301
CVE-2019-19781Citrix ADC and Gateway - Directory Traversalapplication_delivery_controller_firmware9.8critical390716
CVE-2019-20504Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Executionkace_systems_management9.8CRITICAL340014
CVE-2019-25141Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Updateeasy_wp_smtp9.8CRITICAL390726
CVE-2019-25213WordPress Advanced Access Manager - Path Traversal-9.8critical344360
CVE-2019-2729Oracle WebLogic Server Administration Console - Remote Code Executioncommunications_diameter_signaling_router9.8critical393655
CVE-2019-3396Atlassian Confluence Server - Path Traversalconfluence9.8critical392301
CVE-2019-5434Revive Adserver 4.2 - Remote Code Executionrevive_adserver9.8critical344362
CVE-2019-7139Magento - SQL Injectionmagento9.8CRITICAL340016, 380026
CVE-2019-9194elFinder <= 2.1.47 - Command Injectionelfinder9.8critical390700
CVE-2019-9618WordPress GraceMedia Media Player 1.0 - Local File Inclusiongracemedia_media_player9.8critical347009
CVE-2019-9762PHPSHE 1.7 - SQL Injectionphpshe9.8critical340016
CVE-2020-10148SolarWinds Orion API - Auth Bypassorion_platform9.8critical390709
CVE-2020-10189ManageEngine Desktop Central Java Deserializationmanageengine_desktop_central9.8critical347019
CVE-2020-10220rConfig 3.9 - SQL Injectionrconfig9.8critical340016
CVE-2020-10257ThemeREX Addons - Remote Code Executionthemerex9.8CRITICAL377360
CVE-2020-10546rConfig 3.9.4 - SQL Injectionrconfig9.8critical380123
CVE-2020-10547rConfig 3.9.4 - SQL Injectionrconfig9.8critical380123
CVE-2020-10548rConfig 3.9.4 - SQL Injectionrconfig9.8critical380123
CVE-2020-10549rConfig <=3.9.4 - SQL Injectionrconfig9.8critical380123
CVE-2020-10987Tenda AC15 AC1900 version 15.03.05.19 - Command Injectionac15_firmware9.8CRITICAL340014
CVE-2020-11455LimeSurvey 4.1.11 - Local File Inclusionlimesurvey9.8critical347009
CVE-2020-11530WordPress Chop Slider 3 - Blind SQL Injectionchop_slider9.8critical380122
CVE-2020-11546SuperWebmailer 7.21.0.01526 - Remote Code Executionsuperwebmailer9.8critical393655
CVE-2020-11984Apache HTTP Server - Remote Code Executionhttp_server9.8critical390626
CVE-2020-12641Roundcube Webmail - Command Injectionwebmail9.8critical340014
CVE-2020-12720vBulletin SQL Injectionvbulletin9.8critical340155
CVE-2020-13117Wavlink Multiple AP - Remote Command Injectionwn575a49.8critical340014
CVE-2020-13167Netsweeper <=6.4.3 - Python Code Injectionnetsweeper9.8critical340095
CVE-2020-13640wpDiscuz <= 5.3.5 - SQL Injectionwpdiscuz9.8critical340155
CVE-2020-13942Apache Unomi <1.5.2 - Remote Code Executionunomi9.8CRITICAL340095
CVE-2020-14750Oracle WebLogic Server - Remote Command Executionfusion_middleware9.8critical340014
CVE-2020-15415DrayTek Vigor - Command Injectionvigor9.8critical390700
CVE-2020-15568TerraMaster TOS <.1.29 - Remote Code Executiontos9.8critical347009
CVE-2020-15920Mida eFramework <=2.9.0 - Remote Command Executioneframework9.8critical347009
CVE-2020-17456SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Executionslc-1309.8critical340014
CVE-2020-17463Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)fuel cms9.8CRITICAL380122, 390727, 392301, 392648
CVE-2020-17496vBulletin 5.5.4 - 5.6.2- Remote Command Executionvbulletin9.8critical344360
CVE-2020-17506Artica Web Proxy 4.30 - Authentication Bypass/SQL Injectionweb_proxy9.8critical340017
CVE-2020-17530Apache Struts 2.0.0-2.5.25 - Remote Code Executionstruts9.8critical347009
CVE-2020-18662Gnuboard5 5.3.2.8 - SQL Injectiongnuboard9.8CRITICAL380122
CVE-2020-19625Gridx 1.3 - Remote Code Executiongridx9.8CRITICAL341250
CVE-2020-20300WeiPHP 5.0 - SQL Injectionweiphp9.8critical340159
CVE-2020-21224Inspur ClusterEngine 4.0 - Remote Code Executionclusterengine9.8critical344360
CVE-2020-2220874cms - ajax_street.php 'x' SQL Injection74cms9.8critical340016
CVE-2020-2220974cms - ajax_common.php SQL Injection74cms9.8critical341250, 390703
CVE-2020-2221074cms - ajax_officebuilding.php SQL Injection74cms9.8critical340145
CVE-2020-2221174cms - ajax_street.php 'key' SQL Injection74cms9.8critical340016
CVE-2020-24193Daily Tracker System 1.0 - Authentication Bypassdaily tracker system9.8CRITICAL340145
CVE-2020-24391Mongo-Express - Remote Code Executionmongo-express9.8critical380026
CVE-2020-25213WordPress File Manager Plugin - Remote Code Executionfile_manager9.8critical393781
CVE-2020-25223Sophos UTM Preauth - Remote Code Executionunified_threat_management9.8CRITICAL340014
CVE-2020-25494SCO Openserver 5.0.7 - 'outputform' Command Injectionopenserver9.8CRITICAL344364
CVE-2020-25506D-Link DNS-320 - Unauthenticated Remote Code Executiondns-320_firmware9.8critical392301
CVE-2020-26919NETGEAR ProSAFE Plus - Unauthenticated Remote Code Executionjgs516pe_firmware9.8critical392301
CVE-2020-27481Good Layers LMS Plugin <= 2.1.4 - SQL Injectiongood_learning_management_system9.8critical380122
CVE-2020-27615WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via log Parameterloginizer9.8CRITICAL380122
CVE-2020-28188TerraMaster TOS - Unauthenticated Remote Command Executiontos9.8critical340014
CVE-2020-28429geojson2kml - Command Injectiongeojson2kml9.8CRITICAL344361
CVE-2020-29047WP Hotel Booking < 1.10.4 - PHP Object Injectionwp_hotel_booking9.8CRITICAL330889
CVE-2020-29214Alumni Management System 1.0 - SQL Injectionalumni_management_system9.8critical340156
CVE-2020-29227Car Rental Management System 1.0 - Local File Inclusioncar_rental_management_system9.8critical347009
CVE-2020-2927974CMS - Remote File Inclusion74cms9.8critical340128
CVE-2020-29390Zeroshell 3.9.3 - Command Injectionzeroshell9.8critical347009
CVE-2020-35131Cockpit CMS 0.6.1 - Remote Code Executioncockpit9.8CRITICAL340095
CVE-2020-35476OpenTSDB <=2.4.0 - Remote Code Executionopentsdb9.8critical340014
CVE-2020-35545Spotweb 1.4.9 - 'search' SQL Injectionspotweb9.8CRITICAL380122
CVE-2020-35713Belkin Linksys RE6500 <1.0.012.001 - Remote Command Executionre6500_firmware9.8critical392301
CVE-2020-35729Klog Server <=2.41 - Unauthenticated Command Injectionklog_server9.8critical392301
CVE-2020-5307PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injectiondairy_farm_shop_management_system9.8critical340145
CVE-2020-5722Grandstream UCM6200 - SQL Injection-9.8critical340145
CVE-2020-5902F5 BIG-IP TMUI - Remote Code Executionbig-ip_access_policy_manager9.8critical347009, 390709, 392301
CVE-2020-7209LinuxKI Toolset <= 6.01 - Remote Command Executionlinuxki9.8critical347009
CVE-2020-7980Satellian Intellian Aptus Web <= 1.24 - Remote Command Executionaptus_web9.8CRITICAL344360
CVE-2020-8515DrayTek - Remote Code Executionvigor2960_firmware9.8CRITICAL392301
CVE-2020-8656EyesOfNetwork - Hardcoded API Key & SQL Injectioneyesofnetwork9.8critical340016, 380122
CVE-2020-8771WordPress Time Capsule < 1.21.16 - Authentication Bypasswp_time_capsule9.8critical392301
CVE-2020-9054Zyxel NAS Firmware 5.21- Remote Code Executionnas326_firmware9.8critical347009
CVE-2020-9480Apache Spark - Authentication Bypassspark9.8CRITICAL340162
CVE-2021-1472Cisco Small Business RV Series - OS Command Injectionrv160_firmware9.8critical340014
CVE-2021-1498Cisco HyperFlex HX Data Platform - Remote Command Executionhyperflex_hx_data_platform9.8critical340014
CVE-2021-20038SonicWall SMA100 Stack - Buffer Overflow/Remote Code Executionsma_200_firmware9.8critical340193
CVE-2021-20158Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Changetew-827dru_firmware9.8critical392301
CVE-2021-20617Acmailer - Improper Access Control to OS Command Injectionacmailer,acmailer_db9.8critical340014
CVE-2021-21307Lucee Admin - Remote Code Executionlucee_server9.8critical340149
CVE-2021-22005VMware vCenter Server - Arbitrary File Uploadcloud_foundation9.8CRITICAL330791
CVE-2021-22175GitLab CI Lint API - Server-Side Request Forgerygitlab9.8CRITICAL344362
CVE-2021-22502Micro Focus Operations Bridge Reporter - Remote Code Executionoperation_bridge_reporter9.8CRITICAL344364
CVE-2021-24212WooCommerce Help Scout - Arbitrary File Uploadhelp_scout9.8critical382238
CVE-2021-24215Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalationcontrolled_admin_access9.8CRITICAL377360
CVE-2021-24284WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Uploadkaswara9.8critical382238
CVE-2021-24285WordPress Car Seller - Auto Classifieds Script - SQL Injectioncars-seller-auto-classifieds-script9.8critical340016
CVE-2021-24442Wordpress Polls Widget < 1.5.3 - SQL Injectionpoll,_survey,_questionnaire_and_voting_system9.8critical380122
CVE-2021-24472Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgerykentharadio9.8critical340162
CVE-2021-24499WordPress Workreap - Remote Code Executionworkreap9.8critical382238
CVE-2021-24527Profile Builder < 3.4.9 - Improper Authenticationprofile-builder9.8critical340130
CVE-2021-24666WordPress Podlove Podcast Publisher <3.5.6 - SQL Injectionpodlove_podcast_publisher9.8critical340016
CVE-2021-24731Pie Register < 3.7.1.6 - SQL Injectionpie_register9.8critical380122
CVE-2021-24762WordPress Perfect Survey <1.5.2 - SQL Injectionperfect_survey9.8critical380122
CVE-2021-24827WordPress Asgaros Forum <1.15.13 - SQL Injectionasgaros_forum9.8critical380122
CVE-2021-24849WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injectionfrontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible9.8CRITICAL380122
CVE-2021-24915Contest Gallery < 13.1.0.6 - SQL injectioncontest_gallery9.8critical340017
CVE-2021-24931WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injectionsecure_copy_content_protection_and_content_locking9.8critical380122
CVE-2021-24943Registrations for the Events Calendar < 2.7.6 - SQL Injectionregistrations_for_the_events_calendar9.8critical380122
CVE-2021-24946WordPress Modern Events Calendar <6.1.5 - Blind SQL Injectionmodern_events_calendar_lite9.8critical380122
CVE-2021-25003WordPress WPCargo Track & Trace <6.9.0 - Remote Code Executionwpcargo_track_&amp;_trace9.8critical331324
CVE-2021-25114WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injectionpaid_memberships_pro9.8critical380122
CVE-2021-25281SaltStack Salt <3002.5 - Auth Bypasssalt9.8CRITICAL340007
CVE-2021-27132Sercomm VD625 Smart Modems - CRLF Injectionagcombo_vd625_firmware9.8critical330708
CVE-2021-27314Doctor Appointment System 1.0 - SQL Injectiondoctor_appointment_system9.8critical380122
CVE-2021-28799QNAP HBS 3 - Broken Access Controlhybrid_backup_sync9.8CRITICAL344360
CVE-2021-30118Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Executionvsa9.8critical392301
CVE-2021-3018IPeakCMS 3.5 - SQL Injectionipeakcms9.8CRITICAL380122
CVE-2021-3110PrestaShop 1.7.7.0 - SQL Injectionprestashop9.8critical380122
CVE-2021-3129Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Executionignition9.8CRITICAL340007, 340162, 344365
CVE-2021-31316CentOS Web Panel - SQL Injectionwebpanel9.8CRITICAL340016
CVE-2021-31324CentOS Web Panel - OS Command Injectionwebpanel9.8CRITICAL340016
CVE-2021-31755Tenda Router AC11 - Remote Command Injectionac11_firmware9.8critical340014
CVE-2021-31805Apache Struts2 S2-062 - Remote Code Executionstruts9.8critical330791
CVE-2021-31856Layer5 Meshery 0.5.2 - SQL Injectionmeshery9.8critical341245, 344366
CVE-2021-32305Websvn <2.6.1 - Remote Code Executionwebsvn9.8critical340014
CVE-2021-3239E-Learning System 1.0 - SQL Injectione-learning system9.8CRITICAL340016
CVE-2021-3278Local Service Search Engine Management System 1.0 - SQLi Authentication Bypasslocal services search engine management system9.8CRITICAL340156
CVE-2021-33357RaspAP <=2.6.5 - Remote Command Injectionraspap9.8critical344363
CVE-2021-34187Chamilo model.ajax.php - SQL Injectionchamilo9.8critical340016
CVE-2021-34621WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weaknessprofilepress9.8CRITICAL377360
CVE-2021-34624WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Uploadprofilepress9.8critical382238
CVE-2021-35395RealTek Jungle SDK - Arbitrary Command Injectionrealtek_jungle_sdk9.8critical340014
CVE-2021-36260Hikvision IP camera/NVR - Remote Command Executionds-2cd2026g2-iu/sl_firmware9.8critical393655
CVE-2021-36380Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injectionsureline9.8critical392301
CVE-2021-37291KevinLAB BEMS 1.0 - SQL Injection4st_l-bems9.8critical340156
CVE-2021-37538PrestaShop SmartBlog <4.0.6 - SQL Injectionsmartblog9.8critical340016
CVE-2021-40617openSIS Community Edition 8.0 - SQL Injectionopensis9.8CRITICAL390727, 392301, 392648
CVE-2021-40870Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Executioncontroller9.8critical340007
CVE-2021-40960Galera WebTemplate 1.0 Directory Traversalgalera_webtemplate9.8critical347009
CVE-2021-41649PuneethReddyHC Online Shopping System homeaction.php SQL Injectiononline-shopping-system-advanced9.8critical392301
CVE-2021-41749CraftCMS SEOmatic - Server-Side Template Injectionseomatic9.8critical390719
CVE-2021-42013Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Executionhttp_server9.8critical347009
CVE-2021-42237Sitecore Experience Platform Pre-Auth RCEexperience_platform9.8critical344362
CVE-2021-42325Froxlor 0.10.29.1 - SQL Injection (Authenticated)froxlor9.8CRITICAL350147, 390724
CVE-2021-42667Online Event Booking and Reservation System 2.3.0 - SQL Injectiononline_event_booking_and_reservation_system9.8critical340016
CVE-2021-43140Simple Subscription Website 1.0 - SQLi Authentication Bypasssimple subscription website9.8CRITICAL340145
CVE-2021-43421Studio-42 elFinder <2.1.60 - Arbitrary File Uploadelfinder9.8critical393781
CVE-2021-43510Sourcecodester Simple Client Management System 1.0 - SQL Injectionsimple_client_management_system9.8critical340145
CVE-2021-4449ZoomSounds Plugin - Unauthenticated Arbitrary File Uploadzoomsounds9.8CRITICAL392301
CVE-2021-44567RosarioSIS 7.6 - SQL Injectionrosariosis9.8CRITICAL392301
CVE-2021-45382D-Link - Remote Command Executiondir-820l_firmware9.8critical392301
CVE-2021-45428Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Uploadtlr-2005ksh9.8CRITICAL392301
CVE-2021-45467Control Web Panel (CWP) - File Inclusionwebpanel9.8CRITICAL390614
CVE-2022-0169Photo Gallery by 10Web < 1.6.0 - SQL Injectionphoto_gallery9.8critical340016
CVE-2022-0332Moodle 3.11.4 - SQL Injectionmoodle9.8CRITICAL390727, 392301, 392648
CVE-2022-0349WordPress NotificationX <2.3.9 - SQL Injectionnotificationx9.8critical380122
CVE-2022-0412WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injectionti_woocommerce_wishlist9.8critical380122
CVE-2022-0434WordPress Page Views Count <2.4.15 - SQL Injectionpage_view_count9.8critical340016
CVE-2022-0479Popup Builder Plugin - SQL Injection and Cross-Site Scriptingpopup_builder9.8CRITICAL340016, 377360
CVE-2022-0592MapSVG < 6.2.20 - Unauthenticated SQLimapsvg9.8critical380122
CVE-2022-0658CommonsBooking < 2.6.8 - SQL Injectioncommonsbooking9.8critical380122
CVE-2022-0679WordPress Narnoo Distributor <=2.5.1 - Local File Inclusionnarnoo_distributor9.8critical344360
CVE-2022-0693WordPress Master Elements <=8.0 - SQL Injectionmaster_elements9.8critical380122
CVE-2022-0747Infographic Maker iList < 4.3.8 - SQL Injectioninfographic_maker9.8critical380122
CVE-2022-0760WordPress Simple Link Directory <7.7.2 - SQL injectionsimple_link_directory9.8critical380122
CVE-2022-0769Users Ultra <= 3.1.0 - SQL Injectionusers_ultra9.8critical380122
CVE-2022-0773Documentor <= 1.5.3 - Unauthenticated SQL Injectiondocumentor9.8critical380122
CVE-2022-0781WordPress Nirweb Support <2.8.2 - SQL Injectionnirweb_support9.8critical340016
CVE-2022-0784WordPress Title Experiments Free <9.0.1 - SQL Injectiontitle_experiments_free9.8critical380122
CVE-2022-0785WordPress Daily Prayer Time <2022.03.01 - SQL Injectiondaily_prayer_time9.8critical380122
CVE-2022-0786WordPress KiviCare <2.3.9 - SQL Injectionkivicare9.8critical380122
CVE-2022-0787Limit Login Attempts (Spam Protection) < 5.1 - SQL Injectionlimit_login_attempts9.8critical380122
CVE-2022-0788WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injectionwp_fundraising_donation_and_crowdfunding_platform9.8CRITICAL390727
CVE-2022-0814Ubigeo de Peru < 3.6.4 - SQL Injectionubigeo_de_peru_para_woocommerce9.8critical340016
CVE-2022-0817WordPress BadgeOS <=3.7.0 - SQL Injectionbadgeos9.8critical340016
CVE-2022-0826WordPress WP Video Gallery <=1.7.1 - SQL Injectionwp-video-gallery-free9.8critical380122
CVE-2022-0827WordPress Best Books <=2.6.3 - SQL Injectionbestbooks9.8critical380122
CVE-2022-0846SpeakOut Email Petitions < 2.14.15.1 - SQL Injectionspeakout!_email_petitions9.8critical380122
CVE-2022-0867WordPress ARPrice <3.6.1 - SQL Injectionpricing_table9.8critical380122
CVE-2022-0948WordPress Order Listener for WooCommerce <3.2.2 - SQL Injectionorder_listener_for_woocommerce9.8CRITICAL380122
CVE-2022-0949WordPress Stop Bad Bots <6.930 - SQL Injectionblock_and_stop_bad_bots9.8critical380122
CVE-2022-1013WordPress Personal Dictionary <1.3.4 - Blind SQL Injectionpersonal_dictionary9.8critical380122
CVE-2022-1057WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injectionpricing_deals_for_woocommerce9.8critical380122
CVE-2022-1388F5 BIG-IP iControl - REST Auth Bypass RCEbig-ip_access_policy_manager9.8critical392767
CVE-2022-1390WordPress Admin Word Count Column 2.2 - Local File Inclusionadmin_word_count_column9.8critical347009
CVE-2022-1391WordPress Cab fare calculator < 1.0.4 - Local File Inclusioncab_fare_calculator9.8critical347009
CVE-2022-1453RSVPMaker <= 9.2.5 - SQL Injection-9.8critical380122
CVE-2022-1574WordPress HTML2WP <=1.0.0 - Arbitrary File Uploadhtml2wp9.8critical382238
CVE-2022-1609The School Management < 9.9.7 - Remote Code Executionschool_management9.8critical340095
CVE-2022-1950Youzify < 1.2.0 - Unauthenticated SQLiyouzify9.8critical380122
CVE-2022-22897PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injectionap_pagebuilder9.8critical340156, 341145, 380122
CVE-2022-22954VMware Workspace ONE Access - Server-Side Template Injectionidentity_manager9.8critical344360
CVE-2022-23898MCMS 5.2.5 - SQL Injectionmcms9.8critical340159
CVE-2022-24112Apache APISIX - Remote Code Executionapisix9.8CRITICAL344364
CVE-2022-24223Atom CMS v2.0 - SQL Injectionatomcms9.8CRITICAL380122
CVE-2022-24260VoipMonitor - Pre-Auth SQL Injectionvoipmonitor9.8critical340016
CVE-2022-24627AudioCodes Device Manager Express - SQL Injectiondevice_manager_express9.8CRITICAL340145
CVE-2022-2467Garage Management System 1.0 - SQL Injectiongarage_management_system9.8critical380122
CVE-2022-24816GeoServer <1.2.2 - Remote Code Executionjai-ext9.8critical344360
CVE-2022-2486Wavlink WN535K2/WN535K3 - OS Command Injectionwl-wn535k29.8critical340014
CVE-2022-2488Wavlink WN535K2/WN535K3 - OS Command Injectionwl-wn535k2_firmware9.8critical340014
CVE-2022-25082TOTOLink - Unauthenticated Command Injectiona950rg_firmware9.8critical344361
CVE-2022-25125MCMS 5.2.4 - SQL Injectionmcms9.8critical340159
CVE-2022-25488Atom CMS v2.0 - SQL Injectionatomcms9.8critical340016
CVE-2022-26134Confluence - Remote Code Executionconfluence_data_center9.8critical337211, 340087
CVE-2022-26585Mingsoft MCMS v5.2.7 - SQL Injectionmcms9.8critical340156
CVE-2022-27927Microfinance Management System 1.0 - 'customer_number' SQLimicrofinance management system9.8CRITICAL340016
CVE-2022-27984Cuppa CMS v1.0 - SQL injectioncuppacms9.8critical380122
CVE-2022-27985Cuppa CMS v1.0 - SQL injectioncuppacms9.8critical340017
CVE-2022-28032Atom CMS v2.0 - SQL Injectionatomcms9.8critical380122
CVE-2022-28033Atom.CMS 2.0 - SQL Injectionatomcms9.8CRITICAL380122
CVE-2022-28219Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Executionmanageengine_adaudit_plus9.8CRITICAL344370
CVE-2022-2840Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLizephyr project manager9.8CRITICAL380122
CVE-2022-29006Directory Management System 1.0 - SQL Injectiondirectory_management_system9.8critical340145
CVE-2022-29007Dairy Farm Shop Management System 1.0 - SQL Injectiondairy_farm_shop_management_system9.8critical340145
CVE-2022-29013Razer Sila Gaming Router - Remote Code Executionsila9.8critical392301
CVE-2022-29078Node.js Embedded JavaScript 3.1.6 - Template Injectionejs9.8critical340014
CVE-2022-29303SolarView Compact 6.00 - OS Command Injectionsv-cpt-mc310_firmware9.8CRITICAL344360
CVE-2022-29383NETGEAR ProSafe SSL VPN firmware - SQL Injectionssl312_firmware9.8critical340156
CVE-2022-30525Zyxel Firewall - OS Command Injectionusg_flex_100w_firmware9.8CRITICAL344363
CVE-2022-31137Roxy-WI < 6.1.1.0 - Remote Code Executionroxy-wi9.8critical344360
CVE-2022-31499Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injectionemerge_e3_firmware9.8critical344364
CVE-2022-31976Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system9.8critical380122
CVE-2022-31977Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system9.8critical380122
CVE-2022-31978Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system9.8critical380122
CVE-2022-32094Hospital Management System 1.0 - SQL Injectionhospital_management_system9.8critical340145
CVE-2022-3236Sophos Firewall <= 19.0 MR1 - Remote Code Executionfirewall9.8critical344361
CVE-2022-32409Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusioni3geo9.8critical347009
CVE-2022-33965WordPress Visitor Statistics <=5.7 - SQL Injectionwp_visitor_statistics9.8critical380122
CVE-2022-34045WAVLINK WN530HG4 - Improper Access Controlwl-wn530hg4_firmware9.8critical390716
CVE-2022-34128GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)positions9.8CRITICAL392301
CVE-2022-3481NotificationX Dropshipping < 4.4 - SQL Injectionwoocommerce dropshipping9.8CRITICAL380122
CVE-2022-35405Zoho ManageEngine - Remote Code Executionmanageengine_access_manager_plus9.8critical392301
CVE-2022-35914GLPI <=10.0.2 - Remote Command Executionglpi9.8critical344360
CVE-2022-36446Webmin <1.997 - Authenticated Remote Code Executionwebmin9.8critical392301
CVE-2022-36553Hytec Inter HWL-2511-SS - Remote Command Executionhwl-2511-ss_firmware9.8critical347009
CVE-2022-36642Omnia MPX 1.5.0+r1 - Local File Inclusionomnia_mpx_node_firmware9.8critical340007, 347009
CVE-2022-37042Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Executioncollaboration9.8critical390626
CVE-2022-38580X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)skipper9.8CRITICAL390727, 392301, 392648
CVE-2022-38627Nortek Linear eMerge E3-Series - SQL Injectionemerge_e3_firmware9.8critical340016
CVE-2022-38637Hospital Management System 1.0 - SQL Injectionhospital_management_system9.8critical340145
CVE-2022-40032Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)simple task managing system9.8CRITICAL340016, 380122
CVE-2022-40347Intern Record System v1.0 - SQL Injection (Unauthenticated)intern record system9.8CRITICAL340016
CVE-2022-4050WordPress JoomSport <5.2.8 - SQL Injectionjoomsport9.8critical380122
CVE-2022-4059Cryptocurrency Widgets Pack < 2.0 - SQL Injectioncryptocurrency_widgets_pack9.8critical380122
CVE-2022-4060WordPress User Post Gallery <=2.19 - Remote Code Executionuser_post_gallery9.8critical347009
CVE-2022-40881SolarView 6.00 - Remote Command Executionsolarview_compact9.8critical344360
CVE-2022-4117WordPress IWS Geo Form Fields <=1.0 - SQL Injectioniws-geo-form-fields9.8critical380122
CVE-2022-41840Welcart eCommerce <=2.7.7 - Local File Inclusionwelcart_e-commerce9.8critical347009
CVE-2022-4328WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Uploadwoocommerce_checkout_field_manager9.8critical382238
CVE-2022-44290WebTareas 2.4p5 - SQL Injectionwebtareas9.8critical380122
CVE-2022-44291WebTareas 2.4p5 - SQL Injectionwebtareas9.8critical380122
CVE-2022-4447WordPress Fontsy <=1.8.6 - SQL Injectionfontsy9.8critical340016
CVE-2022-44588Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection-9.8critical380122
CVE-2022-44877Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)webpanel9.8CRITICAL393655
CVE-2022-45699APsystems ECU-R Firmware - Command Injectionecu-r_firmware9.8CRITICAL344364
CVE-2022-45805WordPress Paytm Payment Gateway <=2.7.3 - SQL Injectionpayment_gateway9.8critical380122
CVE-2022-46071Helmet Store Showroom v1.0 - SQL Injectionhelmet_store_showroom_site9.8critical340145
CVE-2022-47615LearnPress Plugin < 4.2.0 - Local File Inclusionlearnpress9.8critical347009
CVE-2022-47945Thinkphp Lang - Local File Inclusionthinkphp9.8critical340007
CVE-2022-47986IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Executionlinux_kernel9.8CRITICAL344364
CVE-2022-48323Sunflower Simple and Personal 1.0.1.43315 - Remote Code Executionsunflower9.8critical392301
CVE-2023-0037WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injectionmap_builder_for_google_maps9.8critical380122
CVE-2023-0297PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)pyload9.8critical340095
CVE-2023-0562Bank Locker Management System v1.0 - SQL Injectionbank_locker_management_system9.8critical340156
CVE-2023-0600WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injectionwp_visitor_statistics9.8CRITICAL380122
CVE-2023-0938Music Gallery Site v1.0 - SQL Injection on music_list.phpmusic gallery site9.8CRITICAL390727, 392301, 392648
CVE-2023-1020Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injectionwp_live_chat_shoutbox9.8critical340016
CVE-2023-1389TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injectionarcher-ax219.8critical393655
CVE-2023-1454Jeecg-boot 3.5.0 qurestSql - SQL Injectionjeecg-boot9.8CRITICAL340159
CVE-2023-1719Bitrix Component - Cross-Site Scriptingbitrix249.8critical347198
CVE-2023-1730SupportCandy < 3.1.5 - Unauthenticated SQL Injectionsupportcandy9.8critical380122
CVE-2023-2130Purchase Order Management v1.0 - SQL Injectionpurchase_order_management_system9.8critical380122
CVE-2023-22463KubePi JwtSigKey - Admin Authentication Bypasskubepi9.8critical392301
CVE-2023-22527Atlassian Confluence - Remote Code Executionconfluence_data_center9.8critical340095
CVE-2023-23333SolarView Compact 6.00 - OS Command Injectionsolarview_compact_firmware9.8critical390614
CVE-2023-23488WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injectionpaid_memberships_pro9.8critical380122
CVE-2023-23489WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injectioneasy_digital_downloads9.8critical380122
CVE-2023-24000WordPress GamiPress <= 2.5.7 - SQL InjectionGamiPress gamipress9.8critical380122
CVE-2023-2479Appium Desktop Server - Remote Code Executionappium-desktop9.8critical342259
CVE-2023-25135vBulletin <= 5.6.9 - Pre-authentication Remote Code Executionvbulletin9.8critical390614
CVE-2023-25280D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injectiondir820la1_firmware9.8CRITICAL340014
CVE-2023-25717Ruckus Wireless Admin - Remote Code Executionruckus_wireless_admin9.8critical393655
CVE-2023-26802DCBI-Netlog-LAB v1.0 - Command Injectiondcbi-netlog-lab_firmware9.8critical344361
CVE-2023-27034Jms Blog - SQL Injectionjms_blog9.8CRITICAL380122
CVE-2023-27350PaperCut - Unauthenticated Remote Code Executionpapercut_mf9.8CRITICAL390727
CVE-2023-27637PrestaShop tshirtecommerce Module - SQL Injectioncustom_product_designer9.8critical380122
CVE-2023-27638tshirtecommerce PrestaShop Module - SQL Injectionprestashop9.8CRITICAL380122
CVE-2023-27847PrestaShop xipblog - SQL Injectionxipblog9.8CRITICAL340016, 340156, 341145, 380122
CVE-2023-28343Altenergy Power Control Software C1.2.5 - Remote Command Injectionenergy_communication_unit_firmware9.8critical344364
CVE-2023-29300Adobe ColdFusion - Pre-Auth Remote Code Executioncoldfusion9.8critical350147
CVE-2023-29827Embedded JavaScript(EJS) 3.1.6 - Template Injectionejs9.8critical340014
CVE-2023-30013TOTOLink - Unauthenticated Command Injectionx5000r_firmware9.8critical392301
CVE-2023-30150PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injectionleocustomajax9.8CRITICAL380122
CVE-2023-30192PrestaShop 'possearchproducts' <= 1.7 - SQL Injectionpossearchproducts9.8CRITICAL380122
CVE-2023-30194Prestashop posstaticfooter <= 1.0.0 - SQL Injectionpoststaticfooter9.8CRITICAL341245
CVE-2023-30258MagnusBilling - Remote Code Executionmagnusbilling9.8critical344363, 344364
CVE-2023-3077MStore API < 3.9.8 - SQL Injectionmstore_api9.8CRITICAL380122
CVE-2023-30869Easy Digital Downloads - Privilege Escalationeasy_digital_downloads9.8CRITICAL377360
CVE-2023-31465TimeKeeper by FSMLabs - Remote Code Executiontimekeeper9.8critical393655
CVE-2023-3197WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injectionmstore api9.8CRITICAL380122
CVE-2023-32563Ivanti Avalanche - Remote Code Executionavalanche9.8critical340007
CVE-2023-33338Old Age Home Management System v1.0 - SQL Injectionold_age_home_management_system9.8critical340145
CVE-2023-33362Piwigo 13.6.0 - SQL Injectionpiwigo9.8CRITICAL390727, 392301, 392648
CVE-2023-3368Chamilo LMS <= v1.11.20 Unauthenticated Command Injectionchamilo9.8critical393655
CVE-2023-3380WAVLINK WN579X3 - Remote Command Executionwn579x3_firmware9.8CRITICAL340014
CVE-2023-33831FUXA - Unauthenticated Remote Code Executionfuxa9.8CRITICAL345240
CVE-2023-34048VMware vCenter Server - Out-of-Bounds Writevcenter_server9.8critical392301
CVE-2023-34124SonicWall GMS and Analytics Web Services - Shell Injectionanalytics9.8critical380123
CVE-2023-34362MOVEit Transfer - Remote Code Executionmoveit_cloud9.8critical340016
CVE-2023-3452WordPress Canto Plugin <= 3.0.4 - File Inclusioncanto9.8CRITICAL340077
CVE-2023-34659JeecgBoot 3.5.0 - SQL Injectionjeecg_boot9.8CRITICAL330791
CVE-2023-34751bloofoxCMS v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34752bloofoxCMS v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34753bloofoxCMS v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34754Bloofox v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34755bloofoxCMS v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34756Bloofox v0.5.2.1 - SQL Injectionbloofoxcms9.8critical380122
CVE-2023-34960Chamilo Command Injectionchamilo9.8critical344360
CVE-2023-34990FortiWLM - Directory Traversalfortiwlm9.8CRITICAL340007
CVE-2023-34993Fortinet FortiWLM Unauthenticated Command Injection Vulnerabilityfortiwlm9.8critical344363
CVE-2023-3643CAREL Boss Mini <= 1.4.0 - Local File Inclusionboss-mini9.8critical344360
CVE-2023-36845Juniper J-Web - Remote Code Executionjunos9.8critical344360
CVE-2023-3710Honeywell PM43 Printers - Command Injectionpm43_firmware9.8critical344361
CVE-2023-37629Online Piggery Management System v1.0 - Unauthenticated File Uploadsimple_online_piggery_management_system9.8critical330791
CVE-2023-37679NextGen Mirth Connect - Remote Code Executionmirth_connect9.8critical344363
CVE-2023-38203Adobe ColdFusion - Deserialization of Untrusted Datacoldfusion9.8critical350147
CVE-2023-39143PaperCut < 22.1.3 - Path Traversalpapercut_mf9.8critical347019
CVE-2023-39361Cacti 1.2.24 - SQL Injectioncacti9.8critical380122
CVE-2023-39650PrestaShop Theme Volty CMS Blog - SQL Injectiontheme volty cms blog9.8CRITICAL340156, 341145, 380122
CVE-2023-39796WBCE 1.6.0 - SQL Injectionwbce_cms9.8CRITICAL380122
CVE-2023-40504LG Simple Editor <= v3.21.0 - Command Injectionsimple_editor9.8CRITICAL340007
CVE-2023-40748PHPJabbers Food Delivery Script - SQL Injectionfood_delivery_script9.8critical340156
CVE-2023-40749PHPJabbers Food Delivery Script v3.0 - SQL Injectionfood_delivery_script9.8critical340017
CVE-2023-41109SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injectionsmartnode_sn2009.8critical392301
CVE-2023-41892CraftCMS < 4.4.15 - Unauthenticated Remote Code Executioncraft_cms9.8critical344365
CVE-2023-43208NextGen Healthcare Mirth Connect - Remote Code Executionmirth_connect9.8critical344363
CVE-2023-43373Hoteldruid v3.0.5 - SQL Injectionhoteldruid9.8CRITICAL380122
CVE-2023-43374Hoteldruid v3.0.5 - SQL Injectionhoteldruid9.8CRITICAL380122
CVE-2023-44353Adobe ColdFusion WDDX Deserialization Gadgetscoldfusion9.8critical350147
CVE-2023-45852Viessmann Vitogate 300 - Remote Code Executionvitogate_300_firmware9.8CRITICAL344360
CVE-2023-46347PrestaShop Step by Step products Pack - SQL Injectionndk_steppingpack9.8critical340016, 341245
CVE-2023-46359cPH2 Charging Station v1.87.0 - OS Command Injectioncph2_echarge9.8critical393655
CVE-2023-46574TOTOLINK A3700R - Command Injectiona3700r_firmware9.8critical392301
CVE-2023-46747F5 BIG-IP - Unauthenticated RCE via AJP Smugglingbig-ip_access_policy_manager9.8critical390626, 392767
CVE-2023-47246SysAid Server - Remote Code Executionsysaid_on-premises9.8critical390626
CVE-2023-48022Anyscale Ray - Remote Code Executionray9.8critical392301
CVE-2023-48084Nagios XI < 5.11.3 - SQL Injectionnagios_xi9.8critical340130, 380122
CVE-2023-4974Academy LMS 6.2 - SQL Injectionacademy_lms9.8critical380122
CVE-2023-50839JS Help Desk <= 2.8.1 - SQL InjectionJS Help Desk – Best Help Desk & Support Plugin9.8critical380122
CVE-2023-50917MajorDoMo thumb.php - OS Command Injectionmajordomo9.8critical344363
CVE-2023-5203WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection-9.8critical380122
CVE-2023-5204WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection-9.8critical380122
CVE-2023-5652WP Hotel Booking <= 2.0.7 - SQL Injectionwp hotel booking9.8CRITICAL380122
CVE-2023-5991Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletionhotel_booking_lite9.8critical347009
CVE-2023-6360WordPress My Calendar <3.4.22 - SQL Injectionmy_calendar9.8CRITICAL380122
CVE-2023-6623Essential Blocks < 4.4.3 - Local File Inclusionessential_blocks9.8critical347009
CVE-2023-6655Hongjing e-HR 2020 - SQL Injectione-hr9.8CRITICAL341245
CVE-2023-6750WordPress WP Clone <= 2.4.2 - Database Backup Exposureclone9.8critical350590
CVE-2023-6989Shield Security WP Plugin <= 18.5.9 - Local File Inclusionshield_security9.8critical340748
CVE-2023-7116WeiYe-Jing datax-web <= 2.1.2 - OS Command Injectiondatax-web9.8CRITICAL340014
CVE-2024-0195SpiderFlow Crawler Platform - Remote Code Executionspider-flow9.8CRITICAL340095
CVE-2024-10571Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusionchartify9.8critical347006
CVE-2024-1061WordPress HTML5 Video Player - SQL Injectionhtml5_video_player9.8critical380122
CVE-2024-10763WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion-9.8critical340077
CVE-2024-10914D-Link NAS - Command Injection via Name Parameterdns-320_firmware9.8critical344363
CVE-2024-10915D-Link NAS - Command Injection via Group Parameterdns-320_firmware9.8critical344363
CVE-2024-12209WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusionwp-umbrella9.8CRITICAL347009
CVE-2024-12987DrayTek Vigor - Command InjectionVigor300B9.8critical347009, 393655
CVE-2024-1512MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injectionmasterstudy_lms9.8critical380122
CVE-2024-1698NotificationX <= 2.8.2 - SQL Injectionnotificationx9.8CRITICAL380122
CVE-2024-22729Netis MW5360 V1.0.1.3031 - Command Injectionmw5360_firmware9.8CRITICAL392301
CVE-2024-23692Rejetto HTTP File Server - Template injection-9.8critical390703
CVE-2024-24112Exrick XMall - SQL Injectionxmall9.8critical340016
CVE-2024-24328TotoLink Router setMacFilterRules - Command Injectiona3300r_firmware9.8critical392301
CVE-2024-24329TotoLink Router setPortForwardRules - Command Injectiona3300r_firmware9.8critical392301
CVE-2024-24495Daily Habit Tracker 1.0 - SQL Injectiondaily habit tracker9.8CRITICAL390727, 392301, 392648
CVE-2024-2667InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Uploadinstawp_connect9.8critical340162
CVE-2024-27954WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRFWP Automatic Automatic9.8critical347009
CVE-2024-30163IPS Community Suite - Unauthenticated SQL Injectionips_community_suite9.8critical380026
CVE-2024-31848CData API Server < 23.4.8844 - Path Traversal-9.8CRITICAL344365
CVE-2024-31849CData Connect < 23.4.8846 - Path Traversal-9.8CRITICAL344365
CVE-2024-3552Web Directory Free < 1.7.0 - SQL Injectionweb_directory_free9.8CRITICAL380122
CVE-2024-3605WP Hotel Booking <= 2.1.0 - SQL Injectionwp hotel booking9.8CRITICAL380122
CVE-2024-36412SuiteCRM - SQL Injectionsuitecrm9.8critical380122
CVE-2024-37393SecurEnvoy Two Factor Authentication - LDAP Injection-9.8critical392301
CVE-2024-37843Craft CMS <=v3.7.31 - SQL Injectioncraft_cms9.8CRITICAL344378
CVE-2024-38773FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injectionformlift for infusionsoft web forms9.8CRITICAL380122
CVE-2024-3922Dokan Pro <= 3.10.3 - SQL Injectiondokan9.8CRITICAL392301
CVE-2024-399071Panel SQL Injection - Authenticated1panel9.8CRITICAL380026
CVE-2024-39914FOG Project < 1.5.10.34 - Remote Command Executionfogproject9.8critical344363
CVE-2024-43360ZoneMinder - SQL Injectionzoneminder9.8critical380122
CVE-2024-44000LiteSpeed Cache <= 6.4.1 - Sensitive Information ExposureliteSpeed-cache9.8CRITICAL390716
CVE-2024-4443Business Directory Plugin <= 6.4.2 - SQL Injectionbusiness_directory9.8critical340156
CVE-2024-45507Apache OFBiz - Remote Code Executionofbiz9.8critical340162
CVE-2024-45622ASIS - SQL Injection Authentication Bypassasis9.8CRITICAL340145
CVE-2024-4577PHP CGI - Argument Injectionphp9.8critical392301
CVE-2024-4620ArForms < 6.6 - Remote Code Executionarforms9.8CRITICAL382238
CVE-2024-48307JeecgBoot v3.7.1 - SQL Injectionjeecg_boot9.8CRITICAL340159
CVE-2024-50498WP Query Console <= 1.0 - Remote Code Executionwp_query_console9.8CRITICAL340095
CVE-2024-5057WordPress Easy Digital Downloads <= 3.2.12 - SQL Injectioneasy_digital_downloads9.8CRITICAL380122
CVE-2024-51211openSIS Classic v9.1 - SQL Injection-9.8critical380122
CVE-2024-51978Brother Printers – Authentication Bypass via Default Admin Password-9.8critical390709
CVE-2024-53584OpenPanel 0.3.4 - OS Command Injectionopenpanel9.8CRITICAL344360
CVE-2024-5522WordPress HTML5 Video Player < 2.5.27 - SQL Injectionhtml5_video_player9.8critical340016
CVE-2024-5765WpStickyBar <= 2.1.0 - SQL Injectionwpstickybar9.8CRITICAL380122
CVE-2024-5827Vanna - SQL injection-9.8CRITICAL344360
CVE-2024-6159Push Notification for Post and BuddyPress <= 1.93 - SQL Injectionpush notification for post and buddypress9.8CRITICAL380122
CVE-2024-6205PayPlus Payment Gateway < 6.6.9 - SQL Injectionpayplus-payment-gateway9.8critical380122
CVE-2024-6460WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusiontradedoubler-affiliate-tracker9.8CRITICAL344360
CVE-2024-6670WhatsUp Gold HasErrors SQL Injection - Authentication Bypasswhatsup_gold9.8CRITICAL340016
CVE-2024-6671WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypasswhatsup_gold9.8CRITICAL340016
CVE-2024-6924TrueBooker <= 1.0.2 - SQL Injectiontruebooker9.8CRITICAL380122
CVE-2024-6926Viral Signup <= 2.1 - SQL Injectionviral-signup9.8CRITICAL380122
CVE-2024-6928Opti Marketing <= 2.0.9 - SQL Injectionopti-marketing9.8CRITICAL380122
CVE-2024-7332TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerabilitycp450_firmware9.8critical390716
CVE-2024-7593Ivanti vTM - Authentication Bypassvirtual traffic manager9.8critical392301
CVE-2024-7854Woo Inquiry <= 0.1 - SQL Injectionwoo_inquiry9.8CRITICAL380122
CVE-2024-7954SPIP Porte Plume Plugin - Remote Code Executionspip9.8critical340023
CVE-2024-8877Riello Netman 204 - SQL Injectionnetman_204_firmware9.8critical340156
CVE-2024-8911LatePoint <= 5.0.11 - SQL Injectionlatepoint9.8CRITICAL380122
CVE-2024-9047WordPress File Upload <= 4.24.11 - Arbitrary File Readwordpress-file-upload9.8critical344360
CVE-2024-9193WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update-9.8critical340087, 347006
CVE-2024-9234GutenKit <= 2.1.0 - Arbitrary File Uploadgutenkit9.8CRITICAL340162
CVE-2025-1023ChurchCRM - SQL Injectionchurchcrm9.8critical380122
CVE-2025-11833Post SMTP <= 3.6.0 - Email Log Disclosurepost_smtp_mailer9.8CRITICAL377360
CVE-2025-13486Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution-9.8CRITICAL377360
CVE-2025-1562Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Controlfunnelkit automations9.8CRITICAL377360
CVE-2025-1661HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion-9.8critical340748
CVE-2025-2294Kubio AI Page Builder <= 2.5.1 - Local File Inclusion-9.8critical347009
CVE-2025-24813Apache Tomcat Path Equivalence - Remote Code Executiontomcat9.8critical392301
CVE-2025-24893XWiki Platform - Remote Code Executionxwiki9.8critical347009
CVE-2025-25257Fortinet FortiWeb - SQL Injectionfortiweb9.8critical340156
CVE-2025-2636InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion-9.8high340007
CVE-2025-29085Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Componentvipshop Saturn v.3.5.1 and before9.8critical340159
CVE-2025-29306FoxCMS v.1.2.5 - Remote Code Execution-9.8critical347009, 393655
CVE-2025-3248Langflow AI - Unauthenticated Remote Code Executionlangflow9.8CRITICAL344360
CVE-2025-32814NetMRI Unauthenticated SQL Injection via skipjackUsernamenetmri9.8critical340016
CVE-2025-32969XWiki REST API Query - SQL Injectionxwiki9.8critical380122
CVE-2025-34085WordPress Simple File List <=4.2.2 - Remote Code Execution-9.8critical382238
CVE-2025-40552SolarWinds Web Help Desk - Authentication Bypassweb_help_desk9.8CRITICAL392301
CVE-2025-4524WordPress Madara - Local File Inclusion-9.8CRITICAL344360
CVE-2025-45985Blink Router - Command Injection-9.8critical344363
CVE-2025-47812Wing FTP Server <= 7.4.3 - Remote Code Executionwftpserver9.8critical390614
CVE-2025-48157WordPress Formality Plugin <= 1.5.9 - Local File Inclusion-9.8critical347009
CVE-2025-52472XWiki - HQL Injectionxwiki9.8high340159
CVE-2025-53770Microsoft SharePoint Server - Remote Code Execution (ToolShell)-9.8critical350147
CVE-2025-57819FreePBX - Remote Code Executionfreepbx9.8critical340157, 341245
CVE-2025-6058WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Uploadwpbookit9.8CRITICAL382238
CVE-2025-6403Code-Projects School Fees Payment System 1.0 - SQL Injection-9.8critical340157, 380122
CVE-2025-6970WordPress Events Manager <= 7.0.3 - SQL Injectionevents_manager9.8critical380122
CVE-2026-3296Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injectioneverest_forms9.8CRITICAL300007
CVE-2026-35273Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCEpeoplesoft_enterprise_peopletools9.8CRITICAL331032
CVE-2026-39808Fortinet FortiSandbox - Command Injectionfortisandbox9.8critical344363
CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionWordPress9.8CRITICAL340156, 344370
CVE-2026-8037Progress ADC LoadMaster - Command Injectionconnection manager for objectscale9.8CRITICAL344360
CVE-2026-9082Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Querydrupal9.8CRITICAL340156
CVE-2019-8982Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgerywavemarker_studio9.6critical347009
CVE-2020-20982shadoweb wdja v1.5.1 - Cross-Site Scriptingwdja_cms9.6critical341266
CVE-2021-32853Erxes <0.23.0 - Cross-Site Scriptingerxes9.6critical341266
CVE-2023-1892Sidekiq < 7.0.8 - Cross-Site Scriptingsidekiq9.6CRITICAL347198
CVE-2024-29824Ivanti EPM - Remote Code Execution-9.6critical340155
CVE-2026-6875ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCEservicenow9.5CRITICAL380026
CVE-2019-16383MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injectionmoveit transfer9.4CRITICAL344366, 361149, 380122
CVE-2022-26833Open Automation Software OAS Platform V16.00.0121 - Missing Authenticationoas_platform9.4CRITICAL390726
CVE-2024-9264Grafana Post-Auth DuckDB - SQL Injection To File Readgrafana9.4CRITICAL344360
CVE-2025-54782NestJS DevTools Integration - Remote Code Executiondevtools-integration9.4CRITICAL345240
CVE-2026-28496FOSSBilling - Server-Side Template Injection-9.4CRITICAL340155
CVE-2026-46442Flowise < 3.1.2 - node-custom-function Unauthorized RCEflowise9.4CRITICAL345240
CVE-2013-1965Apache Struts2 S2-012 RCEstruts9.3critical344360
CVE-2013-2251Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Executionstruts9.3critical393655
CVE-2020-37123Pinger 1.0 - Remote Code Executionpinger9.3CRITICAL344363
CVE-2024-30498CRM Perks Forms <= 1.1.4 - SQL InjectionCRM Perks Forms9.3critical380122
CVE-2024-32128WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL InjectionRealtyna Organic IDX plugin9.3CRITICAL380122
CVE-2024-32709WP-Recall <= 16.26.5 - SQL Injectionwp-recall9.3critical340016
CVE-2025-25034SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection-9.3critical344370
CVE-2025-32778Web-Check < 2.0.1 Screenshot API - OS Command Injectionweb-check9.3CRITICAL393655
CVE-2025-48281MyStyle Custom Product Designer <= 3.21.1 - SQL Injectionmystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer9.3critical380122
CVE-2026-27174MajorDoMo - Unauthenticated RCEmajordomo9.3CRITICAL347009
CVE-2026-29014MetInfo CMS <= 8.1 - Remote Code Executionmetinfo9.3CRITICAL393655
CVE-2026-41940cPanel & WHM - Authentication Bypass via Session-File CRLF Injectioncpanel9.3CRITICAL377364
CVE-2026-4810Google ADK-Python - Unauthenticated Builder Endpointadk-python9.3CRITICAL390726
CVE-2026-54836YMC Filter - SQL InjectionYMC Filter9.3CRITICAL380122
CVE-2026-27760OpenCATS - Command Injectionopencats9.2CRITICAL344363
CVE-2026-41179RClone RC - Command Injectionrclone9.2CRITICAL340014
CVE-2026-42796Arelle < 2.39.10 - Remote Code Executionarelle9.2CRITICAL340162
CVE-2026-58455Dockwatch <= 0.6.567 - OS Command Injectiondockwatch9.2CRITICAL344361
CVE-2017-14611Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgerycockpit9.1CRITICAL390727, 392301, 392648
CVE-2018-14916Loytec LGATE-902 <6.4.2 - Local File Inclusionlgate-9029.1critical347009
CVE-2018-16716NCBI ToolBox - Directory Traversalncbi_toolbox9.1critical347009
CVE-2018-19365Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversalstreaming_engine9.1critical347009
CVE-2018-9302Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgerycockpit9.1CRITICAL390727, 392301, 392648
CVE-2019-13462Lansweeper Unauthenticated SQL Injectionlansweeper9.1critical340155
CVE-2019-9880WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosurewpgraphql9.1CRITICAL344361
CVE-2020-24589WSO2 API Manager <=3.1.0 - Blind XML External Entity Injectionapi_manager9.1critical380018
CVE-2020-36333ThemeGrill Demo Importer < 1.6.2 - Database Resetthemegrill-demo-importer9.1critical375357
CVE-2021-21479SCIMono <0.0.19 - Remote Code Executionscimono9.1critical340087
CVE-2021-27828In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injectionin4suite erp9.1CRITICAL392301
CVE-2021-27931LumisXP <10.0.0 - Blind XML External Entity Attacklumis_experience_platform9.1critical392301
CVE-2021-28918Netmask NPM Package - Server-Side Request Forgerynetmask9.1critical347009
CVE-2021-37425Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)mobiletogether server9.1CRITICAL330791
CVE-2021-37593PEEL Shopping 9.3.0 - 'id' Time-based SQL Injectionpeel shopping9.1CRITICAL390727, 392301, 392648
CVE-2021-46419Telesquare TLR-2855KS6 - Arbitrary File Deletiontlr-2855ks6 firmware9.1CRITICAL392301, 393134
CVE-2022-26960elFinder <=2.1.60 - Local File Inclusionelfinder9.1critical347009
CVE-2022-27593QNAP QTS Photo Station External Reference - Local File Inclusionphoto_station9.1critical340007
CVE-2022-44727PrestaShop lgcookieslaw - SQL Injectioneu_cookie_law_gdpr9.1CRITICAL380122
CVE-2023-36934MOVEit Transfer - SQL Injectionmoveit_transfer9.1critical340016
CVE-2024-3673Web Directory Free < 1.7.3 - Local File Inclusionweb-directory-free9.1CRITICAL344360
CVE-2024-40422Devika v1 - Path Traversaldevika9.1CRITICAL347009
CVE-2024-5276Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injectionfilecatalyst workflow9.1CRITICAL341245
CVE-2024-53537OpenPanel 0.3.4 - Directory Traversalopenpanel9.1CRITICAL340007
CVE-2024-53900Mongoose < 8.8.3 - Remote Code Executionmongoose9.1critical340095
CVE-2024-5975CZ Loan Management <= 1.1 - SQL Injectioncz-loan-management9.1CRITICAL380122
CVE-2024-8673Z-Downloads < 1.11.7 - Cross-Site Scriptingz-downloads9.1CRITICAL377360
CVE-2025-49029WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Executionbitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget9.1CRITICAL377360
CVE-2026-40887Vendure Core - SQL Injection-9.1CRITICAL340156
CVE-2008-4668Joomla! Image Browser 0.1.5 rc2 - Local File Inclusioncom_imagebrowser9.0HIGH347009
CVE-2013-5758Yealink VoIP Phone SIP-T38G - Privilege Escalationsip-t38g9.0HIGH344360, 344370, 390726, 392647
CVE-2014-5308TestLink 1.9.11 - Multiple SQL Injectionstestlink9.0HIGH350147, 390726, 392647
CVE-2014-7884ArcSight Logger - Arbitrary File Upload / Code Executionarcsight logger9.0HIGH390726, 392647
CVE-2019-7671Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scriptingflexair9.0CRITICAL340147, 390726, 392647
CVE-2021-40438Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgeryhttp_server9.0critical345271
CVE-2021-45046Apache Log4j2 - Remote Code Injectionlog4j9.0critical345115
CVE-2023-34192Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scriptingcollaboration9.0critical341266
CVE-2025-5086Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization-9.0critical331702
CVE-2026-54157LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgerylobe-chat9.0CRITICAL392301
CVE-2025-1302JSONPath Plus < 10.3.0 - Remote Code Execution-8.9HIGH345240
CVE-2013-4863MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware8.8HIGH390726, 392647
CVE-2014-8356ZHONE < S3.0.501 - Multiple Vulnerabilitiesznid 2426a firmware8.8HIGH390726, 392301, 392647
CVE-2014-8357ZHONE < S3.0.501 - Multiple Vulnerabilitiesznid 2426a firmware8.8HIGH390726, 392301, 392647
CVE-2014-9118ZHONE < S3.0.501 - Multiple Vulnerabilitiesznid 2426a firmware8.8HIGH390726, 392301, 392647
CVE-2015-0104IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Executionchange and configuration management database8.8HIGH392301
CVE-2015-4117Vesta Control Panel 0.9.8 - OS Command Injectioncontrol panel8.8HIGH344370
CVE-2016-10960WordPress wSecure Lite < 2.4 - Remote Code Executionwsecure8.8high392301
CVE-2016-4808Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py8.8HIGH344360
CVE-2016-4977Spring Security OAuth2 Remote Command Executionspring_security_oauth8.8high393655
CVE-2016-6277NETGEAR Routers - Remote Code Executiond6220_firmware8.8high347009
CVE-2017-11398Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Controlsmart protection server8.8HIGH330791
CVE-2017-11610XML-RPC Server - Remote Code Executionsupervisor8.8high344364
CVE-2017-14535Trixbox - 2.8.0.4 OS Command Injectiontrixbox8.8high347009
CVE-2017-5799HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusionopencall media platform8.8HIGH390726, 392301, 392647
CVE-2017-6090PhpColl 2.5.1 Arbitrary File Uploadphpcollab8.8HIGH391746
CVE-2017-6823Fiyo CMS 2.0.6.1 - Privilege Escalationfiyo cms8.8HIGH390724
CVE-2017-9413Subsonic 6.1.1 - Server-Side Request Forgerysubsonic8.8HIGH390726, 392301, 392647
CVE-2017-9822DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Executiondotnetnuke8.8high344365
CVE-2018-10093AudioCodes 420HD - Remote Code Execution420hd_ip_phone_firmware8.8high347009
CVE-2018-10823D-Link Routers - Remote Command Injectiondwr-116_firmware8.8high347009
CVE-2018-11442EasyService Billing 1.0 - Cross-Site Request Forgeryeasyservice billing8.8HIGH340147
CVE-2018-11445EasyService Billing 1.0 - Cross-Site Request Forgeryeasyservice billing8.8HIGH340147
CVE-2018-12613PhpMyAdmin <4.8.2 - Local File Inclusionphpmyadmin8.8high347009
CVE-2018-15142OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actionsopenemr8.8HIGH344360, 344370
CVE-2018-15884RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)mp c4504ex firmware8.8HIGH350147
CVE-2018-5406KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilitieskace systems management appliance firmware8.8HIGH390727, 392301, 392648
CVE-2018-7700DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Executiondedecms8.8high344370
CVE-2018-7765Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injectionu.motion builder8.8HIGH341245, 344364
CVE-2019-14530OpenEMR <5.0.2 - Local File Inclusionopenemr8.8high347009
CVE-2019-15642Webmin < 1.920 - Authenticated Remote Code Executionwebmin8.8high344362
CVE-2019-19824TOTOLINK Realtek SD Routers - Remote Command Injectiona3002ru_firmware8.8high340014
CVE-2019-20224Pandora FMS 7.0NG - Remote Command Injectionpandora_fms8.8high344363
CVE-2019-9082ThinkPHP < 3.2.4 - Remote Code Execution-8.8high393753
CVE-2019-9189Prima Access Control 2.3.35 - Arbitrary File Uploadflexair8.8HIGH344360, 390726, 392647
CVE-2020-11978Apache Airflow <=1.10.10 - Remote Code Executionairflow8.8HIGH344364
CVE-2020-13851Artica Pandora FMS 7.44 - Remote Code Executionpandora_fms8.8high347009
CVE-2020-17505Artica Web Proxy 4.30 - OS Command Injectionweb_proxy8.8high340017
CVE-2020-2036Palo Alto Networks PAN-OS Web Interface - Cross Site-Scriptingpan-os8.8HIGH347198
CVE-2020-24579D-Link DSL 2888a - Authentication Bypass/Remote Command Executiondsl2888a_firmware8.8high347009, 392301
CVE-2020-24949PHP-Fusion 9.03.50 - Remote Code Executionphp-fusion8.8high393655
CVE-2020-25760Visitor Management System in PHP 1.0 - SQL Injection (Authenticated)visitor management system8.8HIGH390727, 392301, 392648
CVE-2020-26217XStream <1.4.14 - Remote Code Executionxstream8.8high344363
CVE-2020-5192Hospital Management System 4.0 - 'searchdata' SQL Injectionhospital management system8.8HIGH340016, 390727, 392301, 392648
CVE-2020-5504phpMyAdmin 5.0.0 - SQL Injectionphpmyadmin8.8HIGH390727, 392301, 392648
CVE-2020-5776MAGMI - Cross-Site Request Forgerymagmi8.8high344364
CVE-2020-6010WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)learnpress8.8HIGH380122
CVE-2020-7991Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)framework8.8HIGH340147
CVE-2020-8163Ruby on Rails <5.0.1 - Remote Code Executionrails8.8high347009
CVE-2020-8641Lotus Core CMS 1.0.1 - Local File Inclusionlotus_core_cms8.8high347009
CVE-2020-8813Cacti v1.2.8 - Remote Code Executioncacti8.8high340014
CVE-2020-9043WordPress wpCentral <1.5.1 - Information Disclosurewpcentral8.8HIGH377360
CVE-2021-20086Odoo Apps - Cross-Site Scripting via Prototype Pollutionjquery-bbq8.8high347198
CVE-2021-22053Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Executionspring_cloud_netflix8.8high340087, 340193
CVE-2021-24347WordPress SP Project & Document Manager <4.22 - Authenticated Shell Uploadsp_project_&amp;_document_manager8.8HIGH377360
CVE-2021-24750WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injectionwp_visitor_statistics_(real_time_traffic)8.8high340016
CVE-2021-25052WordPress Button Generator <2.3.3 - Remote File Inclusionbutton_generator8.8high340464
CVE-2021-25082WordPress Popup Builder < 4.0.7 - Remote Code Executionpopup builder8.8HIGH377360
CVE-2021-28151Hongdian H8922 3.0.5 - Remote Command Injectionh8922_firmware8.8high392301
CVE-2021-32819Nodejs Squirrelly - Remote Code Executionsquirrelly8.8high340014
CVE-2021-3577Motorola Baby Monitors - Remote Command Executionhalo+_camera_firmware8.8high393655
CVE-2022-0439Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injectionemail subscribers &amp; newsletters8.8HIGH377360
CVE-2022-1329Elementor Website Builder - Remote Code Executionwebsite_builder8.8HIGH377360
CVE-2022-1883Terraboard <2.2.0 - SQL Injectionterraboard8.8HIGH341245
CVE-2022-28079College Management System 1.0 - 'course_code' SQL Injection (Authenticated)college management system8.8HIGH340016, 340145
CVE-2022-28080Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)event management system8.8HIGH340016, 340145
CVE-2022-3142NEX-Forms Plugin < 7.9.7 - SQL Injectionnex-forms8.8high380122
CVE-2022-33891Apache Spark UI - Remote Command Injectionspark8.8high344361
CVE-2022-3768WordPress WPSmartContracts <1.3.12 - SQL Injectionwpsmartcontracts8.8high380122
CVE-2022-3800IBAX - SQL Injectiongo-ibax8.8high344366
CVE-2022-46443Bangresto - SQL Injectionbangresto8.8high340016
CVE-2023-0261WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injectionwp_tripadvisor_review_slider8.8high380122
CVE-2023-0630Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injectionslimstat_analytics8.8high380122
CVE-2023-0903Employee Task Management System v1.0 - SQL Injection on edit-task.phpemployee task management system8.8HIGH340016
CVE-2023-0904Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)employee task management system8.8HIGH340016
CVE-2023-0912Auto Dealer Management System v1.0 - SQL Injectionauto dealer management system8.8HIGH340016
CVE-2023-0913Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.phpauto dealer management system8.8HIGH340016
CVE-2023-0915Auto Dealer Management System v1.0 - SQL Injection on manage_user.phpauto dealer management system8.8HIGH340016
CVE-2023-0962Music Gallery Site v1.0 - SQL Injection on page Master.phpmusic gallery site8.8HIGH390727, 392301, 392648
CVE-2023-23492Login with Phone Number - Cross-Site Scriptinglogin_with_phone_number8.8high347198
CVE-2023-23897Ozette Plugins - Cross-Site Request Forgerysimple_mobile_url_redirect8.8HIGH377360
CVE-2023-30625Rudder Server < 1.3.0-rc.1 - SQL Injectionrudder-server8.8high392301
CVE-2023-32749Pydio Cells 4.1.2 - Unauthorised Role Assignmentscells8.8HIGH330791
CVE-2023-37462XWiki Platform - Remote Code Executionxwiki8.8high340130
CVE-2023-39108rConfig 3.9.4 - Server-Side Request Forgeryrconfig8.8high347009
CVE-2023-39109rConfig 3.9.4 - Server-Side Request Forgeryrconfig8.8high347009
CVE-2023-39110rConfig 3.9.4 - Server-Side Request Forgeryrconfig8.8high347009
CVE-2023-4169Ruijie RG-EW1200G Router - Password Resetrg-ew1200g_firmware8.8high392301
CVE-2023-4415Ruijie RG-EW1200G Router Background - Login Bypassrg-ew1200g_firmware8.8high392301
CVE-2023-45375PrestaShop PireosPay - SQL Injectionpireospay8.8HIGH341245
CVE-2023-48777WordPress Elementor 3.18.1 - File Upload/Remote Code Executionwebsite_builder8.8HIGH377360
CVE-2023-49230Peplink Balance Two before 8.4.0 - Unauthenticated Config Uploadbalance_two_firmware8.8HIGH392301
CVE-2023-50094reNgine 2.2.0 - Command Injectionrengine8.8HIGH330791
CVE-2023-7137Client Details System 1.0 - SQL Injectionclient details system8.8HIGH380122
CVE-2024-30464WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorizationsocial-icons-widget-by-wpzoom8.8HIGH377360
CVE-2024-35584openSIS < 9.1 - SQL Injectionopensis8.8high380122
CVE-2024-36597AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability.life insurance management system8.8HIGH340145
CVE-2024-41667OpenAM<=15.0.3 FreeMarker - Template Injection-8.8HIGH344360, 392647
CVE-2024-7029AVTECH IP Camera - Command Injection-8.8high344363
CVE-2024-7340W&B Weave Server - Remote Arbitrary File Leak-8.8high347009
CVE-2024-8252WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusionclean-login8.8HIGH344360
CVE-2025-2075Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationuncanny automator8.8HIGH377360
CVE-2025-32614EventON Lite <= 2.4 - Authenticated Local File Inclusionflavor8.8HIGH344360, 377360
CVE-2021-4463Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download-8.7HIGH347009
CVE-2021-47795GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scriptinggeowebserver8.7HIGH341266, 390716
CVE-2022-41800F5 BIG-IP Appliance Mode - Command Injectionbig-ip_access_policy_manager8.7HIGH344362
CVE-2023-7327Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read-8.7HIGH390716
CVE-2024-6911PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusionprocessplus8.7HIGH347019
CVE-2026-31831Tautulli <= 2.16.1 - Path Traversaltautulli8.7HIGH346019
CVE-2026-33497Langflow < 1.7.0 - Path Traversallangflow8.7HIGH300006
CVE-2026-35029LiteLLM - Arbitrary File Readlitellm8.7HIGH344360
CVE-2015-4694WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrievalzip_attachments8.6high347009
CVE-2018-16288LG SuperSign EZ CMS 2.5 - Local File Inclusionsupersign_cms8.6high347009
CVE-2021-22214Gitlab CE/EE 10.5 - Server-Side Request Forgerygitlab8.6HIGH344362
CVE-2021-32820Express-handlebars - Local File Inclusionexpress_handlebars8.6high347009
CVE-2022-0783Multiple Shipping Address Woocommerce < 2.0 - SQL Injectionmultiple_shipping_addresses_for_woocommerce8.6high380122
CVE-2022-24900Piano LED Visualizer 1.3 - Local File Inclusionpiano_led_visualizer8.6high347009
CVE-2022-41412perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgeryperfsonar8.6high340007
CVE-2023-26360Adobe ColdFusion - Local File Readcoldfusion8.6high340007, 344360
CVE-2023-28787Quiz and Survey Master <= 8.1.4 - SQL InjectionQuiz And Survey Master8.6critical380122
CVE-2023-3722Avaya Aura Device Services - OS Command Injectionaura_device_services8.6high392301
CVE-2023-43662ShokoServer System - Local File Inclusion (LFI)shokoserver8.6high390716
CVE-2023-4490WordPress Job Portal < 2.0.6 - SQL Injection-8.6high380122
CVE-2023-47105Chaosblade < 1.7.4 - Remote Code Executionchaosblade8.6high393655
CVE-2024-13726Themes Coder Ecommerce <= 1.3.4 - SQL Injectiontc-ecommerce8.6HIGH380122
CVE-2024-21136Oracle Retail Xstore Suite - Pre-authenticated Path Traversalretail_xstore_office8.6high347019
CVE-2024-23167GestSup - Cross-Site Scriptinggestsup8.6high333141
CVE-2024-24919Check Point Quantum Gateway - Information Disclosurequantum_security_gateway8.6high392301
CVE-2024-31850CData Arc < 23.4.8839 - Path Traversalarc8.6HIGH344365
CVE-2024-31851CData Sync < 23.4.8843 - Path Traversal-8.6HIGH344365
CVE-2024-34470HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusionmailinspector8.6HIGH347009
CVE-2024-48248NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Readbackup &amp; replication director8.6HIGH390726
CVE-2024-48766NetAlert X - Arbitary File Readnetalertx8.6critical344360
CVE-2024-9186Automation By Autonami < 3.3.0 - SQL Injectionwp-marketing-automations8.6HIGH380122
CVE-2025-10897WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read-8.6high344360
CVE-2025-2558WordPress The Wound Theme <= 0.0.1 - Local File Inclusionthe-wound8.6HIGH344360, 347009
CVE-2025-31131Yeswiki < 4.5.2 - Unauthenticated Path Traversal-8.6high347009
CVE-2025-34045WeiPHP 5.0 - Path Traversal-8.6high344360
CVE-2026-30958OneUptime < 10.0.21 - Path Traversaloneuptime8.6HIGH347009
CVE-2026-3326XStore Theme < 9.7.3 - SQL Injection-8.6HIGH380122
CVE-2015-2996SysAid Help Desk <15.2 - Local File Inclusionsysaid8.5HIGH347009
CVE-2021-39144XStream 1.4.18 - Remote Code Executionxstream8.5high344363
CVE-2024-9054Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injectiontimeprovider 4100 firmware8.5HIGH392301
CVE-2026-34885WordPress Media Library Assistant <= 3.34 - SQL InjectionDavid Lingren Media LIbrary Assistant8.5HIGH377360
CVE-2012-10018WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Uploadmapplic8.3HIGH377360
CVE-2024-35219OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete-8.3HIGH340007
CVE-2024-5420SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting-8.3high340147
CVE-2017-10075Oracle Content Server - Cross-Site Scriptingwebcenter_content8.2high347198
CVE-2020-13379Grafana 3.0.1-7.0.1 - Server-Side Request Forgerygrafana8.2high340165
CVE-2020-26248PrestaShop Product Comments <4.2.0 - SQL Injectionproductcomments8.2high380122
CVE-2022-2633All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgeryall-in-one_video_gallery8.2high340163
CVE-2024-21893Ivanti SAML - Server Side Request Forgery (SSRF)connect_secure8.2high392301
CVE-2024-40348Bazarr < 1.4.3 - Arbitrary File Readbazarr8.2HIGH347009
CVE-2025-2609MagnusBilling Login Logs - Cross-Site Scriptingmagnusbilling8.2high333141
CVE-2025-44177White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)protop8.2HIGH347009, 390727, 392648
CVE-2025-49002DataEase - Remote Code Executiondataease8.2HIGH340195
CVE-2026-23482Blinko < 1.8.4 - Path Traversalblinko8.2HIGH347009
CVE-2013-2678Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware8.1HIGH392301
CVE-2013-4862MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware8.1HIGH390726, 392647
CVE-2016-1337Cisco EPC 3928 - Multiple Vulnerabilitiesepc3928 firmware8.1HIGH333141, 340147, 344363, 390726, 392301, 392647
CVE-2016-3081Apache S2-032 Struts - Remote Code Executionstruts8.1high347009
CVE-2017-12615Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)tomcat8.1HIGH347009, 380026, 392301
CVE-2017-12617Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)tomcat8.1HIGH392301
CVE-2017-14095Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Controlsmart protection server8.1HIGH330791
CVE-2017-15715Apache httpd <=2.4.29 - Arbitrary File Uploadhttp_server8.1high344365
CVE-2017-9805Apache Struts2 S2-052 - Remote Code Executionstruts8.1high344360
CVE-2018-1000130Jolokia Agent - JNDI Code Injectionwebarchive_agent8.1high344362
CVE-2018-11231Opencart Divido - Sql Injectiondivido8.1high392301
CVE-2018-11776Apache Struts2 S2-057 - Remote Code Executionstruts8.1high347009
CVE-2018-12455Intelbras NPLUG 1.0.0.14 - Authentication Bypassnplug8.1critical390716
CVE-2018-1335Apache Tika < 1.1.8 - Header Command Injectiontika8.1HIGH340138
CVE-2018-6961VMware NSX SD-WAN Edge - Command Injectionnsx_sd-wan_edge8.1critical393655
CVE-2019-6340Drupal - Remote Code Executiondrupal8.1high392301
CVE-2021-23394elFinder < 2.1.58 - Remote Code Executionelfinder8.1high393781
CVE-2021-25094Wordpress Tatsubuilder <= 3.3.11 - Remote Code Executiontatsu8.1HIGH382238
CVE-2023-26067Lexmark Printers - Command Injectioncxtpc_firmware8.1high392301
CVE-2023-5815News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusionnews_&amp;_blog_designer_pack8.1high347006
CVE-2023-6831mlflow - Path Traversalmlflow8.1high390709
CVE-2024-30188Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Writedolphinscheduler8.1HIGH390726
CVE-2024-38473Apache HTTP Server - ACL BypassApache HTTP Server8.1high390709
CVE-2025-48954Discourse OAuth Social Login - Cross-site Scripting-8.1high347198, 390712
CVE-2025-52970Fortinet FortiWeb - Authentication Bypass to Admin PrivilegeFortiWeb8.1HIGH340157
CVE-2026-11111CVE-2026-11111 Research NoteExampleProduct8.1HIGH340016, 340162
CVE-2020-36836WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletionwp_fastest_cache8.0HIGH377360
CVE-2021-20167Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrunrax43_firmware8.0high392301
CVE-2009-1558Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusionwvc54gca7.8HIGH347009
CVE-2010-4231Camtron CMNC-200 IP Camera - Directory Traversalcmnc-200_firmware7.8HIGH347009
CVE-2011-3315Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversalunified_ip_interactive_voice_response7.8high347009
CVE-2014-2962Belkin N150 Router 1.00.08/1.00.09 - Path Traversaln150_f9k1009_firmware7.8high347009
CVE-2015-3035TP-LINK - Local File Inclusiontl-wr841n_(9.0)_firmware7.8high347009
CVE-2015-4669Xceedium Xsuite - Multiple Vulnerabilitiesxsuite7.8HIGH344360, 347198, 390726, 392647
CVE-2019-20499D-Link DWL-2600AP - Multiple OS Command Injectiondwl-2600ap firmware7.8HIGH330791, 344361, 390726, 392647
CVE-2019-20500D-Link DWL-2600AP - Multiple OS Command Injectiondwl-2600ap firmware7.8HIGH330791, 344361, 390726, 392647
CVE-2019-20501D-Link DWL-2600AP - Multiple OS Command Injectiondwl-2600ap firmware7.8HIGH330791, 344361, 390726, 392647
CVE-2021-21315Node.JS System Information Library <5.3.1 - Remote Command Injectionsysteminformation7.8high347009
CVE-2022-25485Cuppa CMS v1.0 - Local File Inclusioncuppacms7.8high344360
CVE-2022-25486Cuppa CMS v1.0 - Local File Inclusioncuppacms7.8high344360
CVE-2023-46022Blood Bank 1.0 - 'bid' SQLiblood bank7.8HIGH390727, 392301, 392648
CVE-2016-3473Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injectionbusiness intelligence publisher7.7HIGH390704, 392301
CVE-2020-35749WordPress Simple Job Board <2.9.4 - Local File Inclusionsimple_board_job7.7high347009
CVE-2021-21234Spring Boot Actuator Logview Directory Traversalspring-boot-actuator-logview7.7high340007, 347009
CVE-2021-43831Gradio < 2.5.0 - Arbitrary File Readgradio7.7high347009
CVE-2024-43687Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)timeprovider 4100 firmware7.7HIGH392301
CVE-2025-46822Java-springboot-codebase 1.1 - Arbitrary File Read-7.7HIGH347009
CVE-2025-59341esm.sh <= v136 - Local File Inclusionesm.sh7.7HIGH347009
CVE-2025-47783Label Studio < 1.18.0 - Reflected XSSlabel-studio7.6HIGH340147
CVE-2002-1131SquirrelMail 1.2.6/1.2.7 - Cross-Site Scriptingsquirrelmail7.5HIGH341266
CVE-2006-2842Squirrelmail <=1.4.6 - Local File Inclusionsquirrelmail7.5HIGH347009
CVE-2008-1059WordPress Sniplets 1.1.2 - Local File Inclusionsniplets_plugin7.5HIGH344360
CVE-2009-2015Joomla! MooFAQ 1.0 - Local File Inclusionjoomla7.5HIGH347009
CVE-2009-3318Joomla! Roland Breedveld Album 1.14 - Local File Inclusionjoomla7.5HIGH347009
CVE-2009-4202Joomla! Omilen Photo Gallery 0.5b - Local File Inclusionjoomla!7.5HIGH347009
CVE-2009-4223KR-Web <=1.1b2 - Remote File Inclusionkr-php_web_content_server7.5HIGH340162
CVE-2009-4679Joomla! Portfolio Nexus - Remote File Inclusioncom_if_nexus7.5HIGH347009
CVE-2010-0157Joomla! Component com_biblestudy - Local File Inclusionjoomla!7.5HIGH347009
CVE-2010-0759Joomla! Plugin Core Design Scriptegrator - Local File Inclusionscriptegrator_plugin7.5HIGH347009
CVE-2010-0972Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusioncom_gcalendar7.5HIGH347009
CVE-2010-0985Joomla! Component com_abbrev - Local File Inclusioncom_abbrev7.5HIGH347009
CVE-2010-1306Joomla! Component Picasa 2.0 - Local File Inclusioncom_joomlapicasa27.5HIGH347009
CVE-2010-1470Joomla! Component Web TV 1.0 - Local File Inclusioncom_webtv7.5HIGH347009
CVE-2010-1471Joomla! Component Address Book 1.5.0 - Local File Inclusioncom_addressbook7.5HIGH347009
CVE-2010-1472Joomla! Component Horoscope 1.5.0 - Local File Inclusioncom_horoscope7.5HIGH347009
CVE-2010-1495Joomla! Component Matamko 1.01 - Local File Inclusioncom_matamko7.5HIGH347009
CVE-2010-1531Joomla! Component redSHOP 1.0 - Local File Inclusioncom_redshop7.5HIGH347009
CVE-2010-1533Joomla! Component TweetLA 1.0.1 - Local File Inclusioncom_tweetla7.5HIGH347009
CVE-2010-1535Joomla! Component TRAVELbook 1.0.1 - Local File Inclusioncom_travelbook7.5HIGH347009
CVE-2010-1602Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusioncom_zimbcomment7.5HIGH347009
CVE-2010-1603Joomla! Component ZiMBCore 0.1 - Local File Inclusioncom_zimbcore7.5HIGH347009
CVE-2010-1653Joomla! Component Graphics 1.0.6 - Local File Inclusioncom_graphics7.5HIGH347009
CVE-2010-1717Joomla! Component iF surfALERT 1.2 - Local File Inclusionif_surfalert7.5HIGH347009
CVE-2010-1875Joomla! Component Property - Local File Inclusioncom_properties7.5HIGH347009
CVE-2010-1878Joomla! Component OrgChart 1.0.0 - Local File Inclusioncom_orgchart7.5HIGH347009
CVE-2010-1952Joomla! Component BeeHeard 1.0 - Local File Inclusioncom_beeheard7.5HIGH347009
CVE-2010-1953Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusioncom_multimap7.5HIGH347009
CVE-2010-1954Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusioncom_multiroot7.5HIGH347009
CVE-2010-1955Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusioncom_blogfactory7.5HIGH347009
CVE-2010-1956Joomla! Component Gadget Factory 1.0.0 - Local File Inclusioncom_gadgetfactory7.5HIGH347009
CVE-2010-1957Joomla! Component Love Factory 1.3.4 - Local File Inclusioncom_lovefactory7.5HIGH347009
CVE-2010-1977Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusioncom_jwhmcs7.5HIGH347009
CVE-2010-1980Joomla! Component Joomla! Flickr 1.0 - Local File Inclusioncom_joomlaflickr7.5HIGH347009
CVE-2010-1983Joomla! Component redTWITTER 1.0 - Local File Inclusioncom_redtwitter7.5HIGH347009
CVE-2010-2033Joomla! Percha Categories Tree 0.6 - Local File Inclusioncom_perchacategoriestree7.5HIGH347009
CVE-2010-2034Joomla! Component Percha Image Attach 1.1 - Directory Traversalcom_perchaimageattach7.5HIGH347009
CVE-2010-2035Joomla! Component Percha Gallery 1.6 Beta - Directory Traversalcom_perchagallery7.5HIGH347009
CVE-2010-2036Joomla! Component Percha Fields Attach 1.0 - Directory Traversalcom_perchafieldsattach7.5HIGH347009
CVE-2010-2037Joomla! Component Percha Downloads Attach 1.1 - Directory Traversalcom_perchadownloadsattach7.5HIGH347009
CVE-2010-2045Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusioncom_dioneformwizard7.5HIGH347009
CVE-2010-2050Joomla! Component MS Comment 0.8.0b - Local File Inclusioncom_mscomment7.5HIGH347009
CVE-2010-2128Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusioncom_jequoteform7.5HIGH347009
CVE-2010-2259Joomla! Component com_bfsurvey - Local File Inclusioncom_bfsurvey_profree7.5HIGH347009
CVE-2010-2682Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusioncom_realtyna7.5HIGH347009
CVE-2010-2918Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusioncom_joomla_visites7.5HIGH347009
CVE-2010-3426Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusioncom_jphone7.5HIGH347009
CVE-2010-4282Pandora Fms < 3.1.1 - Directory Traversalpandora_fms7.5high347009
CVE-2010-4719Joomla! Component JRadio - Local File Inclusioncom_jradio7.5high347009
CVE-2010-4769Joomla! Component Jimtawl 1.0.2 - Local File Inclusioncom_jimtawl7.5high347009
CVE-2010-4977Joomla! Component Canteen 1.0 - Local File Inclusioncom_canteen7.5high347009
CVE-2010-5028Joomla! Component JE Job 1.0 - Local File Inclusioncom_jejob7.5high347009
CVE-2011-4448WikkaWiki 1.3.2 - Multiple Vulnerabilitieswikkawiki7.5HIGH344360, 390715, 390726, 392647
CVE-2011-4899WordPress Core 3.3.1 - Multiple Vulnerabilitieswordpress7.5HIGH340147, 390727, 392301, 392648
CVE-2012-1226Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilitiesdolibarr_erp/crm7.5high347009
CVE-2012-1823PHP CGI v5.3.12/5.4.2 Remote Code Executionphp7.5high340165
CVE-2013-0249cURL - Buffer Overflow (PoC)curl7.5HIGH390727, 392301, 392648
CVE-2013-2680Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware7.5HIGH392301
CVE-2013-5639Gnew 2013.1 - Multiple Vulnerabilities (2)gnew7.5HIGH390727, 392301, 392648
CVE-2013-5640Gnew 2013.1 - Multiple Vulnerabilities (2)gnew7.5HIGH390727, 392301, 392648
CVE-2013-5694Opsview pre 4.4.1 - Blind SQL Injectionopsview7.5HIGH344370, 390726, 392647
CVE-2013-6041Webuzo 2.1.3 - Multiple Vulnerabilitieswebuzo7.5HIGH333140, 344360, 390726, 392647
CVE-2014-10037DomPHP 0.83 - Directory Traversaldomphp7.5high347009
CVE-2014-3704Drupal SQL Injectiondrupal7.5high392301
CVE-2014-3744Node.js st module Directory Traversalnode.js7.5high347009
CVE-2014-6389PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Executionphpcompta/noalyss7.5HIGH390726, 392301, 392647
CVE-2014-8675SO Planning 1.32 - Multiple Vulnerabilitiessoplanning7.5HIGH340155, 390726, 392647
CVE-2014-8682Gogs (Go Git Service) - SQL Injectiongogs7.5high340016, 340017
CVE-2014-9145Fiyo CMS 2.0.1.8 - Multiple Vulnerabilitiesfiyo cms7.5HIGH344360, 390720, 390726, 392647
CVE-2014-9147Fiyo CMS 2.0.1.8 - Multiple Vulnerabilitiesfiyo cms7.5HIGH344360, 390720, 390726, 392647
CVE-2014-9215PBBoard CMS 3.0.1 - SQL Injectionpbboard7.5HIGH380026, 390726, 392647
CVE-2014-9464Microweber CMS 0.95 - SQL Injectionmicroweber7.5HIGH390726, 392301, 392647
CVE-2014-9735WordPress RevSlider - Remote Code Execution via File Uploadshowbiz_pro7.5high337469
CVE-2015-1000005WordPress Candidate Application Form <= 1.3 - Local File Inclusioncandidate-application-form7.5high347009
CVE-2015-1000010WordPress Simple Image Manipulator < 1.0 - Local File Inclusionsimple-image-manipulator7.5high347009
CVE-2015-1000012WordPress MyPixs <=0.3 - Local File Inclusionmypixs7.5high347009
CVE-2015-1400NPDS CMS REvolution-13 - SQL Injectionrevolution7.5HIGH334168, 390726, 392647
CVE-2015-1427ElasticSearch - Remote Code Executionelasticsearch7.5high344360
CVE-2015-1503IceWarp Mail Server < 11.1.1 - Directory Traversalmail server7.5HIGH347009, 390726, 390727, 392301, 392647, 392648
CVE-2015-1518RedaxScript CMS 2.2.0 - SQL Injectionredaxscript7.5HIGH380026, 390726, 392647
CVE-2015-2080Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffersfedora7.5HIGH344361, 344365, 390724
CVE-2015-2196WordPress Spider Calendar <=1.4.9 - SQL Injectionspider_calendar7.5high380122
CVE-2015-2824WordPress Plugin Simple Ads Manager - Multiple SQL Injectionssimple ads manager7.5HIGH380026, 390720, 390724, 390726, 392647
CVE-2015-3648ResourceSpace - Local File inclusionresourcespace7.5high347009
CVE-2015-4074Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusionhelpdesk_pro7.5high347009
CVE-2015-4632Koha 3.20.1 - Directory Traversalkoha7.5high347009
CVE-2015-5469WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusionmdc_youtube_downloader7.5high347009
CVE-2015-6401Cisco EPC 3928 - Multiple Vulnerabilitiesepc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter7.5HIGH333141, 340147, 344363, 390726, 392301, 392647
CVE-2015-7245D-Link DVG-N5402SP - Local File Inclusiondvg-n5402sp_firmware7.5HIGH392301
CVE-2015-7297Joomla! Core SQL Injectionjoomla!7.5high340159
CVE-2015-9406mTheme Unus < 2.3 - Directory Traversalmtheme-unus7.5high344360
CVE-2016-10367Opsview Monitor Pro - Local File Inclusionopsview7.5high390709
CVE-2016-10924Wordpress Zedna eBook download <1.2 - Local File Inclusionzedna_ebook_download7.5high344360
CVE-2016-10956WordPress Mail Masta 1.0 - Local File Inclusionmail-masta7.5high347009
CVE-2016-1328Cisco EPC 3928 - Multiple Vulnerabilitiesepc3928 firmware7.5HIGH333141, 340147, 344363, 390726, 392301, 392647
CVE-2016-1336Cisco EPC 3928 - Multiple Vulnerabilitiesepc3928 firmware7.5HIGH333141, 340147, 344363, 390726, 392301, 392647
CVE-2016-2389SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusionnetweaver7.5high347009
CVE-2016-4309Symphony CMS 2.6.7 - Session Fixationsymphony7.5HIGH390727, 392301, 392648
CVE-2016-4806Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py7.5HIGH344360
CVE-2016-6601WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilitieswebnms framework7.5HIGH347009, 390727, 392301, 392648
CVE-2017-1000028Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusionglassfish_server7.5high347009
CVE-2017-1000029Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusionglassfish_server7.5high347009
CVE-2017-1000170WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusionjqueryfiletree7.5high392301
CVE-2017-10271Oracle WebLogic Server - Remote Command Executionweblogic_server7.5high344362
CVE-2017-10974Yaws 1.91 - Local File Inclusionyaws7.5high350591
CVE-2017-11456Geneko Routers - Path Traversalgwr352 3g router firmware7.5HIGH346019
CVE-2017-11512ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrievalservicedesk7.5high340007, 347019
CVE-2017-14523Wonder CMS 2.3.1 - 'Host' Header Injectionwondercms7.5HIGH392301
CVE-2017-14849Node.js <8.6.0 - Directory Traversalnode.js7.5high347009
CVE-2017-15363Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusionrestler7.5high340007
CVE-2017-15647FiberHome Routers - Local File Inclusionrouterfiberhome_firmware7.5high347009
CVE-2017-16806Ulterius Server < 1.9.5.0 - Directory Traversalulterius_server7.5high347009
CVE-2017-16877Nextjs <2.4.1 - Local File Inclusionnext.js7.5high347009
CVE-2017-16894Laravel <5.5.21 - Information Disclosurelaravel7.5high390709
CVE-2017-5850OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Serviceopenbsd7.5HIGH390727, 392301, 392648
CVE-2017-6190D-Link DWR-116 / DWR-116A1 - Arbitrary File Downloaddwr-116 firmware7.5HIGH347009, 390727, 392648
CVE-2017-9833BOA Web Server 0.94.14 - Arbitrary File Accessboa7.5high347009
CVE-2018-10201Ncomputing vSPace Pro 10 and 11 - Directory Traversalvspace_pro7.5high390716
CVE-2018-10822D-Link Routers - Local File Inclusiondwr-116_firmware7.5high347009
CVE-2018-10956IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusionorchid_core_vms7.5high347009
CVE-2018-11222Pandora FMS <=7.0NG.722 - Remote Code Executionpandora_fms7.5HIGH390726
CVE-2018-12054Schools Alert Management Script - Arbitrary File Readschools_alert_management_script7.5high344360
CVE-2018-12909Webgrind <= 1.5 - Local File Inclusionwebgrind7.5high347009
CVE-2018-1306Apache Portals Pluto 3.0.0 - Remote Code Executionpluto7.5HIGH390727, 392648
CVE-2018-14912cgit < 1.2.1 - Directory Traversalcgit7.5high347009
CVE-2018-14918LOYTEC LGATE-902 6.3.2 - Local File Inclusionlgate-902_firmware7.5high347009
CVE-2018-15138LG-Ericsson iPECS NMS 30M - Local File Inclusionipecs_nms7.5high347009
CVE-2018-15535Responsive FileManager < 9.13.4 - Directory Traversalresponsive filemanager7.5HIGH347009, 390720, 390727, 392648
CVE-2018-15745Argus Surveillance DVR 4.0.0.0 - Local File Inclusiondvr7.5high340007
CVE-2018-15811DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserializationdotnetnuke7.5high344365
CVE-2018-16299WordPress Localize My Post 1.0 - Local File Inclusionlocalize_my_post7.5high347009
CVE-2018-18323Centos Web Panel 0.9.8.480 - Local File Inclusionwebpanel7.5high347009
CVE-2018-18325DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserializationdotnetnuke7.5high344365
CVE-2018-19326Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusionvmg1312-b10d_firmware7.5high347009
CVE-2018-19458PHP Proxy 3.0.3 - Local File Inclusionphp-proxy7.5high347009
CVE-2018-19753Tarantella Enterprise <3.11 - Local File Inclusiontarantella_enterprise7.5high347009
CVE-2018-20463WordPress JSmol2WP <=1.07 - Local File Inclusionjsmol2wp7.5high344360
CVE-2018-20470Tyto Sahi pro 7.x/8.x - Local File Inclusionsahi_pro7.5high340007
CVE-2018-3760Ruby On Rails - Local File Inclusioncloudforms7.5high347009
CVE-2018-6008Joomla! Jtag Members Directory 5.3.7 - Local File Inclusionjtag_members_directory7.5high347009
CVE-2018-6184Zeit Next.js < 4.2.3 - Local File Inclusionnext.js7.5high347009
CVE-2018-7171TwonkyMedia Server 7.0.11-8.5 - Directory Traversaltwonky server7.5HIGH390727, 392301, 392648
CVE-2018-7422WordPress Site Editor <=1.1.1 - Local File Inclusionsite_editor7.5high344360, 347009
CVE-2018-7490uWSGI PHP Plugin Local File Inclusionuwsgi7.5high347009
CVE-2018-7719Acrolinx Server <5.2.5 - Local File Inclusionacrolinx_server7.5high347019
CVE-2018-8033Apache OFBiz - XML External Entity Injectionofbiz7.5high341256
CVE-2018-8727Mirasys DVMS Workstation <=5.12.6 - Local File Inclusiondvms_workstation7.5high390716
CVE-2018-9118WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusionwp_background_takeover_advertisements7.5high344360
CVE-2018-9205Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusionavatar_uploader7.5high347009
CVE-2019-12276GrandNode 4.40 - Local File Inclusiongrandnode7.5high347009
CVE-2019-12593IceWarp Mail Server <=10.4.4 - Local File Inclusionmail_server7.5high347019
CVE-2019-14205WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusionadaptive_images7.5high344360
CVE-2019-14206Nevma Adaptive Images - Arbitrary File Deletionadaptive_images7.5HIGH340007, 377360
CVE-2019-14251T24 Web Server - Local File Inclusiont247.5high347009
CVE-2019-14322Pallets Werkzeug <0.15.5 - Local File Inclusionwindows7.5high390716
CVE-2019-16123PilusCart <=1.4.1 - Local File Inclusionpiluscart7.5high347009
CVE-2019-16469Adobe Experience Manager - Expression Language Injectionexperience_manager7.5high393655
CVE-2019-16758Lexmark Services Monitor 2.27.4.0.39 - Directory Traversalservices monitor firmware7.5HIGH346019
CVE-2019-17538Jiangnan Online Judge 0.8.0 - Local File Inclusionjiangnan_online_judge7.5high347009
CVE-2019-18371Xiaomi Mi WiFi R3G Routers - Local file Inclusionmillet_router_3g_firmware7.5high347009
CVE-2019-18665DOMOS 5.5 - Local File Inclusiondomos7.5high347009
CVE-2019-18922Allied Telesis AT-GS950/8 - Local File Inclusionat-gs950/8_firmware7.5high347009
CVE-2019-19731Roxy Fileman 1.4.5 - Directory Traversalroxy fileman7.5HIGH340007
CVE-2019-19822TOTOLINK/Realtek Routers - Information Disclosure-7.5high390716
CVE-2019-19823TOTOLINK/Realtek Routers - Information Disclosure-7.5high390716
CVE-2019-5418Rails File Content Disclosurerails7.5high390719
CVE-2019-7254eMerge E3 1.00-06 - Local File Inclusionlinear_emerge_essential_firmware7.5high347009
CVE-2019-7315Genie Access WIP3BVAF IP Camera - Local File Inclusionwip3bvaf7.5high347009
CVE-2019-7481SonicWall SRA 4600 VPN - SQL Injectionsma_100_firmware7.5high340016
CVE-2019-9922Joomla! Harmis Messenger 1.2.2 - Local File Inclusionje_messenger7.5high347009
CVE-2020-10973WAVLINK - Access Controlwn530hg4_firmware7.5high390716
CVE-2020-11738WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusionduplicator7.5high344360, 347009
CVE-2020-12447Onkyo TX-NR585 Web Interface - Directory Traversaltx-nr585_firmware7.5high347009
CVE-2020-13158Artica Proxy Community Edition <4.30.000000 - Local File Inclusionartica_proxy7.5high347009
CVE-2020-13886Intelbras TIP 200/200 LITE/300 - Local File Inclusion-7.5high347009
CVE-2020-14864Oracle Fusion - Directory Traversal/Local File Inclusionbusiness_intelligence7.5high347009
CVE-2020-17519Apache Flink - Local File Inclusionflink7.5high390709
CVE-2020-19360FHEM 6.0 - Local File Inclusionfhem7.5high347009
CVE-2020-22165PHPGurukul Hospital Management System 4.0 - SQL Injectionhospital_management_system7.5HIGH380122
CVE-2020-23575Kyocera Printer d-COPIA253MF - Directory Traversald-copia253mf_plus_firmware7.5high347009
CVE-2020-24285INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusiontip2007.5high347009
CVE-2020-27191LionWiki <3.2.12 - Local File Inclusionlionwiki7.5high347009
CVE-2020-27467Processwire CMS <2.7.1 - Local File Inclusionprocesswire7.5high347009
CVE-2020-35580SearchBlox <9.2.2 - Local File Inclusionsearchblox7.5high347009
CVE-2020-35598Advanced Comment System 1.0 - Local File Inclusionadvanced_comment_system7.5high347009
CVE-2020-35736GateOne 1.1 - Local File Inclusiongateone7.5high347009
CVE-2020-5410Spring Cloud Config Server - Local File Inclusionspring_cloud_config7.5high390709
CVE-2020-5766SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injectionsrs_simple_hits_counter7.5HIGH380123
CVE-2020-8209Citrix XenMobile Server - Local File Inclusionxenmobile_server7.5high347009
CVE-2020-8982Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Readsharefile_storagezones_controller7.5high340007
CVE-2020-9483SkyWalking SQLIskywalking7.5HIGH341250
CVE-2021-20123Draytek VigorConnect 1.6.0-B - Local File Inclusionvigorconnect7.5high340007, 347009
CVE-2021-20124Draytek VigorConnect 6.0-B3 - Local File Inclusionvigorconnect7.5high347009
CVE-2021-24170User Profile Picture < 2.5.0 - Sensitive Information Disclosureuser_profile_picture7.5HIGH377360
CVE-2021-24227Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusionpatreon_wordpress7.5high347009
CVE-2021-24340WordPress Statistics <13.0.8 - Blind SQL Injectionwp_statistics7.5high380122
CVE-2021-24644Images to WebP < 1.9 - Authenticated Local File Inclusionimages_to_webp7.5HIGH377360
CVE-2021-25864Hue Magic 3.0.0 - Local File Inclusionhuemagic7.5high347009
CVE-2021-25899Void Aural Rec Monitor 9.0.0.1 - SQL Injectionaurall_rec_monitor7.5high380122
CVE-2021-27316Doctor Appointment System 1.0 - SQL Injectiondoctor_appointment_system7.5high380122
CVE-2021-27319Doctor Appointment System 1.0 - SQL Injectiondoctor_appointment_system7.5high380122
CVE-2021-27320Doctor Appointment System 1.0 - SQL Injectiondoctor_appointment_system7.5high380122
CVE-2021-3223Node RED Dashboard <2.26.2 - Local File Inclusionnode-red-dashboard7.5high347009
CVE-2021-32789WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injectionwoocommerce_blocks7.5HIGH360150
CVE-2021-33807Cartadis Gespage 8.2.1 - Directory Traversalgespage7.5high344360
CVE-2021-34805FAUST iServer 9.0.018.018.4 - Local File Inclusionfaust_iserver7.5high347019
CVE-2021-35250SolarWinds Serv-U 15.3 - Directory Traversalserv-u7.5high340007
CVE-2021-35380TermTalk Server 3.24.0.2 - Local File Inclusiontermtalk_server7.5high340007
CVE-2021-36748PrestaHome Blog for PrestaShop <1.7.8 - SQL Injectionblog7.5HIGH341245
CVE-2021-37589Virtua Software Cobranca 12S - SQLicobranca7.5HIGH340156
CVE-2021-39312WordPress True Ranker <2.2.4 - Local File Inclusiontrue_ranker7.5high344360
CVE-2021-39316WordPress DZS Zoomsounds <=6.50 - Local File Inclusionzoomsounds7.5high347009
CVE-2021-39433BIQS IT Biqs-drive v1.83 Local File Inclusionbiqsdrive7.5high347009
CVE-2021-40150Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosuree1_zoom_firmware7.5high390716
CVE-2021-40661IND780 - Local File Inclusionind780_firmware7.5high340007
CVE-2021-40822Geoserver - Server-Side Request Forgerygeoserver7.5HIGH340007
CVE-2021-40978MKdocs 1.2.2 - Directory Traversalmkdocs7.5high347009
CVE-2021-41277Metabase - Local File Inclusionmetabase7.5high340165, 347009
CVE-2021-41291ECOA Building Automation System - Directory Traversal Content Disclosureecs_router_controller-ecs_firmware7.5high347009
CVE-2021-41293ECOA Building Automation System - Arbitrary File Retrievalecs_router_controller-ecs_firmware7.5high392301
CVE-2021-41460ECShop 4.1.0 - SQL Injectionecshop7.5high340159
CVE-2021-41569SAS/Internet 9.4 1520 - Local File Inclusionsas/intrnet7.5high347009
CVE-2021-41648PuneethReddyHC action.php SQL Injectiononline-shopping-system-advanced7.5high392301
CVE-2021-41773Apache 2.4.49 - Path Traversal and Remote Code Executionhttp_server7.5high347009
CVE-2021-43287Pre-Auth Takeover of Build Pipelines in GoCDgocd7.5high347009
CVE-2021-43495AlquistManager Local File Inclusionalquist7.5high347009
CVE-2021-43496Clustering Local File Inclusionclustering7.5high347009
CVE-2021-43734kkFileview v4.0.0 - Local File Inclusionkkfileview7.5high340165, 347009
CVE-2021-43778GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.barcode7.5high347009
CVE-2021-43798Grafana v8.x - Arbitrary File Readgrafana7.5high347009
CVE-2021-45043HD-Network Realtime Monitoring System 2.0 - Local File Inclusionhd-network_real-time_monitoring_system7.5high344360
CVE-2021-46104webp_server_go 0.4.0 - Path Traversalwebp_server_go7.5high390709
CVE-2021-46107Ligeo Archives Ligeo Basics - Server Side Request Forgeryligeo_basics7.5high340162, 347009
CVE-2021-46381DLINK DAP-1620 A1 v1.01 - Directory Traversaldap-1620 firmware7.5HIGH344360, 390726, 392301, 392647
CVE-2021-46417Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)colibri firmware7.5HIGH347009
CVE-2021-46418Telesquare TLR-2855KS6 - Arbitrary File Creationtlr-2855ks67.5HIGH392301
CVE-2022-0656uDraw <3.3.3 - Local File Inclusionweb_to_print_shop\7.5high344360
CVE-2022-0666Microweber < 1.2.11 - CRLF Injectionmicroweber7.5high330708
CVE-2022-1119WordPress Simple File List <3.2.8 - Local File Inclusionsimple-file-list7.5high344360
CVE-2022-1768WordPress RSVPMaker <=9.3.2 - SQL Injectionrsvpmaker7.5high380122
CVE-2022-23347BigAnt Server v5.6.06 - Local File Inclusionbigant_server7.5high340007
CVE-2022-23854AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusionintouch_access_anywhere7.5high390716
CVE-2022-24124Casdoor 1.13.0 - Unauthenticated SQL Injectioncasdoor7.5HIGH341245
CVE-2022-24264Cuppa CMS v1.0 - SQL injectioncuppacms7.5high340016
CVE-2022-24265Cuppa CMS v1.0 - SQL injectioncuppacms7.5high380122
CVE-2022-24266Cuppa CMS v1.0 - SQL injectioncuppacms7.5high380122
CVE-2022-24716Icinga Web 2 - Arbitrary File Disclosureicinga_web_27.5high347009
CVE-2022-26233Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusioncontrol_room_management_suite7.5high347019
CVE-2022-2627174cmsSE v3.4.1 - Arbitrary File Read74cms7.5high340007
CVE-2022-27043Yearning - Directory Traversalyearning7.5high347009, 347019
CVE-2022-29014Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusionsila_firmware7.5high344360
CVE-2022-29298SolarView Compact 6.00 - Local File Inclusionsv-cpt-mc310_firmware7.5high347009
CVE-2022-31474BackupBuddy - Local File Inclusionbackupbuddy7.5high347009
CVE-2022-33901WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Readmultisafepay_plugin_for_woocommerce7.5high347009
CVE-2022-34121CuppaCMS v1.0 - Local File Inclusioncuppacms7.5high344360
CVE-2022-34127GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities pluginmanageentities7.5HIGH344360
CVE-2022-37122Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversalpcoweb_hvac_bacnet_gateway7.5high347009
CVE-2022-38794Zaver - Local File Inclusionzaver7.5high347009
CVE-2022-38840Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)man-eam-00037.5high344360
CVE-2022-4140WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Accesswelcart_e-commerce7.5high347009
CVE-2022-47501Apache OFBiz < 18.12.07 - Local File Inclusionofbiz7.5high340165, 347009
CVE-2023-0126SonicWall SMA1000 LFIsma10007.5high347009
CVE-2023-0159Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCEextensive_vc_addons_for_wpbakery_page_builder7.5high344360
CVE-2023-0905Employee Task Management System v1.0 - Broken Authenticationemployee task management system7.5HIGH350147
CVE-2023-22047Oracle Peoplesoft - Unauthenticated File Readpeoplesoft_enterprise7.5high340165, 347009
CVE-2023-23063Cellinx NVT Web Server - Local File Disclosurenvt_web_server7.5high347009
CVE-2023-2356Mlflow <2.3.0 - Local File Inclusionmlflow7.5HIGH340007
CVE-2023-26256STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusionstagil_navigation7.5high347009
CVE-2023-27639PrestaShop TshirteCommerce - Directory Traversalcustom_product_designer7.5high340007
CVE-2023-27640PrestaShop tshirtecommerce - Directory Traversalcustom_product_designer7.5high340007
CVE-2023-2766Weaver OA 9.5 - Information Disclosureweaver_office_automation7.5high390716
CVE-2023-29887Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusionspreadsheet-reader7.5high347009
CVE-2023-31059Repetier Server - Directory Traversalrepetier-server7.5high347019
CVE-2023-32235Ghost CMS < 5.42.1 - Path Traversalghost7.5high390703
CVE-2023-32590Subscribe to Category <= 2.7.4 - SQL Injectionsubscribe to category7.5HIGH380122
CVE-2023-33510Jeecg P3 Biz Chat - Local File Inclusionjeecg_p3_biz_chat7.5high347009
CVE-2023-34092Vite Dev Server - Information Exposure-7.5high390709
CVE-2023-34105SRS - Command Injectionsimple_realtime_server7.5HIGH344364
CVE-2023-34133SonicWall GMS and Analytics - SQL Injectionanalytics7.5high380123
CVE-2023-34843Traggo Server - Local File Inclusiontraggo7.5high347019
CVE-2023-35843NocoDB version <= 0.106.1 - Arbitrary File Readnocodb7.5high347009
CVE-2023-35844Lightdash version <= 0.510.3 Arbitrary File Readlightdash7.5high347009
CVE-2023-36284QloApps 1.6.0 - SQL Injectionqloapps7.5HIGH380122
CVE-2023-37474Copyparty <= 1.8.2 - Directory Traversalcopyparty7.5high347009
CVE-2023-38879openSIS v9.0 - Path Traversalopensis7.5high347009
CVE-2023-38950ZKTeco BioTime v8.5.5 - Path Traversalbiotime7.5high340007
CVE-2023-39026FileMage Gateway - Directory Traversalwindows7.5high347019
CVE-2023-39141Aria2 WebUI - Path traversalwebui-aria27.5high347009
CVE-2023-40279OpenClinic GA 5.247.01 - Path Traversal (Authenticated)openclinic ga7.5HIGH390727, 392301, 392648
CVE-2023-40924SolarView Compact < 6.00 - Directory Traversalsolarview_compact_firmware7.5high347009
CVE-2023-43261Milesight Routers - Information Disclosureur517.5high390716
CVE-2023-48241XWiki < 4.10.15 - Information Disclosurexwiki7.5high390722
CVE-2023-6020Ray Static File - Local File Inclusionray7.5high347009
CVE-2023-6023VertaAI ModelDB - Path Traversalmodeldb7.5high347009
CVE-2023-6038H2O ImportFiles - Local File Inclusionh2o7.5high344360, 347009
CVE-2023-6063WP Fastest Cache 1.2.2 - Unauthenticated SQL Injectionwp fastest cache7.5HIGH380122
CVE-2023-6567LearnPress <= 4.2.5.7 - SQL Injectionlearnpress7.5high380122
CVE-2023-6909Mlflow <2.9.2 - Path Traversalmlflow7.5high392301
CVE-2023-6977Mlflow <2.8.0 - Local File Inclusionmlflow7.5high344360
CVE-2024-0705Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injectionstripe payment plugin for woocommerce7.5HIGH380122
CVE-2024-11303Korenix JetPort 5601v3 - Path Traversaljetport_56017.5high347009
CVE-2024-12008W3 Total Cache < 2.8.2 - Log File Exposurew3-total-cache7.5HIGH390716
CVE-2024-12025WordPress Collapsing Categories <= 3.0.8 - SQL Injection-7.5high380122
CVE-2024-12849Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Readerror-log-viewer-wp7.5HIGH344360
CVE-2024-13322Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection-7.5high380122
CVE-2024-1483Mlflow < 2.9.2 - Path Traversalmlflow7.5HIGH340007
CVE-2024-1561Gradio 4.3-4.12 - Local File Readgradio7.5HIGH344365
CVE-2024-1728Gradio > 4.19.1 UploadButton - Path Traversalgradio7.5HIGH344360
CVE-2024-20440Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials-7.5high390716
CVE-2024-23334aiohttp - Directory Traversalaiohttp7.5high347009
CVE-2024-26291Avid NEXIS Agent - Arbitrary File Readnexis7.5high347009
CVE-2024-27292Docassemble - Local File Inclusion-7.5high347009
CVE-2024-2879WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injectionlayerslider7.5HIGH380122
CVE-2024-28995SolarWinds Serv-U - Directory Traversalserv-u7.5high340007, 347019
CVE-2024-2928MLflow < 2.11.3 - Path Traversalmlflow7.5HIGH340007
CVE-2024-32736CyberPower < v2.8.3 - SQL Injection-7.5high340016
CVE-2024-32737CyberPower - SQL Injection-7.5high340016
CVE-2024-32738CyberPower - SQL Injection-7.5high340016
CVE-2024-32739CyberPower < v2.8.3 - SQL Injection-7.5high340016
CVE-2024-36420Flowise 1.4.3 - Arbitrary File Readflowise7.5HIGH344360
CVE-2024-36991Splunk Enterprise - Local File Inclusionsplunk7.5HIGH390716
CVE-2024-3848Mlflow < 2.11.0 - Path Traversalmlflow7.5HIGH340007
CVE-2024-38816WebMvc.fn/WebFlux.fn - Path Traversal-7.5high347009
CVE-2024-38819Spring Framework Path Traversal in Functional Web Frameworksspring_framework7.5high347009
CVE-2024-41628Cluster Control CMON API - Directory Traversalcluster_control7.5HIGH347009
CVE-2024-45241CentralSquare CryWolf - Path Traversalcrywolf7.5high340007
CVE-2024-45293TablePress < 2.4.3 - XXE Injectiontablepress7.5HIGH377360
CVE-2024-45388Hoverfly < 1.10.3 - Arbitrary File Read-7.5high344360
CVE-2024-46938Sitecore Experience Platform <= 10.4 - Arbitrary File Readexperience_commerce7.5HIGH340007, 347019
CVE-2024-4956Sonatype Nexus Repository Manager 3 - Local File Inclusionnexus7.5high347009
CVE-2024-5334Devika - Local File Inclusion-7.5high347009
CVE-2024-6049Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal-7.5HIGH390716
CVE-2024-6250LOLLMS WebUI - Absolute Path Traversallollms_web_ui7.5high392301
CVE-2024-6587LiteLLM - Server-Side Request Forgerylitellm7.5HIGH340162
CVE-2024-6893Journyx - XML External Entities Injection (XXE)journyx-jtime7.5high344360
CVE-2024-8484REST API TO MiniProgram <= 4.7.1 - SQL Injectionrest-api-to-miniprogram7.5HIGH380122
CVE-2024-8522LearnPress < 4.2.7.1 - SQL Injectionlearnpress7.5critical380122
CVE-2024-8529LearnPress < 4.2.7.1 - SQL Injectionlearnpress7.5HIGH380122
CVE-2024-8752WebIQ 2.15.9 - Directory Traversalwebiq7.5high347019
CVE-2024-9362Polyaxon - Unauthenticated Directory Traversal-7.5HIGH347009
CVE-2024-9935PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Downloadpdf-generator-addon-for-elementor-page-builder7.5HIGH347009
CVE-2025-10162WordPress OrderConvo < 14 - Path Traversal-7.5high344360
CVE-2025-12055MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal-7.5high344365
CVE-2025-13339Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Readhippoo-mobile-app-for-woocommerce7.5HIGH344360, 347009
CVE-2025-13801Yoco Payments <= 3.8.8 - Path Traversal-7.5HIGH347009
CVE-2025-14437WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log Filehummingbird-performance7.5high390716
CVE-2025-2011Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection-7.5high340016
CVE-2025-24799GLPI < 10.0.17 - Pre-Auth SQL InjectionGLPI7.5critical380122
CVE-2025-27817Apache Kafka Client - Arbitrary File Readkafka7.5HIGH344360
CVE-2025-30208Vite - Arbitrary File Readvite7.5HIGH347009
CVE-2025-30567WordPress WP01 - Path Traversalwp017.5high390709
CVE-2025-34023Karel IP Phone IP1211 Web Management Panel - Local File Inclusion-7.5high347009
CVE-2025-34031Moodle Jmol Filter 6.1 - Local File Inclusion-7.5high347009
CVE-2025-4008MeteoBridge <= 6.1 - Remote Code Execution-7.5high393655
CVE-2025-4396Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection-7.5high380122
CVE-2025-44137MapTiler Tileserver-php v2.0 - Unauthenticated File Read-7.5high347009
CVE-2025-47445WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File DownloadArraytics Eventin wp-event-solution7.5high347009
CVE-2025-5287Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection-7.5high380122
CVE-2025-54726WordPress JS Archive List <= 6.1.5 - SQL InjectionMiguel Useche JS Archive List jquery-archive-list-widget7.5high380122
CVE-2025-55523Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download-7.5high347009
CVE-2025-55748XWiki Platform - Path Traversal-7.5high340007
CVE-2025-59049Mockoon < 9.2.0 - Path Traversalmockoon7.5high347009
CVE-2025-61884Oracle E-Business Suite - Server-Side Request Forgery-7.5high342259
CVE-2025-66744Yonyou YonBIP - Path Traversal-7.5high340007
CVE-2025-69411ionCube Tester Plus <= 1.3 - Local File Inclusionioncube-tester-plus7.5HIGH347009
CVE-2026-0560LolLMS < 2.2.0 - Server-Side Request Forgerylollms7.5HIGH360151
CVE-2026-1557WP Responsive Images <= 1.0 - Arbitrary File Read-7.5high344360
CVE-2026-1581wpForo Forum <= 2.4.14 - SQL Injection-7.5critical380122
CVE-2026-2413Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection-7.5high380122
CVE-2026-2416Geo Mashup <= 1.13.17 - SQL Injection-7.5HIGH380122
CVE-2026-28414Gradio - Absolute Path Traversalgradio7.5HIGH390716
CVE-2026-3018WordPress Newsletters <= 4.13 - Unauthenticated SQL Injectionnewsletters7.5HIGH380122
CVE-2026-3396WCAPF WooCommerce Ajax Product Filter - SQL Injection-7.5HIGH380122
CVE-2026-39364Vite Dev Server - Directory Traversal-7.5high390709
CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Readw3-total-cache7.5HIGH344360
CVE-2017-15643Ikraus Anti Virus 2.16.7 - Remote Code Executionikarus antivirus7.4HIGH390727, 392301, 392648
CVE-2017-9355Subsonic 6.1.1 - XML External Entity Injectionsubsonic7.4HIGH390726, 392301, 392647
CVE-2024-11740Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Executiondownload_manager7.3high344370
CVE-2024-33288Prison Management System - SQL Injection Authentication Bypassprison_management_system7.3HIGH341245
CVE-2024-36683PrestaShop productsalert - SQL Injectionthe module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop7.3HIGH380122
CVE-2024-46507Yeti Platform < 2.1.12 - Server-Side Template Injection to RCEyeti7.3HIGH340130
CVE-2024-48259Cloudlog - SQL Injectioncloudlog7.3high340016
CVE-2024-7188Bylancer Quicklancer 2.4 G - SQL Injectionquicklancer7.3high380122
CVE-2025-10090Jinher OA - SQL Injection-7.3high344366, 361149
CVE-2025-14340Payara Server - Cross-Site Scripting-7.3HIGH341266
CVE-2026-6433FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Executioncustom-css-js-php7.3HIGH340016
CVE-2015-4027Acunetix WVS 10 - Local Privilege Escalationweb vulnerability scanner7.2HIGH390726, 392647
CVE-2016-10940WordPress zm-gallery plugin 1.0 SQL Injectionzm-gallery7.2high340017
CVE-2018-1002000WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter7.2HIGH380122, 390726, 392647
CVE-2018-10735NagiosXI <= 5.4.12 commandline.php SQL injectionnagios_xi7.2high340016
CVE-2018-10736NagiosXI <= 5.4.12 - SQL injectionnagios_xi7.2high340016
CVE-2018-10737NagiosXI <= 5.4.12 logbook.php SQL injectionnagios_xi7.2high340155
CVE-2018-10738NagiosXI <= 5.4.12 menuaccess.php - SQL injectionnagios_xi7.2high340155
CVE-2019-16996Metinfo 7.0.0 beta - SQL Injectionmetinfo7.2high340016
CVE-2019-16997Metinfo 7.0.0 beta - SQL Injectionmetinfo7.2high340016
CVE-2019-17418MetInfo 7.0.0 beta - SQL Injectionmetinfo7.2high340016
CVE-2019-18396Technicolor TD5130.2 - Remote Command Executiontd5130v2 firmware7.2HIGH344361
CVE-2019-1936Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilitiesintegrated management controller supervisor7.2HIGH350147, 390724, 390727, 392301, 392648
CVE-2019-2767Oracle Business Intelligence Publisher - XML External Entity Injectionbi_publisher7.2high380018
CVE-2019-9041ZZZCMS 1.6.1 - Remote Code Executionzzzphp7.2high380026
CVE-2020-14883Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Executionweblogic_server7.2high380026
CVE-2020-20969PluckCMS 4.7.10 - Unrestricted File Uploadpluck7.2HIGH390727, 392301, 392648
CVE-2021-24145WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Uploadmodern_events_calendar_lite7.2high382238
CVE-2021-24155WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Uploadbackup_guard7.2HIGH377360
CVE-2021-24554WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injectionpaytm-pay7.2high380122
CVE-2021-24627G Auto-Hyperlink <= 1.0.1 - SQL Injectiong_auto-hyperlink7.2high340017
CVE-2021-24786Download Monitor < 4.4.5 - SQL Injectiondownload_monitor7.2high380122
CVE-2021-24791Header Footer Code Manager < 1.1.14 - Admin+ SQL Injectionheader_footer_code_manager7.2high380122
CVE-2021-24862WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injectionregistrationmagic7.2high380122
CVE-2021-24970WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusionall-in-one_video_gallery7.2HIGH377360
CVE-2021-30203Dzzoffice 2.02.1 - Cross-Site Scriptingdzzoffice7.2high333141
CVE-2021-33544Geutebruck - Remote Command Injectiong-cam_ebc-21107.2high393655
CVE-2021-39411Hospital Management System 1.0 - Cross-Site Scriptinghospital_management_system7.2high340147
CVE-2022-0228Popup Builder < 4.0.7 - SQL Injectionpopup_builder7.2high380122
CVE-2022-2219Unyson < 2.7.27 - Cross Site Scriptingunyson7.2high341266
CVE-2022-29316Complete Online Job Search System 1.0 - Cross-Site Scripting-7.2high340147
CVE-2022-31974Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system7.2high340016
CVE-2022-31975Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system7.2high340016
CVE-2022-31984Online Fire Reporting System v1.0 - SQL injectiononline_fire_reporting_system7.2high340016
CVE-2022-32007Complete Online Job Search System 1.0 - SQL Injectioncomplete_online_job_search_system7.2high340016
CVE-2022-32015Complete Online Job Search System 1.0 - SQL Injectioncomplete_online_job_search_system7.2high340016
CVE-2022-32018Complete Online Job Search System 1.0 - SQL Injectioncomplete_online_job_search_system7.2high340016
CVE-2022-32022Car Rental Management System 1.0 - SQL Injectioncar_rental_management_system7.2high340156
CVE-2022-32024Car Rental Management System 1.0 - SQL Injectioncar_rental_management_system7.2high340016
CVE-2022-32025Car Rental Management System 1.0 - SQL Injectioncar_rental_management_system7.2high340016
CVE-2022-32026Car Rental Management System 1.0 - SQL Injectioncar_rental_management_system7.2high340016
CVE-2022-32028Car Rental Management System 1.0 - SQL Injectioncar_rental_management_system7.2high340016
CVE-2022-34590Hospital Management System 1.0 - SQL Injectionhospital_management_system7.2high340145
CVE-2023-0669Fortra GoAnywhere MFT - Remote Code Executiongoanywhere_managed_file_transfer7.2high344370
CVE-2023-0900AP Pricing Tables Lite <= 1.1.6 - SQL Injectionpricing_table_builder7.2HIGH377360
CVE-2023-1211phpIPAM 1.5.1 - SQL Injectionphpipam7.2HIGH380122
CVE-2023-1408Video List Manager <= 1.7 - SQL Injectionvideo_list_manager7.2high380122
CVE-2023-33439Faculty Evaluation System v1.0 - SQL Injectionfaculty_evaluation_system7.2high340159
CVE-2023-33629H3C Magic R300-2100M - Remote Code Executionmagic_r300-2100m_firmware7.2high392301
CVE-2023-47873WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Uploadwp_child_theme_generator7.2HIGH377360
CVE-2025-29635D-Link DIR-823X set_prohibiting - Command Injectiondir-823x_firmware7.2HIGH340014
CVE-2025-32813Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_requestnetmri7.2high393655
CVE-2025-5961WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Uploadmigration, backup, staging7.2HIGH377360
CVE-2019-10717BlogEngine.NET 3.3.7.0 - Local File Inclusionblogengine.net7.1HIGH340007
CVE-2019-25246BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosuren100_h.264_vga_ip_camera7.1HIGH347009
CVE-2022-35507Proxmox - CRLF Injectionproxmox_mail_gateway7.1high390714
CVE-2024-10152Simple Certain Time to Show Content - Cross-Site Scriptingsimple_certain_time_to_show_content7.1HIGH377360
CVE-2024-11921Give WP Plugin < 3.19.0 - Cross-Site Scripting-7.1high341266
CVE-2024-12638Bulk Me Now! Plugin <= 2.0 - Cross-Site Scriptingbulk_me_now7.1HIGH377360
CVE-2024-12749WordPress Competition Form Plugin <= 2.0 - Cross-Site Scriptingcompetition_form7.1HIGH377360
CVE-2024-12878Lazy Blocks <= 3.8.2 - Cross-Site Scriptinglazy blocks7.1HIGH377360
CVE-2024-13055Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scriptingdyn_business_panel7.1HIGH377360
CVE-2024-13094WP Triggers Lite - Cross-Site Scriptingwp_triggers_lite7.1HIGH377360
CVE-2024-13330JustRows WordPress - Cross-Site Scriptingjustrows_free7.1HIGH377360
CVE-2024-13569WordPress Front End Users - Reflected XSSfront_end_users7.1HIGH377360
CVE-2024-13624WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scriptingwpmovielibrary7.1HIGH341266, 377360
CVE-2024-35694Wordpress WPMobile.App >= 11.42 - Cross-Site Scriptingwpmobile.app7.1high341266
CVE-2024-41357phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)phpipam7.1HIGH340147
CVE-2019-6793GitLab Enterprise Edition - Server-Side Request Forgerygitlab7.0high390616
CVE-2018-3238Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scriptingwebcenter_sites6.9medium341266
CVE-2024-10758NEWS-BUZZ News Management System 1.0 - SQL Injectionnews-buzz6.9MEDIUM380122
CVE-2024-9474PAN-OS Management Web Interface - Command Injectionpan-os6.9MEDIUM344363
CVE-2025-5298Campcodes Online Hospital Management System 1.0 - SQL Injectiononline hospital management system6.9MEDIUM390726, 392647
CVE-2025-62613VDO.Ninja - DOM-Based Cross-Site Scripting-6.9MEDIUM347198
CVE-2026-29059Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversalwindmill6.9MEDIUM347009
CVE-2004-0519SquirrelMail 1.4.x - Folder Name Cross-Site Scriptingpropack6.8MEDIUM341266
CVE-2007-0885Jira Rainbow.Zen - Cross-Site Scriptingrainbow.zen6.8MEDIUM341266
CVE-2007-4556OpenSymphony XWork/Apache Struts2 - Remote Code Executionxwork6.8MEDIUM344360
CVE-2008-2650CMSimple 3.1 - Local File Inclusioncmsimple6.8MEDIUM347009
CVE-2008-6172Joomla! Component RWCards 3.0.11 - Local File Inclusionrwcards6.8MEDIUM347009
CVE-2009-3053Joomla! Agora 3.0.0b - Local File Inclusionjoomla6.8MEDIUM347009
CVE-2010-1056Joomla! Component com_rokdownloads - Local File Inclusioncom_rokdownloads6.8MEDIUM347009
CVE-2010-1219Joomla! Component com_janews - Local File Inclusioncom_janews6.8MEDIUM347009
CVE-2010-1469Joomla! Component JProject Manager 1.0 - Local File Inclusioncom_jprojectmanager6.8MEDIUM347009
CVE-2010-1473Joomla! Component Advertising 0.25 - Local File Inclusioncom_advertising6.8MEDIUM347009
CVE-2010-1474Joomla! Component Sweetykeeper 1.5 - Local File Inclusioncom_sweetykeeper6.8MEDIUM347009
CVE-2010-1475Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusioncom_preventive6.8MEDIUM347009
CVE-2010-1476Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusioncom_alphauserpoints6.8MEDIUM347009
CVE-2010-1478Joomla! Component Jfeedback 1.2 - Local File Inclusioncom_jfeedback6.8MEDIUM347009
CVE-2010-1607Joomla! Component WMI 1.5.0 - Local File Inclusioncom_wmi6.8MEDIUM347009
CVE-2010-1715Joomla! Component Online Exam 1.5.0 - Local File Inclusioncom_onlineexam6.8MEDIUM347009
CVE-2010-1718Joomla! Component Archery Scores 1.0.6 - Local File Inclusioncom_archeryscores6.8MEDIUM347009
CVE-2010-1719Joomla! Component MT Fire Eagle 1.2 - Local File Inclusioncom_mtfireeagle6.8MEDIUM347009
CVE-2010-1722Joomla! Component Online Market 2.x - Local File Inclusioncom_market6.8MEDIUM347009
CVE-2010-1723Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusioncom_drawroot6.8MEDIUM347009
CVE-2010-1979Joomla! Component Affiliate Datafeeds 880 - Local File Inclusioncom_datafeeds6.8MEDIUM347009
CVE-2010-1981Joomla! Component Fabrik 2.0 - Local File Inclusionfabrik6.8MEDIUM347009
CVE-2010-2122Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrievalcom_simpledownload6.8MEDIUM347009
CVE-2010-2507Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusioncom_picasa2gallery6.8MEDIUM347009
CVE-2010-2680Joomla! Component jesectionfinder - Local File Inclusioncom_jesectionfinder6.8MEDIUM347009
CVE-2010-2857Joomla! Component Music Manager - Local File Inclusioncom_music6.8MEDIUM347009
CVE-2010-2920Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusioncom_foobla_suggestions6.8MEDIUM347009
CVE-2010-4617Joomla! Component JotLoader 2.2.1 - Local File Inclusioncom_jotloader6.8medium347009
CVE-2011-2744Chyrp 2.x - Local File Inclusionchyrp6.8medium347009
CVE-2011-4449WikkaWiki 1.3.2 - Multiple Vulnerabilitieswikkawiki6.8MEDIUM344360, 390715, 390726, 392647
CVE-2011-4452WikkaWiki 1.3.2 - Multiple Vulnerabilitieswikkawiki6.8MEDIUM344360, 390715, 390726, 392647
CVE-2012-0286stoneware webnetwork6 - Multiple Vulnerabilitieswebnetwork6.8MEDIUM390726, 392301, 392647
CVE-2012-0392Apache Struts2 S2-008 RCEstruts6.8medium347009
CVE-2012-3350Webmatic 3.1.1 - Blind SQL Injectionwebmatic6.8MEDIUM390727, 392301, 392648
CVE-2014-0864IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits6.8MEDIUM392301
CVE-2014-2383Dompdf < v0.6.0 - Local File Inclusiondompdf6.8medium347009
CVE-2014-3120ElasticSearch v1.1.1/1.2 RCEelasticsearch6.8medium344360
CVE-2015-2755WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scriptingab_google_map_travel6.8MEDIUM377360
CVE-2015-5161eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injectionzend framework6.8MEDIUM390727, 392301, 392648
CVE-2012-1258Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilitiesscrutinizer netflow &amp; sflow analyzer6.5MEDIUM341266, 390727, 392301, 392648
CVE-2012-4240Group Office Calendar - '/calendar/json.php' SQL Injectiongroupoffice6.5MEDIUM340016
CVE-2013-4861MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware6.5MEDIUM390726, 392647
CVE-2013-4865MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware6.5MEDIUM390726, 392647
CVE-2014-7176Enalean Tuleap 7.4.99.5 - Blind SQL Injectiontuleap6.5MEDIUM390726, 392301, 392647
CVE-2015-4062WordPress NewStatPress 0.9.8 - SQL Injectionnewstatpress6.5medium380122
CVE-2017-14537Trixbox 2.8.0 - Path Traversaltrixbox6.5medium344360, 347009
CVE-2017-3546Oracle PeopleSoft - Server-Side Request Forgerypeoplesoft enterprise peopletools6.5MEDIUM390727, 392301, 392648
CVE-2017-6338Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilitiesinterscan web security virtual appliance6.5MEDIUM340147, 390724
CVE-2017-6339Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilitiesinterscan web security virtual appliance6.5MEDIUM340147, 390724
CVE-2017-9416Odoo 8.0/9.0/10.0 - Local File Inclusionodoo6.5medium347009
CVE-2018-15140OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actionsopenemr6.5MEDIUM344360, 344370
CVE-2018-15141OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actionsopenemr6.5MEDIUM344360, 344370
CVE-2018-18809TIBCO JasperReports Library - Directory Traversaljasperreports_library6.5medium340007
CVE-2018-3714node-srv - Local File Inclusionnode-srv6.5medium347009
CVE-2018-5404KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilitieskace systems management appliance firmware6.5MEDIUM390727, 392301, 392648
CVE-2018-7690Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosurefortify software security center6.5MEDIUM390727, 392301, 392648
CVE-2018-7691Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2)fortify software security center6.5MEDIUM330791
CVE-2018-9038Monstra CMS 3.0.4 - Arbitrary Folder Deletionmonstra6.5MEDIUM390727, 392301, 392648
CVE-2019-11013Nimble Streamer <=3.5.4-9 - Local File Inclusionnimble_streamer6.5medium347009
CVE-2019-12616phpMyAdmin 4.8 - Cross-Site Request Forgeryphpmyadmin6.5MEDIUM390727, 392301, 392648
CVE-2019-14312Aptana Jaxer 1.0.3.4547 - Local File inclusionjaxer6.5medium347009
CVE-2019-3778Spring Security OAuth - Open Redirectorspring security oauth6.5MEDIUM390703, 390727, 392648
CVE-2019-3799Spring Cloud Config Server - Local File Inclusionspring_cloud_config6.5medium347009
CVE-2019-7439JioFi 4G M2S 1.0.2 - Denial of Servicejiofi 4g m2s firmware6.5MEDIUM340147
CVE-2020-13945Apache APISIX - Insufficiently Protected Credentialsapisix6.5MEDIUM380026
CVE-2020-5405Spring Cloud Config - Local File Inclusionspring_cloud_config6.5medium390709
CVE-2020-6950Eclipse Mojarra - Local File Readmojarra6.5medium340007
CVE-2020-8615Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgerytutor_lms6.5MEDIUM377360
CVE-2021-21402Jellyfin <10.7.0 - Local File Inclusionjellyfin6.5medium347019
CVE-2021-22145Elasticsearch 7.10.0-7.13.3 - Information Disclosureelasticsearch6.5MEDIUM330791
CVE-2021-24405WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSSeasy cookies policy6.5MEDIUM390585, 390726, 392647
CVE-2021-24947WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Readresponsive_vector_maps6.5medium347009
CVE-2021-27124Doctor Appointment System 1.0 - SQL Injectiondoctor_appointment_system6.5medium340016
CVE-2021-28149Hongdian H8922 3.0.5 Devices - Local File Inclusionh8922_firmware6.5medium347009
CVE-2021-29006rConfig 3.9.6 - Local File Inclusionrconfig6.5medium347009
CVE-2021-31195Microsoft Exchange Server - Cross-Site Scriptingexchange_server6.5medium350148
CVE-2021-31249CHIYU TCP/IP Converter - Carriage Return Line Feed Injectionbf-430_firmware6.5medium341266
CVE-2021-34369Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)civic platform6.5MEDIUM390727, 392301, 392648
CVE-2021-36749Apache Druid - Local File Inclusiondruid6.5MEDIUM344360
CVE-2021-39165Cachet <=2.3.18 - SQL Injectioncachet6.5medium380122
CVE-2021-40651OS4Ed OpenSIS Community 8.0 - Local File Inclusionopensis6.5medium347009
CVE-2021-41349Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scriptingexchange_server6.5medium340147
CVE-2022-1398External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgeryexternal_media_without_import6.5MEDIUM377360
CVE-2022-34125GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugincmdb6.5MEDIUM344360
CVE-2022-37299Shirne CMS 1.2.0 - Local File Inclusionshirne_cms6.5medium347009
CVE-2022-38812AeroCMS 0.1.1 - SQL Injectionaerocms6.5medium340016
CVE-2022-40734Laravel Filemanager v2.5.1 - Local File Inclusionlaravel_filemanager6.5medium340007
CVE-2023-27167Suprema BioStar 2 v2.8.16 - SQL Injectionbiostar 26.5MEDIUM330791
CVE-2023-3188Owncast - Server Side Request Forgeryowncast6.5medium392301
CVE-2023-3345LMS by Masteriyo < 1.6.8 - Information Exposuremasteriyo6.5MEDIUM377360
CVE-2023-45826Leantime < 2.4 - Authenticated SQL Injectionleantime6.5MEDIUM390726
CVE-2024-24565CrateDB Database - Arbitrary File Readcratedb6.5MEDIUM340016, 344360
CVE-2024-4257BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injectionclinical browsing system6.5MEDIUM341245
CVE-2024-55457MasterSAM Star Gate v11 - Local File Inclusion-6.5high347009
CVE-2024-9765EKC Tournament Manager WordPress plugin - Path Traversalekc_tournament_manager6.5MEDIUM377360
CVE-2025-13652WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injectioncbx-bookmark-favorite6.5MEDIUM377360
CVE-2025-28367mojoPortal <=2.9.0.1 - Directory Traversal-6.5medium344360
CVE-2025-32430XWiki Platform - Cross-Site Scriptingxwiki-platform6.5medium347198
CVE-2025-32815NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentialsnetmri6.5medium344360
CVE-2025-4388Liferay Portal - Cross-Site Scripting-6.5medium347198
CVE-2025-53771Microsoft SharePoint Server - Authentication Bypass (ToolShell)-6.5medium350147
CVE-2025-54249Adobe Experience Manager ≤ 6.5.23.0 – SSRFexperience_manager6.5MEDIUM390726
CVE-2025-55911ClipBucket 5.5.2 Buildclipbucket6.5MEDIUM340162
CVE-2025-61224DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scriptingdokuwiki6.5MEDIUM333141
CVE-2000-0760Jakarta Tomcat 3.1 and 3.0 - Information Disclosuretomcat6.4MEDIUM310094
CVE-2009-0932Horde/Horde Groupware - Local File Inclusionhorde6.4MEDIUM390614
CVE-2011-4450WikkaWiki 1.3.2 - Multiple Vulnerabilitieswikkawiki6.4MEDIUM344360, 390715, 390726, 392647
CVE-2012-3153Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)fusion_middleware6.4medium340165
CVE-2012-4940Axigen Mail Server Filename Directory Traversalaxigen_free_mail_server6.4medium347019
CVE-2025-13418Responsive Pricing Table <= 5.1.12 - Cross-Site Scriptingresponsive-pricing-table6.4MEDIUM377360
CVE-2017-9640Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Writei-vu6.3MEDIUM390727, 392301, 392648
CVE-2024-11305Altenergy Power Control Software - SQL Injectionenergy_communication_unit_firmware6.3medium340016
CVE-2024-2330NS-ASG Application Security Gateway 6.3 - Sql Injection-6.3medium340157
CVE-2024-2621Fujian Kelixin Communication - Command Injection-6.3medium380122
CVE-2024-32231Stash < 0.26.0 - SQL Injectionstash6.3MEDIUM340016
CVE-2024-7120Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection-6.3medium344363
CVE-2024-7801Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injectiontimeprovider 4100 firmware6.3MEDIUM392301
CVE-2025-10210ChanCMS <= 3.3.0 - SQL Injection-6.3medium340159
CVE-2025-54589Copyparty <=1.18.6 - Cross-Site Scriptingcopyparty6.3medium341266
CVE-2025-11371Gladinet CentreStack & TrioFox - Local File Inclusion-6.2medium347019
CVE-2026-29066TinaCMS - Path Traversaltinacms6.2MEDIUM347009
CVE-2011-4336Tiki Wiki CMS Groupware 7.0 Cross-Site Scriptingtikiwiki_cms/groupware6.1medium341266
CVE-2012-1260Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilitiesscrutinizer netflow &amp; sflow analyzer6.1MEDIUM341266, 390727, 392301, 392648
CVE-2012-1261Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilitiesscrutinizer netflow &amp; sflow analyzer6.1MEDIUM341266, 390727, 392301, 392648
CVE-2012-5193Bitweaver 2.8.1 - Multiple Vulnerabilitiesbitweaver6.1MEDIUM340147, 380026
CVE-2013-2679Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware6.1MEDIUM392301
CVE-2013-2684Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware6.1MEDIUM392301
CVE-2014-100004Sitecore CMS - Cross-Site Scriptingsitecore.net6.1medium347198
CVE-2014-4535Import Legacy Media <= 0.1 - Cross-Site Scriptingimport_legacy_media6.1MEDIUM341266
CVE-2014-4536Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scriptinginfusionsoft_gravity_forms6.1MEDIUM341266
CVE-2014-4539Movies <= 0.6 - Cross-Site Scriptingmovies6.1MEDIUM341266
CVE-2014-4544Podcast Channels < 0.28 - Cross-Site Scriptingpodcast_channels6.1medium341266
CVE-2014-4550Shortcode Ninja <= 1.4 - Cross-Site Scriptingninja6.1MEDIUM341266
CVE-2014-4558WooCommerce Swipe <= 2.7.1 - Cross-Site Scriptingswipehq-payment-gateway-woocommerce6.1MEDIUM341266
CVE-2014-4561Ultimate Weather Plugin <= 1.0 - Cross-Site Scriptingultimate-weather6.1MEDIUM341266
CVE-2014-4592WP Planet <= 0.1 - Cross-Site Scriptingwp-planet6.1medium341266
CVE-2014-9606Netsweeper 4.0.8 - Cross-Site Scriptingnetsweeper6.1medium341266
CVE-2014-9607Netsweeper 4.0.4 - Cross-Site Scriptingnetsweeper6.1medium341266
CVE-2014-9608Netsweeper 4.0.3 - Cross-Site Scriptingnetsweeper6.1medium341266
CVE-2014-9615Netsweeper 4.0.4 - Cross-Site Scriptingnetsweeper6.1medium341266
CVE-2015-4668Xceedium Xsuite - Multiple Vulnerabilitiesxsuite6.1MEDIUM344360, 347198, 390726, 392647
CVE-2015-6544Combodo iTop <2.2.0-2459 - Cross-Site Scriptingitop6.1medium341266
CVE-2015-8349SourceBans <2.0 - Cross-Site Scriptingsourcebans6.1medium341266
CVE-2015-8350WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSScall_to_action6.1MEDIUM377360
CVE-2015-9312NewStatPress <=1.0.4 - Cross-Site Scriptingnewstatpress6.1medium347198
CVE-2015-9414WordPress Symposium <=15.8.1 - Cross-Site Scriptingwp-symposium6.1MEDIUM341266
CVE-2016-1000126WordPress Admin Font Editor <=1.8 - Cross-Site Scriptingadmin-font-editor6.1MEDIUM341266
CVE-2016-1000127WordPress AJAX Random Post <=2.00 - Cross-Site Scriptingajax-random-post6.1MEDIUM341266
CVE-2016-1000128WordPress anti-plagiarism <=3.60 - Cross-Site Scriptinganti-plagiarism6.1MEDIUM341266
CVE-2016-1000129WordPress defa-online-image-protector <=3.3 - Cross-Site Scriptingdefa-online-image-protector6.1MEDIUM341266
CVE-2016-1000130WordPress e-search <=1.0 - Cross-Site Scriptinge-search6.1MEDIUM341266
CVE-2016-1000131WordPress e-search <=1.0 - Cross-Site Scriptingesearch6.1MEDIUM341266
CVE-2016-1000132WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scriptingtooltip_glossary6.1MEDIUM341266
CVE-2016-1000133WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scriptingforget_about_shortcode_buttons6.1MEDIUM341266
CVE-2016-1000134WordPress HDW Video Gallery <=1.2 - Cross-Site Scriptinghdw-tube6.1MEDIUM341266
CVE-2016-1000135WordPress HDW Video Gallery <=1.2 - Cross-Site Scriptinghdw-tube6.1MEDIUM341266
CVE-2016-1000136WordPress heat-trackr 1.0 - Cross-Site Scriptingheat-trackr6.1MEDIUM341266
CVE-2016-1000137WordPress Hero Maps Pro 2.1.0 - Cross-Site Scriptinghero-maps-pro6.1MEDIUM341266
CVE-2016-1000138WordPress Admin Font Editor <=1.8 - Cross-Site Scriptingindexisto6.1MEDIUM341266
CVE-2016-1000139WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scriptinginfusionsoft6.1MEDIUM341266
CVE-2016-1000140WordPress New Year Firework <=1.1.9 - Cross-Site Scriptingnew-year-firework6.1MEDIUM341266
CVE-2016-1000141WordPress Page Layout builder v1.9.3 - Cross-Site Scriptingpage-layout-builder6.1MEDIUM341266
CVE-2016-1000142WordPress MW Font Changer <=4.2.5 - Cross-Site Scriptingparsi-font6.1MEDIUM341266
CVE-2016-1000143WordPress Photoxhibit 2.1.8 - Cross-Site Scriptingphotoxhibit6.1MEDIUM341266
CVE-2016-1000146WordPress Pondol Form to Mail <=1.1 - Cross-Site Scriptingpondol-formmail6.1MEDIUM341266
CVE-2016-1000148WordPress S3 Video <=0.983 - Cross-Site Scriptings3-video6.1MEDIUM341266
CVE-2016-1000149WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scriptingsimpel-reserveren6.1MEDIUM341266
CVE-2016-1000152WordPress Tidio-form <=1.0 - Cross-Site Scriptingtidio-form6.1MEDIUM341266
CVE-2016-1000153WordPress Tidio Gallery <=1.1 - Cross-Site Scriptingtidio-gallery6.1MEDIUM341266
CVE-2016-1000154WordPress WHIZZ <=1.0.7 - Cross-Site Scriptingwhizz6.1MEDIUM341266
CVE-2016-1000155WordPress WPSOLR <=8.6 - Cross-Site Scriptingwpsolr-search-engine6.1MEDIUM341266
CVE-2016-10973Brafton WordPress Plugin < 3.4.8 - Cross-Site Scriptingbrafton6.1medium347198
CVE-2016-4975Apache mod_userdir CRLF injectionhttp_server6.1medium330708
CVE-2016-7981SPIP <3.1.2 - Cross-Site Scriptingspip6.1medium341266
CVE-2016-8527Aruba Airwave <8.2.3.1 - Cross-Site Scriptingairwave6.1MEDIUM341266
CVE-2017-1000163Phoenix Framework - Open Redirectphoenix6.1medium344365
CVE-2017-11107phpLDAPadmin <= 1.2.3 - Reflected XSSphpldapadmin6.1MEDIUM341266
CVE-2017-11629FineCMS <=5.0.10 - Cross-Site Scriptingfinecms6.1medium341266
CVE-2017-12583DokuWiki - Cross-Site Scriptingdokuwiki6.1medium347198
CVE-2017-12794Django Debug Page - Cross-Site Scriptingdjango6.1medium341266
CVE-2017-14096Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Controlsmart protection server6.1MEDIUM330791
CVE-2017-14622WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting2kb_amazon_affiliates_store6.1medium341266
CVE-2017-15287Dreambox WebControl 2.0.0 - Cross-Site Scriptingbouqueteditor6.1medium341266
CVE-2017-15687Logitech Media Server - Cross-Site Scriptingmedia server6.1MEDIUM347198
CVE-2017-17043WordPress Emag Marketplace Connector 1.0 - Cross-Site Scriptingemag_marketplace_connector6.1MEDIUM341266
CVE-2017-17059WordPress amtyThumb Posts 8.1.3 - Cross-Site Scriptingamtythumb6.1MEDIUM341266
CVE-2017-17451WordPress Mailster <=1.5.4 - Cross-Site Scriptingwp_mailster6.1MEDIUM341266
CVE-2017-18024AvantFAX 3.3.3 - Cross-Site Scriptingavantfax6.1medium340147
CVE-2017-18487AdPush < 1.44 - Cross-Site Scriptinggoogle_adsense6.1medium341266
CVE-2017-18490Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scriptingcontact_form_multi6.1medium341266
CVE-2017-18491Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scriptingcontact_form6.1medium341266
CVE-2017-18492Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scriptingcontact_form_to_db6.1medium341266
CVE-2017-18493Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scriptingcustom_admin_page6.1medium341266
CVE-2017-18494Custom Search by BestWebSoft < 1.36 - Cross-Site Scriptingcustom_search6.1medium341266
CVE-2017-18496Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scriptinghtaccess6.1medium341266
CVE-2017-18500Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scriptingsocial_buttons_pack6.1medium341266
CVE-2017-18501Social Login by BestWebSoft < 0.2 - Cross-Site Scriptingsocial_login6.1medium341266
CVE-2017-18502Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scriptingsubscriber6.1medium341266
CVE-2017-18505BestWebSoft's Twitter < 2.55 - Cross-Site Scriptingtwitter_button6.1medium341266
CVE-2017-18516LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scriptinglinkedin6.1medium341266
CVE-2017-18517Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scriptingpinterest6.1medium341266
CVE-2017-18518SMTP by BestWebSoft < 1.1.0 - Cross-Site Scriptingsmtp6.1medium341266
CVE-2017-18527Pagination by BestWebSoft < 1.0.7 - Cross-Site Scriptingpagination6.1medium341266
CVE-2017-18528PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scriptingpdf_&amp;_print6.1medium341266
CVE-2017-18529PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scriptingpromobar6.1medium341266
CVE-2017-18530Rating by BestWebSoft < 0.2 - Cross-Site Scriptingrating6.1medium341266
CVE-2017-18532Realty by BestWebSoft < 1.1.0 - Cross-Site Scriptingrealty6.1medium341266
CVE-2017-18536WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scriptingstop_user_enumeration6.1medium341266
CVE-2017-18537Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scriptingvisitors_online6.1medium341266
CVE-2017-18542Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scriptingzendesk_help_center6.1medium341266
CVE-2017-18556Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scriptinggoogle_analytics6.1medium341266
CVE-2017-18557Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scriptinggoogle_maps6.1medium341266
CVE-2017-18558Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scriptingtestimonials6.1medium341266
CVE-2017-18562Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scriptingerror_log_viewer6.1medium341266
CVE-2017-18564Sender by BestWebSoft < 1.2.1 - Cross-Site Scriptingsender6.1medium341266
CVE-2017-18565Updater by BestWebSoft < 1.35 - Cross-Site Scriptingupdater6.1medium341266
CVE-2017-18566User Role by BestWebSoft < 1.5.6 - Cross-Site Scriptinguser_role6.1medium341266
CVE-2017-18590Timesheet Plugin < 0.1.5 - Cross-Site Scriptingtimesheet6.1MEDIUM341266, 377360
CVE-2017-18598WordPress Qards - Cross-Site Scriptingqards6.1MEDIUM393749
CVE-2017-3132Fortinet FortiOS < 5.6.0 - Cross-Site Scriptingfortios6.1MEDIUM340147, 341266, 347198, 390727, 392648
CVE-2017-3133Fortinet FortiOS < 5.6.0 - Cross-Site Scriptingfortios6.1MEDIUM340147, 341266, 347198, 390727, 392648
CVE-2017-5631KMCIS CaseAware - Cross-Site Scriptingcaseaware6.1medium341266
CVE-2017-5798HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusionopencall media platform6.1MEDIUM390726, 392301, 392647
CVE-2017-5868OpenVPN Access Server 2.1.4 - CRLF Injectionopenvpn_access_server6.1medium330708
CVE-2017-6443EPSON TMNet WebConfig 1.00 - Cross-Site Scriptingtmnet webconfig6.1MEDIUM340147
CVE-2017-6478MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting-6.1medium341266
CVE-2017-7391Magmi 0.7.22 - Cross-Site Scriptingmagmi6.1medium341266
CVE-2017-7855IceWarp WebMail 11.3.1.5 - Cross-Site Scriptingserver6.1medium347198
CVE-2017-9140Reflected XSS - Telerik Reporting Moduletelerik_reporting6.1medium333141
CVE-2017-9288WordPress Raygun4WP <=1.8.0 - Cross-Site Scriptingraygun4wp6.1MEDIUM341266
CVE-2017-9506Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgeryoauth6.1medium382291
CVE-2017-9979QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilitiesquantastor6.1MEDIUM392301
CVE-2018-1000129Jolokia 1.3.7 - Cross-Site Scriptingjolokia6.1medium347198
CVE-2018-10095Dolibarr <7.0.2 - Cross-Site Scriptingdolibarr6.1medium341266
CVE-2018-10230Zend Server <9.13 - Cross-Site Scriptingzend_server6.1medium341266
CVE-2018-10383Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scriptingsecurelinx_spider_firmware6.1MEDIUM333141
CVE-2018-11227Monstra CMS <=3.0.4 - Cross-Site Scriptingmonstra_cms6.1medium333141
CVE-2018-11709WordPress wpForo Forum <= 1.4.11 - Cross-Site Scriptingwpforo_forum6.1medium341266
CVE-2018-12111Canon PrintMe EFI - Cross-Site Scriptingefi printme6.1MEDIUM347198
CVE-2018-12300Seagate NAS OS 4.3.15.1 - Open Redirectnas_os6.1medium340163
CVE-2018-12998Zoho manageengine - Cross-Site Scriptingfirewall_analyzer6.1medium341266
CVE-2018-13380Fortinet FortiOS - Cross-Site Scriptingfortios6.1medium341266, 347198
CVE-2018-14013Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scriptingzimbra_collaboration_suite6.1medium341266
CVE-2018-16139BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scriptingbibliopac6.1medium341266
CVE-2018-16833ManageEngine Desktop Central 10.0.271 - Cross-Site Scriptingmanageengine desktop central6.1MEDIUM333141
CVE-2018-16979Monstra CMS 3.0.4 - HTTP Header Injectionmonstra6.1medium330708
CVE-2018-17082Apache2 - Transfer-Encoding Chunked XSSphp6.1medium392301
CVE-2018-17310RICOH MP C1803 JPN Printer - Cross-Site Scriptingmp c1803 jpn firmware6.1MEDIUM350147
CVE-2018-17313RICOH MP C1803 JPN Printer - Cross-Site Scriptingmp c307 firmware6.1MEDIUM350147
CVE-2018-17587Airties AIR5342 1.0.0.18 - Cross-Site Scriptingair 5750 firmware6.1MEDIUM341266
CVE-2018-17588Airties AIR5342 1.0.0.18 - Cross-Site Scriptingair 5021 firmware6.1MEDIUM341266
CVE-2018-17590Airties AIR5342 1.0.0.18 - Cross-Site Scriptingair 5442 firmware6.1MEDIUM341266
CVE-2018-17591Airties AIR5342 1.0.0.18 - Cross-Site Scriptingair 5343v2 firmware6.1MEDIUM341266
CVE-2018-17593Airties AIR5342 1.0.0.18 - Cross-Site Scriptingair 5453 firmware6.1MEDIUM341266
CVE-2018-18069WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scriptingwpml6.1medium392301
CVE-2018-18570Planon <Live Build 41 - Cross-Site Scriptingplanon6.1medium341266
CVE-2018-18608DedeCMS 5.7 SP2 - Cross-Site Scriptingdedecms6.1medium341266
CVE-2018-18775Microstrategy Web 7 - Cross-Site Scriptingmicrostrategy_web6.1medium341266
CVE-2018-19136DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod6.1medium341266
CVE-2018-19137DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod6.1medium341266
CVE-2018-19287WordPress Ninja Forms <3.3.18 - Cross-Site Scriptingninja_forms6.1medium347198
CVE-2018-19439Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scriptingsecure_global_desktop6.1medium341266
CVE-2018-19877Adiscon LogAnalyzer <4.1.7 - Cross-Site Scriptingloganalyzer6.1medium341266
CVE-2018-19933Bolt CMS < 3.6.2 - Cross-Site Scriptingbolt cms6.1MEDIUM340147
CVE-2018-20462WordPress JSmol2WP <=1.07 - Cross-Site Scriptingjsmol2wp6.1MEDIUM341266
CVE-2018-20503SirsiDynix e-Library 3.5.x - Cross-Site Scripting8100l/8 firmware6.1MEDIUM340147
CVE-2018-20824Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scriptingjira6.1medium347198
CVE-2018-5230Atlassian Jira Confluence - Cross-Site Scriptingjira6.1medium340112
CVE-2018-5233Grav CMS <1.3.0 - Cross-Site Scriptinggrav_cms6.1medium341266
CVE-2018-5316WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scriptingsagepay_server_gateway_for_woocommerce6.1medium341266
CVE-2018-5715SugarCRM 3.5.1 - Cross-Site Scriptingsugarcrm6.1medium341266
CVE-2018-7203TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scriptingtwonky server6.1MEDIUM340147
CVE-2018-7653YzmCMS v3.6 - Cross-Site Scriptingyzmcms6.1medium347198
CVE-2018-8006Apache ActiveMQ <=5.15.5 - Cross-Site Scriptingactivemq6.1medium341266
CVE-2018-8024Apache Spark UI - Cross-Site Scriptingspark6.1medium341266
CVE-2019-0221Apache Tomcat - Cross-Site Scriptingtomcat6.1medium341266
CVE-2019-10092Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scriptinghttp_server6.1medium344365
CVE-2019-1010287Timesheet Next Gen <=1.5.3 - Cross-Site Scriptingtimesheet_next_gen6.1medium340147
CVE-2019-10475Jenkins build-metrics 1.3 - Cross-Site Scriptingbuild-metrics6.1medium347198
CVE-2019-11398UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scriptingulicms6.1MEDIUM342259
CVE-2019-11844RICOH SP 4520DN Printer - HTML Injectionsp 4520dn firmware6.1MEDIUM350147
CVE-2019-11845RICOH SP 4510DN Printer - HTML Injectionsp 4510dn firmware6.1MEDIUM350147
CVE-2019-12461WebPort 1.19.1 - Cross-Site Scriptingweb_port6.1medium341266
CVE-2019-12581Zyxel ZyWal/USG/UAG Devices - Cross-Site Scriptinguag21006.1medium341266
CVE-2019-12935Shopware < 5.5.8 - Cross-Site Scriptingshopware6.1MEDIUM341266
CVE-2019-13392MindPalette NateMail 3.0.15 - Cross-Site Scriptingnatemail6.1medium342259
CVE-2019-14427Ultimate Loan Manager 2.0 - Cross-Site Scriptingultimate loan manager6.1MEDIUM390585
CVE-2019-14470WordPress UserPro 4.9.32 - Cross-Site Scriptinginstagram-php-api6.1MEDIUM347198
CVE-2019-14696Open-School 3.0/Community Edition 2.3 - Cross-Site Scriptingopen-school6.1medium341266
CVE-2019-14789Custom 404 Pro < 3.2.8 - Cross-Site Scriptingcustom_404_pro6.1medium347198
CVE-2019-14950WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scriptinglive_chat6.1medium380026
CVE-2019-14974SugarCRM Enterprise 9.0.0 - Cross-Site Scriptingsugarcrm6.1medium340112
CVE-2019-15501L-Soft LISTSERV <16.5-2018a - Cross-Site Scriptinglistserv6.1medium341266
CVE-2019-15713WordPress My Calendar <= 3.1.9 - Cross-Site Scriptingmy_calendar6.1MEDIUM341266
CVE-2019-15811DomainMOD <=4.13.0 - Cross-Site Scriptingdomainmod6.1medium333141
CVE-2019-15889WordPress Download Manager <2.9.94 - Cross-Site Scriptingwordpress_download_manager6.1MEDIUM341266
CVE-2019-16332WordPress API Bearer Auth <20190907 - Cross-Site Scriptingapi_bearer_auth6.1MEDIUM341266
CVE-2019-16525WordPress Checklist <1.1.9 - Cross-Site Scriptingchecklist6.1MEDIUM341266
CVE-2019-16931WordPress Visualizer <3.3.1 - Cross-Site Scriptingvisualizer6.1MEDIUM340147
CVE-2019-18859Digi AnywhereUSB 14 - Reflective Cross-Site Scriptinganywhereusb/14 firmware6.1MEDIUM341266, 390727, 392648
CVE-2019-18957MicroStrategy Library <11.1.3 - Cross-Site Scriptingmicrostrategy_library6.1medium347198
CVE-2019-19134WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scriptinghero_maps_premium6.1medium341266
CVE-2019-19368Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scriptingrumpus6.1medium342259
CVE-2019-1943CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilitiessg200-50 firmware6.1MEDIUM390727, 392301, 392648
CVE-2019-19908phpMyChat-Plus 1.98 - Cross-Site Scriptingphpmychat-plus6.1medium341266
CVE-2019-20141WordPress Laborator Neon Theme 2.0 - Cross-Site Scriptingneon6.1medium347198
CVE-2019-20210WordPress CTHthemes - Cross-Site Scriptingcitybook6.1medium341266
CVE-2019-3402Jira < 8.1.1 - Cross-Site Scriptingjira6.1medium341266
CVE-2019-3911LabKey Server Community Edition <18.3.0 - Cross-Site Scriptinglabkey_server6.1medium341266
CVE-2019-6112WordPress Sell Media 2.4.1 - Cross-Site Scriptingsell_media6.1medium341266
CVE-2019-6802Pypiserver <1.2.5 - Carriage Return Line Feed Injectionpypiserver6.1medium330708
CVE-2019-7219Zarafa WebApp <=2.0.1.47791 - Cross-Site Scriptingwebaccess6.1medium347198
CVE-2019-7255Linear eMerge E3 - Cross-Site Scriptinglinear_emerge_essential_firmware6.1medium341266
CVE-2019-7438JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scriptingjiofi 4g m2s firmware6.1MEDIUM340149
CVE-2019-8937HotelDruid 2.3.0 - Cross-Site Scriptinghoteldruid6.1medium341266
CVE-2019-9553Bolt CMS 3.6.4 - Cross-Site Scriptingbolt6.1MEDIUM340148
CVE-2019-9591ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilitiesconnect onsite6.1MEDIUM341266, 390727, 392648
CVE-2019-9592ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilitiesconnect onsite6.1MEDIUM341266, 390727, 392648
CVE-2019-9593ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilitiesconnect onsite6.1MEDIUM341266, 390727, 392648
CVE-2019-9912WP Google Maps < 7.10.43 - Cross-Site Scriptingwp_go_maps6.1MEDIUM347198
CVE-2020-11930WordPress GTranslate <2.8.52 - Cross-Site Scriptingtranslate_wordpress_with_gtranslate6.1medium341266
CVE-2020-12054WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scriptingcatch_breadcrumb6.1medium347198
CVE-2020-13121Submitty <= 20.04.01 - Open Redirectsubmitty6.1medium340162
CVE-2020-13258Contentful <=2020-05-21 - Cross-Site Scriptingpython_example6.1medium341266
CVE-2020-13483Bitrix24 <=20.0.0 - Cross-Site Scriptingbitrix246.1medium344363, 390722
CVE-2020-13820Extreme Management Center 8.4.1.24 - Cross-Site Scriptingextreme_management_center6.1medium333141
CVE-2020-14413NeDi 1.9C - Cross-Site Scriptingnedi6.1medium347198
CVE-2020-15500TileServer GL <=3.0.0 - Cross-Site Scriptingtileservergl6.1medium333141
CVE-2020-15599Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scriptingvictor cms6.1MEDIUM340147
CVE-2020-15718RosarioSIS 6.7.2 - Cross-Site Scriptingrosariosis6.1medium347198
CVE-2020-17362Nova Lite < 1.3.9 - Cross-Site Scriptingnova_lite6.1medium341266
CVE-2020-18268Z-Blog <=1.5.2 - Open Redirectz-blogphp6.1medium390500, 390501
CVE-2020-19282Jeesns 1.4.2 - Cross-Site Scriptingjeesns6.1medium341266
CVE-2020-19283Jeesns 1.4.2 - Cross-Site Scriptingjeesns6.1medium341266
CVE-2020-19295Jeesns 1.4.2 - Cross-Site Scriptingjeesns6.1medium341266
CVE-2020-1943Apache OFBiz <=16.11.07 - Cross-Site Scriptingofbiz6.1medium347198
CVE-2020-19515qdPM 9.1 - Cross-site Scriptingqdpm6.1medium347198
CVE-2020-2096Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scriptinggitlab_hook6.1medium341266
CVE-2020-23517Aryanic HighMail (High CMS) - Cross-Site Scriptinghigh_cms6.1medium341266
CVE-2020-24223Mara CMS 7.5 - Cross-Site Scriptingmara_cms6.1medium341266
CVE-2020-24609Savsoft Quiz 5 - Stored Cross-Site Scriptingsavsoft quiz6.1MEDIUM340147
CVE-2020-24701OX Appsuite - Cross-Site Scriptingopen-xchange_appsuite6.1medium341266
CVE-2020-24902Quixplorer <=2.4.1 - Cross-Site Scriptingquixplorer6.1medium341266
CVE-2020-24903Cute Editor for ASP.NET 6.4 - Cross-Site Scriptingcute_editor6.1medium341266
CVE-2020-25495SCO Openserver 5.0.7 - 'section' Reflected XSSopenserver6.1MEDIUM341266
CVE-2020-25864HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scriptingconsul6.1medium392301
CVE-2020-26153Event Espresso Core-Reg 4.10.7.p - Cross-Site Scriptingevent_espresso6.1MEDIUM341266
CVE-2020-27735Wing FTP 6.4.4 - Cross-Site Scriptingwing_ftp_server6.1medium350148
CVE-2020-27982IceWarp WebMail 11.4.5.0 - Cross-Site Scriptingmail_server6.1medium347198
CVE-2020-28351Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scriptingshoretel6.1MEDIUM341266
CVE-2020-29164PacsOne Server <7.1.1 - Cross-Site Scriptingpacsone_server6.1medium333141
CVE-2020-29395Wordpress EventON Calendar 3.0.5 - Cross-Site Scriptingeventon6.1MEDIUM347198
CVE-2020-3580Cisco ASA/FTD Software - Cross-Site Scriptingfirepower_threat_defense6.1medium333141
CVE-2020-36510WordPress 15Zine <3.3.0 - Cross-Site Scripting15zine6.1MEDIUM341266
CVE-2020-36731Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Updateflexible_checkout_fields_for_woocommerce6.1MEDIUM377360
CVE-2020-5191Hospital Management System 4.0 - Persistent Cross-Site Scriptinghospital management system6.1MEDIUM342259
CVE-2020-6171CLink Office 2.0 - Cross-Site Scriptingclink_office6.1medium341266
CVE-2020-7107WordPress Ultimate FAQ <1.8.30 - Cross-Site Scriptingultimate_faq6.1MEDIUM347198
CVE-2020-8115Revive Adserver <=5.0.3 - Cross-Site Scriptingrevive_adserver6.1medium350148
CVE-2020-8191Citrix ADC/Gateway - Cross-Site Scriptingapplication_delivery_controller_firmware6.1medium340147
CVE-2020-8512IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scriptingicewarp_server6.1medium347198
CVE-2020-9344Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scriptingsubversion_application_lifecycle_management6.1medium341266
CVE-2021-20137Gryphon Tower - Cross-Site Scriptinggryphon_tower6.1medium347198
CVE-2021-20323Keycloak 10.0.0 - 18.0.0 - Cross-Site Scriptingkeycloak6.1MEDIUM333141
CVE-2021-20792WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scriptingquiz_and_survey_master6.1medium341266
CVE-2021-21799Advantech R-SeeNet 2.4.12 - Cross-Site Scriptingr-seenet6.1medium341266
CVE-2021-21800Advantech R-SeeNet 2.4.12 - Cross-Site Scriptingr-seenet6.1medium341266
CVE-2021-21801Advantech R-SeeNet - Cross-Site Scriptingr-seenet6.1medium347198
CVE-2021-21802Advantech R-SeeNet - Cross-Site Scriptingr-seenet6.1medium347198
CVE-2021-21803Advantech R-SeeNet - Cross-Site Scriptingr-seenet6.1medium347198
CVE-2021-24165WordPress Ninja Forms <3.4.34 - Open Redirectninja_forms6.1MEDIUM377360
CVE-2021-24169WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scriptingadvanced_order_export6.1medium341266
CVE-2021-24210WordPress PhastPress <1.111 - Open Redirectphastpress6.1medium340162
CVE-2021-24213GiveWP <= 2.9.7 - Cross-Site Scriptinggivewp6.1MEDIUM377360
CVE-2021-24214WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scriptingopenid_connect_generic_client6.1MEDIUM341266
CVE-2021-24235WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scriptinggoto6.1medium347198
CVE-2021-24237WordPress Realteo <=1.2.3 - Cross-Site Scriptingfindeo6.1medium347198
CVE-2021-24245WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)stop spammers6.1MEDIUM333141
CVE-2021-24274WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scriptingultimate_maps6.1MEDIUM341266
CVE-2021-24275Popup by Supsystic <1.10.5 - Cross-Site scriptingpopup6.1medium341266
CVE-2021-24276WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scriptingcontact_form6.1medium341266
CVE-2021-24286WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scriptingredirect_404_to_parent6.1MEDIUM377360
CVE-2021-24287WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scriptingselect_all_categories_and_taxonomies,_change_checkbox_to_radio_buttons6.1MEDIUM377360
CVE-2021-24291WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scriptingphoto_gallery6.1medium347198
CVE-2021-24298WordPress Simple Giveaways <2.36.2 - Cross-Site Scriptingsimple_giveaways6.1MEDIUM341266
CVE-2021-24300WordPress WooCommerce <1.13.22 - Cross-Site Scriptingproduct_slider_for_woocommerce6.1medium347198
CVE-2021-24316WordPress Mediumish Theme <=1.0.47 - Cross-Site Scriptingmediumish6.1medium341266
CVE-2021-24320WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scriptingbello6.1MEDIUM341266
CVE-2021-24335WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scriptingcar_repair_services_&amp;_auto_mechanic6.1MEDIUM341266
CVE-2021-24342WordPress JNews Theme <8.0.6 - Cross-Site Scriptingjnews6.1MEDIUM340147
CVE-2021-24364WordPress Jannah Theme <5.4.4 - Cross-Site Scriptingjannah6.1MEDIUM341266
CVE-2021-24387WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scriptingreal_estate_76.1medium341266
CVE-2021-24389WordPress FoodBakery <2.2 - Cross-Site Scriptingfoodbakery6.1medium341266
CVE-2021-24407WordPress Jannah Theme <5.4.5 - Cross-Site Scriptingjannah6.1MEDIUM392301
CVE-2021-24409Prismatic < 2.8 - Cross-Site Scriptingprismatic6.1medium347198
CVE-2021-24435WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scriptingtitan_framework6.1medium333141, 347198
CVE-2021-24436WordPress W3 Total Cache <2.1.4 - Cross-Site Scriptingw3_total_cache6.1medium341266
CVE-2021-24452WordPress W3 Total Cache <2.1.5 - Cross-Site Scriptingw3_total_cache6.1MEDIUM377360
CVE-2021-24488WordPress Post Grid <2.1.8 - Cross-Site Scriptingpost_grid6.1medium347198
CVE-2021-24495Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scriptingmarmoset_viewer6.1medium347198
CVE-2021-24498WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scriptingcalendar_event_multi_view6.1medium347198
CVE-2021-24510WordPress MF Gig Calendar <=1.1 - Cross-Site Scriptingmf_gig_calendar6.1medium341266
CVE-2021-24522ProfilePress < 3.1.11 - Cross-Site Scriptingprofilepress6.1MEDIUM341266
CVE-2021-24563WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)frontend uploader6.1MEDIUM392301
CVE-2021-24657Limit Login Attempts WordPress - Stored Cross-site Scriptinglimit login attempts6.1MEDIUM377360
CVE-2021-24838WordPress AnyComment <0.3.5 - Open Redirectanycomment6.1medium390145
CVE-2021-24875WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scriptingecommerce_product_catalog6.1medium347198
CVE-2021-24876Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scriptingregistrations_for_the_events_calendar6.1MEDIUM377360
CVE-2021-24910WordPress Transposh Translation <1.0.8 - Cross-Site Scriptingtransposh_wordpress_translation6.1medium347198
CVE-2021-24926WordPress Domain Check <1.0.17 - Cross-Site Scriptingdomain_check6.1medium341266
CVE-2021-24934Visual CSS Style Editor < 7.5.4 - Cross-Site Scriptingvisual_css_style_editor6.1medium341266
CVE-2021-24940WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scriptingpersian-woocommerce6.1medium347198
CVE-2021-24956Blog2Social < 6.8.7 - Cross-Site Scriptingblog2social6.1medium341266
CVE-2021-24979Paid Memberships Pro < 2.6.6 - Cross-Site Scriptingpaid_memberships_pro6.1medium347198
CVE-2021-24987WordPress Super Socializer <7.13.30 - Cross-Site Scriptingsuper_socializer6.1medium347198
CVE-2021-25008The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scriptingcode_snippets6.1medium347198
CVE-2021-25016Chaty < 2.8.2 - Cross-Site Scriptingchaty6.1medium347198
CVE-2021-25055WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scriptingfeedwordpress6.1medium347198
CVE-2021-25063WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scriptingcontact_form_7_skins6.1medium347198
CVE-2021-25074WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirectwebp_converter_for_media6.1medium340162
CVE-2021-25078Affiliates Manager < 2.9.0 - Cross Site Scriptingaffiliates_manager6.1medium347198
CVE-2021-25079Contact Form Entries < 1.2.4 - Cross-Site Scriptingcontact_form_entries6.1medium341266
CVE-2021-25085WOOF WordPress plugin - Cross-Site Scriptingwoocommerce_products_filter6.1medium347198
CVE-2021-25104WordPress Ocean Extra <1.9.5 - Cross-Site Scriptingocean_extra6.1medium341266
CVE-2021-25112WordPress WHMCS Bridge <6.4b - Cross-Site Scriptingwhmcs_bridge6.1medium347198
CVE-2021-25120Easy Social Feed < 6.2.7 - Cross-Site Scriptingeasy_social_feed6.1medium341266
CVE-2021-25161Aruba Instant Access Point (IAP) - Cross-Site Scriptingaruba-instant-access-point6.1medium390722
CVE-2021-26247Cacti - Cross-Site Scriptingcacti6.1medium341266
CVE-2021-26475EPrints 3.4.2 - Cross-Site Scriptingeprints6.1medium341266
CVE-2021-26702EPrints 3.4.2 - Cross-Site Scriptingeprints6.1medium341266
CVE-2021-26710Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scriptingreport2web6.1medium341266
CVE-2021-26723Jenzabar 9.2x-9.2.2 - Cross-Site Scriptingjenzabar6.1medium341266
CVE-2021-26947Odoo <= 15.0 - Cross-Site Scriptingodoo6.1medium341266, 347198
CVE-2021-27309Clansphere CMS 2011.4 - Cross-Site Scriptingclansphere6.1medium341266
CVE-2021-27310Clansphere CMS 2011.4 - Cross-Site Scriptingclansphere6.1medium341266
CVE-2021-27330Triconsole Datepicker Calendar <3.77 - Cross-Site Scriptingdatepicker_calendar6.1medium341266
CVE-2021-27519FUDForum 3.1.0 - Cross-Site Scriptingfudforum6.1medium347198
CVE-2021-27520FUDForum 3.1.0 - Cross-Site Scriptingfudforum6.1medium347198
CVE-2021-27695openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scriptingopenmaint6.1MEDIUM330791
CVE-2021-29625Adminer <=4.8.0 - Cross-Site Scriptingadminer6.1medium341266
CVE-2021-3002Seo Panel 4.8.0 - Cross-Site Scriptingseo_panel6.1medium333141
CVE-2021-30049SysAid Technologies 20.3.64 b14 - Cross-Site Scriptingsysaid6.1medium341266
CVE-2021-30134Php-mod/curl Library <2.3.2 - Cross-Site Scriptingphp_curl_class6.1medium347198
CVE-2021-30213Knowage Suite 7.3 - Cross-Site Scriptingknowage6.1medium341266
CVE-2021-31537SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scriptingsis-rewe_go6.1medium341266
CVE-2021-31589BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scriptingappliance_base_software6.1medium347198
CVE-2021-31682WebCTRL OEM <= 6.5 - Cross-Site Scriptingwebctrl6.1medium341266
CVE-2021-31862SysAid 20.4.74 - Cross-Site Scriptingsysaid6.1medium341266
CVE-2021-32478Moodle 3.8-3.10.3 - Reflected XSS & Open Redirectmoodle6.1medium350148
CVE-2021-33904Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)civic platform6.1MEDIUM390727, 392301, 392648
CVE-2021-34370Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)civic platform6.1MEDIUM390727, 392301, 392648
CVE-2021-34630GTranslate < 2.8.65 - Cross-Site Scriptinggtranslate6.1medium341266
CVE-2021-34640WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scriptingsecurimage-wp-fixed6.1medium341266
CVE-2021-34643WordPress Skaut Bazar <1.3.3 - Cross-Site Scriptingskaut-bazar6.1medium341266
CVE-2021-35265MaxSite CMS > V106 - Cross-Site Scriptingmaxsite_cms6.1medium347198
CVE-2021-35488Thruk 2.40-2 - Cross-Site Scriptingthruk6.1medium341266
CVE-2021-36450Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scriptingworkforce_optimization6.1medium350147
CVE-2021-36646KodExplorer - Cross-Site Scriptingkod-explorer6.1MEDIUM341266
CVE-2021-37416Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scriptingmanageengine_adselfservice_plus6.1medium341266
CVE-2021-37573Tiny Java Web Server - Cross-Site Scriptingtiny_java_web_server6.1medium347198
CVE-2021-37833Hotel Druid 3.0.2 - Cross-Site Scriptinghoteldruid6.1medium341266
CVE-2021-38702Cyberoam NetGenie Cross-Site Scriptingnetgenie_c0101b1-20141120-ng11vo_firmware6.1medium341266
CVE-2021-38704ClinicCases 7.3.3 Cross-Site Scriptingcliniccases6.1medium341266
CVE-2021-39320WordPress Under Construction <1.19 - Cross-Site Scriptingunderconstruction6.1medium341266
CVE-2021-39322WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scriptingeasy_social_icons6.1medium341266
CVE-2021-39350FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scriptingfv_flowplayer_video_player6.1medium341266
CVE-2021-40542Opensis-Classic 8.0 - Cross-Site Scriptingopensis6.1medium341266
CVE-2021-40868Cloudron 6.2 Cross-Site Scriptingcloudron6.1medium341266
CVE-2021-41467JustWriting - Cross-Site Scriptingjustwriting6.1MEDIUM341266
CVE-2021-41878i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)i-panel administration system6.1MEDIUM347198
CVE-2021-41951Resourcespace - Cross-Site Scriptingresourcespace6.1medium341266
CVE-2021-42551NetBiblio WebOPAC - Cross-Site Scriptingnetbiblio6.1medium341245, 344370
CVE-2021-42565myfactory FMS - Cross-Site Scriptingfms6.1medium341266
CVE-2021-42567Apereo CAS Cross-Site Scriptingcentral_authentication_service6.1medium333141
CVE-2021-43062Fortinet FortiMail 7.0.1 - Cross-Site Scriptingfortimail6.1medium347198
CVE-2021-43574Atmail 6.5.0 - Cross-Site Scriptingatmail6.1medium341266
CVE-2021-43725Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)spotweb6.1medium341266
CVE-2021-43810Admidio - Cross-Site Scriptingadmidio6.1medium340112
CVE-2021-45380AppCMS - Cross-Site Scriptingappcms6.1medium341266
CVE-2021-45422Reprise License Manager 14.2 - Cross-Site Scriptingreprise_license_manager6.1medium341266
CVE-2021-45425SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)safari montage6.1MEDIUM341266
CVE-2021-46387Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)zywall 2 plus internet security appliance firmware6.1MEDIUM333141
CVE-2022-0087Keystone 6 Login Page - Open Redirect and Cross-Site Scriptingkeystone6.1medium333140
CVE-2022-0147WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scriptingwp-gdpr-compliance6.1medium347198
CVE-2022-0149WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scriptingstore_exporter_for_woocommerce6.1medium341266
CVE-2022-0189WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scriptingwp_rss_aggregator6.1MEDIUM377360
CVE-2022-0201WordPress Permalink Manager <2.2.15 - Cross-Site Scriptingpermalink_manager_lite6.1medium347198
CVE-2022-0206WordPress NewStatPress <1.3.6 - Cross-Site Scriptingnewstatpress6.1medium347198
CVE-2022-0208WordPress Plugin MapPress <2.73.4 - Cross-Site Scriptingmappress6.1medium347198
CVE-2022-0212WordPress Spider Calendar <=1.5.65 - Cross-Site Scriptingspidercalendar6.1medium347198
CVE-2022-0234WordPress WOOCS < 1.3.7.5 - Cross-Site Scriptingwoocs6.1medium347198
CVE-2022-0250Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scriptingredirection_for_contact_form_76.1medium341266
CVE-2022-0271LearnPress <4.1.6 - Cross-Site Scriptinglearnpress6.1medium347198
CVE-2022-0346WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Executionxml_sitemap_generator6.1medium340165, 347198
CVE-2022-0381WordPress Embed Swagger <=1.0.0 - Cross-Site Scriptingembed_swagger6.1MEDIUM350148
CVE-2022-0429WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scriptingwp_cerber_security,anti-spam&amp;_malware_scan6.1medium347198
CVE-2022-0437karma-runner DOM-based Cross-Site Scriptingkarma6.1medium340112
CVE-2022-0533Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scriptingditty6.1medium347198
CVE-2022-0599WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scriptingmapping_multiple_urls_redirect_same_page6.1medium347198
CVE-2022-0653Wordpress Profile Builder Plugin Cross-Site Scriptingprofile_builder6.1medium340112
CVE-2022-0678Microweber <1.2.11 - Cross-Site Scriptingmicroweber6.1medium341266
CVE-2022-0864UpdraftPlus < 1.22.9 - Cross-Site Scriptingupdraftplus6.1medium341266
CVE-2022-0879Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting-6.1medium347198
CVE-2022-0899Header Footer Code Manager < 1.1.24 - Cross-Site Scriptingheader_footer_code_manager6.1medium341266
CVE-2022-1007WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scriptingadvanced_booking_calendar6.1medium341266
CVE-2022-1168WordPress WP JobSearch <1.5.1 - Cross-Site Scriptingjobsearch_wp_job_board6.1medium347198
CVE-2022-1170JobMonster < 4.5.2.9 - Cross-Site Scriptingjobmonster6.1medium347198
CVE-2022-1221WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scriptinggwyn&#x27;s_imagemap_selector6.1medium341266
CVE-2022-1439Microweber <1.2.15 - Cross-Site Scriptingmicroweber6.1medium347198
CVE-2022-1724WordPress Simple Membership <4.1.1 - Cross-Site Scriptingsimple_membership6.1MEDIUM341266
CVE-2022-1756Newsletter < 7.4.5 - Cross-Site Scriptingnewsletter6.1medium347198
CVE-2022-1904WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scriptingeasy_pricing_tables6.1medium341266
CVE-2022-1906WordPress Copyright Proof <=4.16 - Cross-Site-Scriptingcopyright_proof6.1medium341266
CVE-2022-1910WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scriptingshortcodes_and_extra_features_for_phlox_theme6.1medium341266
CVE-2022-1933WordPress CDI <5.1.9 - Cross Site Scriptingcollect_and_deliver_interface_for_woocommerce6.1medium341266
CVE-2022-1937WordPress Awin Data Feed <=1.6 - Cross-Site Scriptingawin_data_feed6.1medium341266
CVE-2022-1946WordPress Gallery <2.0.0 - Cross-Site Scriptinggallery6.1medium341266
CVE-2022-2130Microweber < 1.2.17 - Cross-Site Scriptingmicroweber6.1medium341266
CVE-2022-2168WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scriptingdownload_manager6.1medium341266
CVE-2022-2174microweber 1.2.18 - Cross-site Scriptingmicroweber6.1medium341266
CVE-2022-2187WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scriptingcontact_form_7_captcha6.1medium341266
CVE-2022-22242Juniper Web Device Manager - Cross-Site Scriptingjunos6.1medium341266
CVE-2022-2290Trilium <0.52.4 - Cross-Site Scriptingtrilium6.1medium347198
CVE-2022-23397Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scriptingez-net_portal6.1medium347198
CVE-2022-23808phpMyAdmin < 5.1.2 - Cross-Site Scriptingphpmyadmin6.1medium341266
CVE-2022-2383WordPress Feed Them Social <3.0.1 - Cross-Site Scriptingfeed_them_social6.1MEDIUM347198
CVE-2022-24384SmarterTools SmarterTrack - Cross-Site Scriptingsmartertrack6.1medium347198
CVE-2022-24899Contao <4.13.3 - Cross-Site Scriptingcontao6.1medium341266
CVE-2022-25323ZEROF Web Server 2.0 - Cross-Site Scriptingweb_server6.1medium347198
CVE-2022-2599WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scriptinganti-malware_security_and_brute-force_firewall6.1medium347198
CVE-2022-26564HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scriptinghoteldruid6.1medium341266
CVE-2022-2733Openemr < 7.0.0.1 - Cross-Site Scriptingopenemr6.1medium347198
CVE-2022-27926Zimbra Collaboration (ZCS) - Cross Site Scriptingcollaboration6.1medium347198
CVE-2022-28290WordPress Country Selector <1.6.6 - Cross-Site Scriptingwordpress_country_selector6.1medium340130
CVE-2022-28363Reprise License Manager 14.2 - Cross-Site Scriptingreprise_license_manager6.1medium347198
CVE-2022-28508MantisBT < 2.25.2 - Cross-Site Scripting-6.1medium341266
CVE-2022-29004Diary Management System 1.0 - Cross-Site Scriptinge-diary_management_system6.1medium340147
CVE-2022-29005Online Birth Certificate System 1.2 - Stored Cross-Site Scriptingonline_birth_certificate_system6.1medium340147
CVE-2022-30489Wavlink WN-535G3 - Cross-Site Scriptingwn535g3_firmware6.1medium340147
CVE-2022-30513School Dormitory Management System 1.0 - Authenticated Cross-Site Scriptingschool_dormitory_management_system6.1medium392301
CVE-2022-30514School Dormitory Management System 1.0 - Authenticated Cross-Site Scriptingschool_dormitory_management_system6.1medium392301
CVE-2022-3062Simple File List < 4.4.12 - Cross Site Scriptingsimple-file-list6.1medium347198
CVE-2022-30776Atmail 6.5.0 - Cross-Site Scriptingatmail6.1medium341266
CVE-2022-30777Parallels H-Sphere 3.6.1713 - Cross-Site Scriptingh-sphere6.1medium341266
CVE-2022-31299Haraj 3.7 - Cross-Site Scriptingharaj6.1medium341266
CVE-2022-31373SolarView Compact 6.00 - Cross-Site Scriptingsv-cpt-mc310_firmware6.1medium341266
CVE-2022-31470Axigen WebMail - Cross-Site Scriptingwebmail6.1MEDIUM341266
CVE-2022-31798Nortek Linear eMerge E3-Series - Cross-Site Scriptingemerge_e3_firmware6.1medium347198
CVE-2022-32195Open edX <2022-06-06 - Cross-Site Scriptingopen_edx6.1medium333141
CVE-2022-3242Microweber <1.3.2 - Cross-Site Scriptingmicroweber6.1medium341266
CVE-2022-32770WWBN AVideo 11.6 - Cross-Site Scriptingavideo6.1medium341266
CVE-2022-32771WWBN AVideo 11.6 - Cross-Site Scriptingavideo6.1medium341266
CVE-2022-32772WWBN AVideo 11.6 - Cross-Site Scriptingavideo6.1medium341266
CVE-2022-33119NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scriptingnvrsolo_firmware6.1medium340003
CVE-2022-34048Wavlink WN-533A8 - Cross-Site Scriptingwn533a8_firmware6.1medium392301
CVE-2022-34093Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scriptingi3geo6.1medium341266
CVE-2022-34094Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scriptingi3geo6.1medium341266
CVE-2022-34328PMB 7.3.10 - Cross-Site Scriptingpmb6.1medium341266
CVE-2022-3484WordPress WPB Show Core - Cross-Site Scriptingwpb_show_core6.1medium341266
CVE-2022-35155Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)bus pass management system6.1MEDIUM340147
CVE-2022-35416H3C SSL VPN <=2022-07-10 - Cross-Site Scriptingssl_vpn6.1medium342259
CVE-2022-35493eShop 3.0.4 - Cross-Site Scriptingeshop_-ecommerce/_store_website6.1medium347198
CVE-2022-35653Moodle LTI module Reflected - Cross-Site Scriptingmoodle6.1medium333141
CVE-2022-3578WordPress ProfileGrid <5.1.1 - Cross-Site Scriptingprofilegrid6.1medium341266
CVE-2022-37153Artica Proxy 4.30.000000 - Cross-Site Scriptingartica_proxy6.1medium340147
CVE-2022-3766phpMyFAQ < 3.1.8 - Cross-Site Scriptingphpmyfaq6.1medium333141
CVE-2022-38295Cuppa CMS v1.0 - Cross Site Scriptingcuppacms6.1medium340147
CVE-2022-38463ServiceNow - Cross-Site Scriptingservicenow6.1medium350148
CVE-2022-38467CRM Perks Forms < 1.1.1 - Cross Site Scriptingcrm_perks_forms6.1medium347198
CVE-2022-38553Academy Learning Management System <5.9.1 - Cross-Site Scriptingacademy_learning_management_system6.1medium341266
CVE-2022-3908WordPress Helloprint <1.4.7 - Cross-Site Scriptinghelloprint6.1medium341266
CVE-2022-39195LISTSERV 17 - Cross-Site Scriptinglistserv6.1medium341266
CVE-2022-40359Kae's File Manager <=1.4.7 - Cross-Site Scriptingkfm6.1medium341266
CVE-2022-41441ReQlogic v11.3 - Cross Site Scriptingreqlogic6.1medium341266
CVE-2022-41473RPCMS 3.0.2 - Cross-Site Scriptingrpcms6.1medium341266
CVE-2022-42118Liferay Portal - Cross-site Scriptingliferay_portal6.1medium341266
CVE-2022-42746CandidATS 3.0.0 - Cross-Site Scripting.candidats6.1medium341266
CVE-2022-42747CandidATS 3.0.0 - Cross-Site Scripting.candidats6.1medium341266
CVE-2022-42748CandidATS 3.0.0 - Cross-Site Scripting.candidats6.1medium341266
CVE-2022-42749CandidATS 3.0.0 - Cross-Site Scriptingcandidats6.1medium341266
CVE-2022-4295Show all comments < 7.0.1 - Cross-Site Scriptingshow_all_comments6.1medium341266
CVE-2022-4301WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scriptingsunshine_photo_cart6.1medium341266
CVE-2022-43014OpenCATS 0.9.6 - Cross-Site Scriptingopencats6.1medium341266
CVE-2022-43015OpenCATS 0.9.6 - Cross-Site Scriptingopencats6.1medium341266
CVE-2022-43016OpenCATS 0.9.6 - Cross-Site Scriptingopencats6.1medium341266
CVE-2022-43017OpenCATS 0.9.6 - Cross-Site Scriptingopencats6.1medium341266
CVE-2022-43018OpenCATS 0.9.6 - Cross-Site Scriptingopencats6.1medium341266
CVE-2022-4320WordPress Events Calendar <1.4.5 - Cross-Site Scriptingwordpress_events_calendar_plugin6.1medium341266
CVE-2022-4321PDF Generator for WordPress < 1.1.2 - Cross Site Scriptingpdf_generator_for_wordpress6.1medium341266
CVE-2022-4325WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scriptingpost_status_notifier_lite6.1medium341266
CVE-2022-46073Helmet Store Showroom - Cross Site Scriptinghelmet_store_showroom6.1medium341266
CVE-2022-46381Linear eMerge E3-Series - Cross-Site Scriptinglinear_emerge_e3_access_control_firmware6.1medium333141
CVE-2022-46888NexusPHP <1.7.33 - Cross-Site Scriptingnexusphp6.1medium341266
CVE-2022-48012OpenCATS 0.9.7 - Cross-Site Scriptingopencats6.1medium340147
CVE-2022-48197Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scriptingyui6.1medium341266
CVE-2022-4897WordPress BackupBuddy <8.8.3 - Cross Site Scriptingbackupbuddy6.1medium347198
CVE-2022-4971Sassy Social Share <= 3.3.3 - Cross-Site Scriptingsassy_social_share6.1medium347198
CVE-2023-0099Simple URLs < 115 - Cross Site Scriptingsimple_urls6.1medium347198
CVE-2023-0236WordPress Tutor LMS <2.0.10 - Cross Site Scriptingtutor_lms6.1medium333141
CVE-2023-0334ShortPixel Adaptive Images < 3.6.3 - Cross Site Scriptingshortpixel_adaptive_images6.1medium347198
CVE-2023-0448WP Helper Lite < 4.3 - Cross-Site Scriptingwp_helper_premium6.1medium347198
CVE-2023-0514Membership Database <= 1.0 - Cross-Site Scriptingmembership_database6.1MEDIUM377360
CVE-2023-0527Online Security Guards Hiring System - Cross-Site Scriptingonline_security_guards_hiring_system6.1medium333141
CVE-2023-0602Twittee Text Tweet <= 1.0.8 - Cross-Site Scriptingtwittee_text_tweet6.1medium341266
CVE-2023-0676phpIPAM 1.5.1 - Cross-site Scriptingphpipam6.1medium340147
CVE-2023-0942WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scriptingjapanized_for_woocommerce6.1medium347198
CVE-2023-0948WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scriptingjapanized_for_woocommerce6.1medium341266
CVE-2023-0968WordPress Watu Quiz <3.3.9.1 - Cross-Site Scriptingwatu_quiz6.1medium347198
CVE-2023-1080WordPress GN Publisher <1.5.6 - Cross-Site Scriptinggn_publisher6.1medium347198
CVE-2023-1119WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scriptingwp-optimize,srbtranslatin6.1medium341266
CVE-2023-1546MyCryptoCheckout < 2.124 - Cross-Site Scriptingmycryptocheckout6.1medium341266
CVE-2023-1780Companion Sitemap Generator < 4.5.3 - Cross-Site Scriptingcompanion_sitemap_generator6.1medium347198
CVE-2023-1835Ninja Forms < 3.6.22 - Cross-Site Scriptingninja_forms6.1medium347198
CVE-2023-1880Phpmyfaq v3.1.11 - Cross-Site Scriptingphpmyfaq6.1medium341266
CVE-2023-1890Tablesome < 1.0.9 - Cross-Site Scriptingtablesome6.1medium341266
CVE-2023-1893Login Configurator <=2.1 - Cross-Site Scriptinglogin_configurator6.1MEDIUM341266
CVE-2023-2023Custom 404 Pro < 3.7.3 - Cross-Site Scriptingcustom_404_pro6.1medium347198
CVE-2023-2122Image Optimizer by 10web < 1.0.26 - Cross-Site Scriptingimage_optimizer6.1medium347198
CVE-2023-2256WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scriptingwoocommerce-product-addon6.1high341266
CVE-2023-2272Tiempo.com <= 0.1.2 - Cross-Site Scriptingtiempo6.1MEDIUM377360
CVE-2023-2309wpForo Forum <= 2.1.8 - Cross-Site Scriptingwpforo_forum6.1medium341266
CVE-2023-23161Art Gallery Management System Project v1.0 - Cross-Site Scriptingart_gallery_management_system6.1medium347198
CVE-2023-23491Quick Event Manager < 9.7.5 - Cross-Site Scriptingquick_event_manager6.1medium341266
CVE-2023-24278Squidex <7.4.0 - Cross-Site Scriptingsquidex6.1medium341266
CVE-2023-24322mojoPortal 2.7.0.0 - Cross-Site Scriptingmojoportal6.1medium350148
CVE-2023-24367Temenos T24 R20 - Cross-Site Scriptingt246.1medium341266
CVE-2023-24488Citrix Gateway and Citrix ADC - Cross-Site Scriptinggateway6.1medium340099, 341266
CVE-2023-24657phpIPAM - 1.6 - Cross-Site Scriptingphpipam6.1medium341266
CVE-2023-24733PMB 7.4.6 - Cross-Site Scriptingpmb6.1medium341266
CVE-2023-24737PMB v7.4.6 - Cross-Site Scriptingpmb6.1medium341266
CVE-2023-2518WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scriptingeasy_forms_for_mailchimp6.1MEDIUM347198, 377360
CVE-2023-25346ChurchCRM 4.5.3 - Cross-Site Scriptingchurchcrm6.1medium341266
CVE-2023-2624KiviCare WordPress Plugin - Cross-Site Scriptingkivicare6.1medium347198
CVE-2023-27008ATutor < 2.2.1 - Cross Site Scriptingatutor6.1medium350148
CVE-2023-27641L-Soft LISTSERV 16.5 - Cross-Site Scriptinglistserv6.1medium341266
CVE-2023-2779Super Socializer < 7.13.52 - Cross-Site Scriptingsocial_share,_social_login_and_social_comments6.1medium347198
CVE-2023-27922Newsletter < 7.6.9 - Cross-Site Scriptingnewsletter6.1medium341266
CVE-2023-2813Wordpress Multiple Themes - Reflected Cross-Site Scriptingconnections_reloaded6.1medium333141
CVE-2023-2822Ellucian Ethos Identity CAS - Cross-Site Scriptingethos_identity6.1medium347198
CVE-2023-29439FooGallery plugin <= 2.2.35 - Cross-Site Scriptingfoogallery6.1medium341266
CVE-2023-2948OpenEMR < 7.0.1 - Cross-Site Scriptingopenemr6.1medium344363
CVE-2023-29489cPanel < 11.109.9999.116 - Cross-Site Scriptingcpanel6.1medium340099
CVE-2023-2949OpenEMR < 7.0.1 - Cross-site Scriptingopenemr6.1medium347198
CVE-2023-29623Purchase Order Management v1.0 - Cross Site Scripting (Reflected)purchase_order_management6.1medium333141
CVE-2023-30210OURPHP <= 7.2.0 - Cross Site Scriptingourphp6.1medium341266
CVE-2023-30212OURPHP <= 7.2.0 - Cross Site Scriptingourphp6.1medium341266
CVE-2023-30256Webkul QloApps 1.5.2 - Cross-site Scriptingqloapps6.1medium347198
CVE-2023-30777Advanced Custom Fields < 6.1.6 - Cross-Site Scriptingadvanced_custom_fields6.1medium347198
CVE-2023-30868Tree Page View Plugin < 1.6.7 - Cross-Site Scriptingcms_tree_page_view6.1medium341266
CVE-2023-3169tagDiv Composer < 4.2 - Stored Cross-Site Scriptingtagdiv_composer6.1high380026
CVE-2023-34599Gibbon v25.0.0 - Cross-Site Scriptinggibbon6.1medium341266
CVE-2023-3479Hestiacp <= 1.7.7 - Cross-Site Scriptingcontrol_panel6.1medium341266
CVE-2023-35155XWiki - Cross-Site Scriptingxwiki6.1medium347198
CVE-2023-35156XWiki >= 6.0-rc-1 - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-35158XWiki - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-35159XWiki >= 3.4-milestone-1 - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-35160XWiki >= 2.5-milestone-2 - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-35161XWiki >= 6.2-milestone-1 - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-35162XWiki < 14.10.5 - Cross-Site Scriptingxwiki6.1medium350148
CVE-2023-3521FOSSBilling < 0.5.3 - Cross-Site Scriptingfossbilling6.1medium347198
CVE-2023-36287Webkul QloApps 1.6.0 - Cross-site Scriptingqloapps6.1medium350148
CVE-2023-36289Webkul QloApps 1.6.0 - Cross-site Scriptingqloapps6.1medium333141
CVE-2023-36306Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scriptingloganalyzer6.1medium341266
CVE-2023-36346POS Codekop v2.0 - Cross Site Scriptingcodekop6.1medium341266
CVE-2023-37580Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scriptingzimbra6.1medium347198
CVE-2023-37728IceWarp Webmail Server v10.2.1 - Cross Site Scriptingicewarp6.1medium347198
CVE-2023-37979Ninja Forms < 3.6.26 - Cross-Site Scriptingninja_forms6.1MEDIUM377360
CVE-2023-37988Contact Form Generator <= 2.5.5 - Cross-Site Scriptingcontact-form-generator6.1medium341266
CVE-2023-38040Revive Adserver 5.4.1 - Cross-Site Scriptingrevive_adserver6.1MEDIUM341266
CVE-2023-38192SuperWebMailer 9.00.0.01710 - Cross-Site Scriptingsuperwebmailer6.1medium340147
CVE-2023-38194SuperWebMailer - Cross-Site Scriptingsuperwebmailer6.1medium347198
CVE-2023-3843mooDating 1.2 - Cross-site scriptingmoodating6.1medium347198
CVE-2023-3844MooDating 1.2 - Cross-Site Scriptingmoodating6.1medium347198
CVE-2023-3845MooDating 1.2 - Cross-Site Scriptingmoodating6.1medium347198
CVE-2023-3846MooDating 1.2 - Cross-Site Scriptingmoodating6.1medium347198
CVE-2023-3847MooDating 1.2 - Cross-Site scriptingmoodating6.1medium347198
CVE-2023-3848MooDating 1.2 - Cross-site scriptingmoodating6.1medium347198
CVE-2023-3849mooDating 1.2 - Cross-site scriptingmoodating6.1medium347198
CVE-2023-38501CopyParty v1.8.6 - Cross Site Scriptingcopyparty6.1medium347198
CVE-2023-38875PHP Login System 2.0.1 - Cross-Site Scriptingphp-login-system6.1medium341266
CVE-2023-38910CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )csz cms6.1MEDIUM333141
CVE-2023-38964Academy LMS 6.0 - Cross-Site Scriptingacademy_lms6.1medium347198
CVE-2023-3936Blog2Social < 7.2.1 - Cross-Site Scriptingblog2social6.1medium347198
CVE-2023-39598IceWarp Email Client - Cross Site Scriptingwebclient6.1medium333141
CVE-2023-39600IceWarp 11.4.6.0 - Cross-Site Scriptingicewarp6.1medium333141
CVE-2023-39676PrestaShop fieldpopupnewsletter Module - Cross Site Scriptingfieldpopupnewsletter6.1medium341266
CVE-2023-39700IceWarp Mail Server v10.4.5 - Cross-Site Scriptingmail_server6.1medium333140
CVE-2023-3990Mingsoft MCMS < 5.3.1 - Cross-Site Scriptingmcms6.1MEDIUM342259
CVE-2023-40750PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scriptingyacht_listing_script6.1medium333141
CVE-2023-40751PHPJabbers Fundraising Script v1.0 - Cross-Site Scriptingfundraising_script6.1medium333141
CVE-2023-40752PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scriptingmake_an_offer_widget6.1medium333141
CVE-2023-40755PHPJabbers Callback Widget v1.0 - Cross-Site Scriptingcallback_widget6.1MEDIUM341266
CVE-2023-4110PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scriptingavailability_booking_calendar6.1medium341266
CVE-2023-4111PHPJabbers Bus Reservation System 1.1 - Cross-Site Scriptingbus_reservation_system6.1medium341266
CVE-2023-4112PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scriptingshuttle_booking_software6.1medium341266
CVE-2023-4113PHPJabbers Service Booking Script 1.0 - Cross Site Scriptingservice_booking_script6.1medium341266
CVE-2023-4114PHP Jabbers Night Club Booking 1.0 - Cross Site Scriptingnight_club_booking_software6.1medium341266
CVE-2023-4115PHPJabbers Cleaning Business 1.0 - Cross-Site Scriptingcleaning_business_software6.1medium341266
CVE-2023-4116PHPJabbers Taxi Booking 2.0 - Cross Site Scriptingtaxi_booking_script6.1medium341266
CVE-2023-4136CrafterCMS Engine - Cross-Site Scriptingcraftercms6.1medium341266
CVE-2023-4148Ditty < 3.1.25 - Cross-Site Scriptingditty6.1medium341266
CVE-2023-4151Store Locator WordPress < 1.4.13 - Cross-Site Scriptingstore_locator6.1MEDIUM377360
CVE-2023-41538PHPJabbers PHP Forum Script 3.0 - Cross-Site Scriptingphp_forum_script6.1medium341266
CVE-2023-41597EyouCms v1.6.2 - Cross-Site Scriptingeyoucms6.1MEDIUM341266
CVE-2023-41621Emlog Pro v2.1.14 - Cross-Site Scriptingemlog6.1medium350148
CVE-2023-4173mooSocial 3.1.8 - Reflected XSSmoostore6.1medium347198
CVE-2023-4174mooSocial 3.1.6 - Reflected Cross Site Scriptingmoostore6.1medium347198
CVE-2023-4284WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scriptingpost-timeline6.1MEDIUM347198, 377360
CVE-2023-43325MooSocial 3.1.8 - Cross-Site Scriptingmoosocial6.1medium347198
CVE-2023-43326MooSocial 3.1.8 - Cross-Site Scriptingmoosocial6.1medium347198
CVE-2023-44012mojoPortal v.2.7.0.0 - Cross-Site Scriptingmojoportal6.1medium347198
CVE-2023-44352Adobe Coldfusion - Cross-Site Scriptingcoldfusion6.1medium341266, 347198
CVE-2023-44393Piwigo - Cross-Site Scriptingpiwigo6.1medium341266
CVE-2023-4451Cockpit - Cross-Site Scriptingcockpit6.1medium347198
CVE-2023-44812mooSocial v.3.1.8 - Cross-Site Scriptingmoosocial6.1MEDIUM341266
CVE-2023-45136XWiki < 14.10.14 - Cross-Site Scriptingxwiki6.1medium341266
CVE-2023-4547SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scriptingecommerce_cms6.1medium341266
CVE-2023-45542MooSocial 3.1.8 - Cross-Site Scriptingmoosocial6.1medium341266
CVE-2023-46020Blood Bank v1.0 - Stored Cross Site Scripting (XSS)blood bank6.1MEDIUM333141
CVE-2023-46732XWiki < 14.10.14 - Cross-Site Scriptingxwiki6.1medium341266
CVE-2023-47684Essential Grid <= 3.1.0 - Cross-Site Scriptingessential_grid6.1medium341266
CVE-2023-48728WWBN AVideo 11.6 - Cross-Site Scriptingavideo6.1medium341266
CVE-2023-49293Vite dev server - Cross-Site Scripting-6.1medium341266
CVE-2023-49489KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)kodexplorer6.1medium342259
CVE-2023-49494DedeCMS v5.7.111 - Cross-Site Scriptingdedecms6.1medium340095
CVE-2023-4973Academy LMS 6.2 - Cross-Site Scriptingacademy_lms6.1medium340147
CVE-2023-5244Microweber < V.2.0 - Cross-Site Scriptingmicroweber6.1medium393655
CVE-2023-5558LearnPress < 4.2.5.5 - Cross-Site Scriptinglearnpress6.1MEDIUM390722, 392301
CVE-2023-5863phpMyFAQ < 3.2.0 - Cross-site ScriptingphpMyFAQ6.1medium333141
CVE-2023-6275TOTVS Fluig Platform - Cross-Site Scriptingfluig6.1medium341266
CVE-2023-6379OpenCMS 14 & 15 - Cross Site Scriptingopencms6.1medium341266
CVE-2023-6568Mlflow - Cross-Site Scriptingmlflow6.1medium334168
CVE-2023-6697WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scriptingwp_go_maps6.1medium347198
CVE-2024-11587idcCMS V1.60 - Cross-Site Scriptingidccms6.1medium341266
CVE-2024-12732AffiliateImporterEb <= 1.0.6 - Reflected XSSaffiliateimportereb6.1MEDIUM377360
CVE-2024-12734Advance Post Prefix WordPress plugin - Reflected XSSadvance_post_prefix6.1MEDIUM377360
CVE-2024-12737WP BASE Booking - Reflected XSSwp base booking of appointments, services and events6.1MEDIUM377360
CVE-2024-12873Custom Field Manager WordPress - Cross-Site Scriptingcustom_field_manager6.1MEDIUM377360
CVE-2024-13112WP MediaTagger <= 4.1.1 - Cross-Site Scriptingwp_mediatagger6.1MEDIUM377360
CVE-2024-13114WP Projects Portfolio <= 3.0 - Cross-Site Scriptingwp_projects_portfolio_with_client_testimonials6.1MEDIUM377360
CVE-2024-13219Privacy Policy Genius - Cross-Site Scriptingprivacy_policy_genius6.1MEDIUM377360
CVE-2024-13220WordPress Google Map Professional - Cross-Site Scriptinggoogle_map_professional6.1MEDIUM377360
CVE-2024-13221Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scriptingfantastic_elasticsearch6.1MEDIUM377360
CVE-2024-13224SlideDeck 1 Lite Content Slider - Cross-Site Scriptingslidedeck_1_lite_content_slider6.1MEDIUM377360
CVE-2024-13225ECT Home Page Products - Reflected XSSect_home_page_products6.1MEDIUM377360
CVE-2024-13226A5 Custom Login Page - Reflected XSSa5 custom login page6.1MEDIUM377360
CVE-2024-13325Glossy WordPress - Reflected XSSglossy6.1MEDIUM377360
CVE-2024-13326iBuildApp <= 0.2.0 - Reflected Cross-Site Scriptingibuildapp6.1MEDIUM377360
CVE-2024-13327Musicbox WordPress - Reflected XSSmusicbox6.1MEDIUM377360
CVE-2024-13331WP Dream Carousel < 1.0.1b - Cross-Site Scriptingwp_dream_carousel6.1MEDIUM377360
CVE-2024-13492Guten Free Options - Cross Site Scriptingguten_free_options6.1MEDIUM377360
CVE-2024-13543Zarinpal Paid Download - Reflected XSSzarinpal_paid_download6.1MEDIUM377360
CVE-2024-13570WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scriptingstray_random_quotes6.1MEDIUM377360
CVE-2024-13619LifterLMS < 8.0.1 - Cross-Site Scriptinglifterlms6.1MEDIUM377360
CVE-2024-13628WP Pricing Table - Reflected XSSwp pricing table6.1MEDIUM377360
CVE-2024-13630NewsTicker <= 1.0 - Reflected Cross-Site Scriptingnewsticker6.1MEDIUM377360
CVE-2024-13634Post Sync Plugin <= 1.1 - Cross-Site Scriptingpost_sync6.1MEDIUM377360
CVE-2024-13727MemberSpace WordPress - Cross-Site Scripting-6.1medium341266
CVE-2024-13853WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scriptingseo-automatic-seo-tools6.1MEDIUM341266
CVE-2024-24131SuperWebMailer 9.31.0.01799 - Cross-Site Scriptingsuperwebmailer6.1medium341266
CVE-2024-24494Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)daily habit tracker6.1MEDIUM340147
CVE-2024-25669CaseAware a360inc - Cross-Site Scriptingcaseaware6.1medium347198
CVE-2024-29138WordPress Restrict User Access <= 2.5 - Cross-Site Scriptingrestrict user access6.1MEDIUM377360
CVE-2024-29792Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scriptingunlimited elements for elementor6.1MEDIUM377360
CVE-2024-29931WP Go Maps <= 9.0.29 - Cross-Site Scriptingwp_go_maps6.1MEDIUM341266, 377360
CVE-2024-30194Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scriptingsunshine-photo-cart6.1MEDIUM377360
CVE-2024-3032WordPress Themify Builder < 7.5.8 - Open Redirectbuilder6.1MEDIUM377360
CVE-2024-3231Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting-6.1medium340147
CVE-2024-3469GP Premium <= 2.4.0 - Cross-Site Scriptinggp-premium6.1medium341266
CVE-2024-35693WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting12-step-meeting-list6.1medium347198
CVE-2024-37259WP Extended < 3.0.0 - Stored Cross-Site Scriptingwp-extended6.1medium340147
CVE-2024-37261WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scriptingwp-lister-lite-for-amazon6.1MEDIUM377360
CVE-2024-39646WordPress Custom 404 Pro <= 3.11.1 - Reflected XSScustom_404_pro6.1MEDIUM377360
CVE-2024-41810Twisted - Open Redirect & XSStwisted6.1MEDIUM341266
CVE-2024-43971Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scriptingsunshine-photo-cart6.1MEDIUM377360
CVE-2024-4439WordPress Core <6.5.2 - Cross-Site Scriptingwordpress6.1MEDIUM377360
CVE-2024-4455YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scriptingyith-woocommerce-ajax-search6.1MEDIUM377360
CVE-2024-47374LiteSpeed Cache <= 6.5.0.2 - Stored XSSlitespeed cache6.1MEDIUM377360
CVE-2024-55218IceWarp Server 10.2.1 - Cross-Site Scriptingmail_server6.1medium333141
CVE-2024-6651WordPress File Upload Plugin < 4.24.8 - Cross-Site Scriptingwp-file-upload6.1MEDIUM341266, 377360
CVE-2024-6753Social Auto Poster <= 5.3.14 - Stored Cross-Site Scriptingsocial auto poster6.1MEDIUM377360
CVE-2024-6892Journyx 11.5.4 - Reflected Cross Site Scriptingjournyx6.1medium333141
CVE-2024-7313Shield Security Plugin < 20.0.6 - Cross-Site Scripting-6.1medium341266
CVE-2024-7354Ninja Forms 3.8.6-3.8.10 - Cross-Site Scriptingninja_forms6.1MEDIUM341266, 377360
CVE-2024-9007123Solar 1.8.4.5 - Cross-Site Scripting123solar6.1medium340147
CVE-2025-25296Label Studio < 1.16.0 - Cross-Site Scriptinglabel-studio6.1MEDIUM347198
CVE-2025-2709Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptingufida_erp-nc6.1medium347198
CVE-2025-2711Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptingufida_erp-nc6.1medium347198
CVE-2025-2712Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptingufida_erp-nc6.1medium347198
CVE-2025-34141ETQ Reliance - Reflected XSS via SQLConverterServletreliance6.1medium347198
CVE-2025-41393Ricoh Web Image Monitor - Reflected XSS-6.1medium341266
CVE-2025-44136MapTiler Tileserver-php v2.0 - Unauthenticated XSS-6.1medium342259
CVE-2025-4576Liferay Portal & DXP - Cross-Site Scripting-6.1medium341266
CVE-2025-46349YesWiki Reflected XSS via File Upload-6.1high347198
CVE-2025-4652Broadstreet WordPress plugin - Reflected XSSbroadstreet6.1MEDIUM377360
CVE-2025-5301ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting-6.1medium341266
CVE-2025-53533Pi-hole Reflected XSS in 404-Error Pageweb_interface6.1medium347198
CVE-2025-54597Heimdall Application Dashboard < 2.7.3 - Reflected XSSheimdall6.1MEDIUM347198
CVE-2025-6174WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)-6.1medium341266
CVE-2026-1296Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect-6.1MEDIUM377360
CVE-2026-15094WP Hotel Booking <= 2.3.2 - Cross-Site Scriptingwp-hotel-booking6.1MEDIUM300002
CVE-2026-24128XWiki Platform Distribution Flavor Main - Cross-Site Scriptingxwiki-platform-distribution-flavor-main6.1medium347198
CVE-2026-25616Blesta <= 5.13.1 - Cross-Site Scripting-6.1medium340112
CVE-2026-27176MajorDoMo - Cross-Site Scripting-6.1medium347198
CVE-2026-29183SiYuan Note - Cross-Site Scriptingsiyuan6.1medium341266, 347198
CVE-2026-40105XWiki - Cross-Site Scriptingxwiki-platform6.1medium341266
CVE-2026-50229Apache Tomcat - Cross-Site Scriptingtomcat6.1MEDIUM341266
CVE-2026-52774YesWiki Bazar Widget - Reflected XSS via 'id' Parameteryeswiki6.1medium333141
CVE-2017-8295WordPress Core < 4.7.4 - Unauthorized Password Resetwordpress5.9MEDIUM377360
CVE-2018-1271Spring MVC Framework - Local File Inclusionspring_framework5.9medium390716
CVE-2021-40149Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosuree1_zoom5.9medium390716
CVE-2024-13609WordPress 1 Click Migration Plugin < 2.3 - Information Exposure1-click-migration5.9medium350590
CVE-2024-3753Hostel < 1.1.5.3 - Cross-Site Scriptinghostel5.9MEDIUM341266, 377360
CVE-2025-24963Vitest Browser Mode - Local File Read-5.9medium347009
CVE-2025-28906Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingThiago S.F. Skitter Slideshow wp-skitter-slideshow5.9MEDIUM377360
CVE-2025-41242Spring Framework - Path Traversal-5.9medium347009
CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryWordPress5.9MEDIUM340156, 344370
CVE-2010-0467Joomla! Component CCNewsLetter - Local File Inclusioncom_ccnewsletter5.8MEDIUM347009
CVE-2012-4982Forescout CounterACT 6.3.4.1 - Open Redirectcounteract5.8medium340162
CVE-2012-6499WordPress Plugin Age Verification v0.4 - Open Redirectage_verification5.8medium392301
CVE-2014-0867IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits5.8MEDIUM392301
CVE-2017-9965Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversalpelco_videoxpert5.8medium390716
CVE-2020-5775Canvas LMS v2020-07-29 - Blind Server-Side Request Forgerycanvas_learning_management_service5.8medium340162
CVE-2023-47218QNAP QTS and QuTS Hero - OS Command Injectionqts5.8medium330791
CVE-2024-20404Cisco Finesse - Server-Side Request Forgery (SSRF)-5.8medium392301
CVE-2024-6095LocalAI - Partial Local File Readlocalai5.8MEDIUM344360
CVE-2025-47423Personal Weather Station Dashboard 12 - Directory Traversal-5.8MEDIUM340007
CVE-2025-1035KLog Server - Path Traversalklog_server5.7medium347009
CVE-2018-13980Zeta Producer Desktop CMS <14.2.1 - Local File Inclusionzeta_producer5.5medium347009
CVE-2018-15536Responsive FileManager < 9.13.4 - Directory Traversalresponsive filemanager5.5MEDIUM347009, 390720, 390727, 392648
CVE-2025-59342esm.sh <= v136 - Arbitrary File Write via Path Traversalesm.sh5.5MEDIUM340162
CVE-2014-8674SO Planning 1.32 - Multiple Vulnerabilitiessoplanning5.4MEDIUM340155, 390726, 392647
CVE-2016-10993ScoreMe Theme - Cross-Site Scriptingscoreme5.4MEDIUM341266
CVE-2017-12544HPE System Management - Cross-Site Scriptingsystem_management_homepage5.4medium344366
CVE-2017-14186FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scriptingfortios5.4medium350148
CVE-2017-14725WordPress < 4.8.2 - Authenticated Open Redirectwordpress5.4MEDIUM377360
CVE-2017-17092WordPress < 4.9.1 - Authenticated JavaScript File Uploadwordpress5.4MEDIUM377360
CVE-2017-3131Fortinet FortiOS < 5.6.0 - Cross-Site Scriptingfortios5.4MEDIUM340147, 341266, 347198, 390727, 392648
CVE-2017-3528Oracle E-Business Suite 12.1.3/12.2.x - Open Redirectapplications_framework5.4medium344365
CVE-2017-6340Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilitiesinterscan web security virtual appliance5.4MEDIUM340147, 390724
CVE-2018-12095OEcms 3.1 - Cross-Site Scriptingoecms5.4medium341266
CVE-2018-15917Jorani Leave Management System 0.6.5 - Cross-Site Scriptingjorani5.4medium341266
CVE-2018-16363WordPress File Manager < 3.0 - Cross-Site Scriptingfile manager5.4MEDIUM377360
CVE-2018-16736Roundcube rcfilters plugin 2.1.6 - Cross-Site Scriptingrcfilters5.4MEDIUM340147
CVE-2018-5405KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilitieskace systems management appliance firmware5.4MEDIUM390727, 392301, 392648
CVE-2019-11269Spring Security OAuth - Open Redirectorspring security oauth5.4MEDIUM390703, 390727, 392648
CVE-2019-11370Carel pCOWeb <B1.2.4 - Cross-Site Scriptingpcoweb_card_firmware5.4medium342259
CVE-2019-9556Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scriptingan5506-04-f firmware5.4MEDIUM340147
CVE-2020-11110Grafana <= 6.7.1 - Cross-Site Scriptinggrafana5.4MEDIUM350148
CVE-2020-11456LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scriptinglimesurvey5.4MEDIUM333141
CVE-2020-11457pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scriptingpfsense5.4MEDIUM333141
CVE-2020-12256rConfig 3.9.4 - Cross-Site Scriptingrconfig5.4medium341266
CVE-2020-12259rConfig 3.9.4 - Cross-Site Scriptingrconfig5.4medium341266
CVE-2020-12262Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scriptingtip3005.4medium341266
CVE-2020-12706php-fusion 9.03.50 - Persistent Cross-Site Scriptingphp-fusion5.4MEDIUM340147
CVE-2020-20285ZZcms - Cross-Site Scriptingzzcms5.4medium333141
CVE-2020-20988DomainMOD 4.13.0 - Cross-Site Scriptingdomainmod5.4medium340147
CVE-2020-24963Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)best support system5.4MEDIUM333141
CVE-2020-27533DedeCMS v.5.8 - keyword Cross-Site Scriptingdedecms5.4MEDIUM340147
CVE-2020-35774twitter-server Cross-Site Scriptingtwitter-server5.4medium341266
CVE-2020-7108WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scriptinglearndash5.4MEDIUM341266, 390727, 392648
CVE-2021-25065Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scriptingsmash_balloon_social_post_feed5.4medium347198
CVE-2021-25067Landing Page Builder < 1.4.9.6 - Cross-Site Scriptinglanding_page5.4medium347198
CVE-2021-31250CHIYU TCP/IP Converter - Cross-Site Scriptingbf-430_firmware5.4medium341266
CVE-2021-33851WordPress Customize Login Image <3.5.3 - Cross-Site Scriptingcustomize_login_image5.4MEDIUM377360
CVE-2021-36873WordPress iQ Block Country <=1.2.11 - Cross-Site Scriptingiq_block_country5.4MEDIUM377360
CVE-2021-3831Gnuboard 5 - Cross-Site Scriptinggnuboard55.4medium341266
CVE-2021-46005Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scriptingcar_rental_management_system5.4medium340147
CVE-2022-0148WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scriptingmystickyelements5.4medium347198
CVE-2022-0378Microweber Cross-Site Scriptingmicroweber5.4medium347198
CVE-2022-0765WordPress Loco Translate < 2.6.1 - Cross-Site Scriptingloco translate5.4MEDIUM377360
CVE-2022-0928Microweber < 1.2.12 - Stored Cross-Site Scriptingmicroweber5.4medium333141
CVE-2022-0954Microweber <1.2.11 - Stored Cross-Site Scriptingmicroweber5.4medium333141
CVE-2022-25489Atom CMS v2.0 - Cross-Site Scriptingatomcms5.4medium341266
CVE-2022-3506WordPress Related Posts <2.1.3 - Stored Cross-Site Scriptingrelated_posts5.4MEDIUM377360
CVE-2022-3933WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scriptingessential_real_estate5.4medium341266
CVE-2022-3934WordPress FlatPM <3.0.13 - Cross-Site Scriptingflat_pm5.4medium347198
CVE-2022-4306WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scriptingpanda_pods_repeater_field5.4medium350148
CVE-2023-0902Employee Task Management System v1.0 - SQL Injection on edit-task.phpsimple food ordering system5.4MEDIUM340016
CVE-2023-1315osTicket < v1.16.6 - Cross-Site Scriptingosticket5.4MEDIUM341266
CVE-2023-1318osTicket < v1.16.6 - Cross-Site Scriptingosticket5.4MEDIUM341266
CVE-2023-26842ChurchCRM 4.5.3 - Cross-Site Scriptingchurchcrm5.4medium333141
CVE-2023-26843ChurchCRM 4.5.3 - Cross-Site Scriptingchurchcrm5.4medium333141
CVE-2023-2745WordPress Core <=6.2 - Directory Traversalwordpress5.4MEDIUM344360
CVE-2023-28665Woo Bulk Price Update <2.2.2 - Cross-Site Scriptingbulk_price_update_for_woocommerce5.4medium347198
CVE-2023-31548ChurchCRM v4.5.3 - Cross-Site Scriptingchurchcrm5.4medium333141
CVE-2023-34537Hoteldruid 3.0.5 - Cross-Site Scriptinghoteldruid5.4medium340130, 340147
CVE-2023-38911CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')csz cms5.4MEDIUM333141
CVE-2023-40753PHPJabbers Ticket Support Script v3.2 - Cross-Site Scriptingticket_support_script5.4medium341266
CVE-2023-4382Hyip Rio 2.1 - Arbitrary File Uploadhyip rio5.4MEDIUM392301
CVE-2023-6030LogDash Activity Log <= 1.1.3 - SQL Injectionlogdash activity log5.4MEDIUM380122
CVE-2023-7246System Dashboard < 2.8.10 - Cross-Site Scriptingsystem dashboard5.4MEDIUM377360
CVE-2024-10146Simple File List < 6.1.13 - Reflected Cross-Site Scriptingsimple_file_list5.4MEDIUM377360
CVE-2024-13097WP Finance Plugin <= 1.3.6 - Cross-Site Scriptingwp_finance5.4MEDIUM377360
CVE-2024-13098WordPress Email Newsletter - Reflected XSSwordpress_email_newsletter5.4MEDIUM377360
CVE-2024-13099Widget4Call WordPress - Cross-Site Scriptingwidget4call5.4MEDIUM377360
CVE-2024-21485Dash Framework - Cross-site Scriptingdash5.4MEDIUM350148
CVE-2024-33326LumisXP - Cross-site Scriptinglumis_experience_platform5.4medium341266
CVE-2024-48120X2CRM 8.5 - Stored Cross-Site Scripting (XSS)x2crm5.4MEDIUM340147, 390726, 392647
CVE-2024-52762Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scriptingganglia-web5.4medium341266
CVE-2024-52763Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scriptingganglia-web5.4medium347198
CVE-2025-27506NocoDB < 0.258.0 - Reflected XSS in Password Reset-5.4medium347198
CVE-2025-32970XWiki WYSIWYG API - Open Redirectxwiki5.4medium340162
CVE-2025-34032Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting-5.4medium341266
CVE-2025-44148MailEnable Mail Service < v10 - Cross-Site Scripting-5.4medium344363
CVE-2026-1207Django RasterField - SQL Injectiondjango5.4MEDIUM341245
CVE-2013-2683Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware5.3MEDIUM392301
CVE-2014-8676SO Planning 1.32 - Multiple Vulnerabilitiessoplanning5.3MEDIUM340155, 347009, 390726, 392647
CVE-2014-8677SO Planning 1.32 - Multiple Vulnerabilitiessoplanning5.3MEDIUM340155, 390726, 392647
CVE-2014-9609Netsweeper 4.0.8 - Directory Traversalnetsweeper5.3medium347009
CVE-2015-2826WordPress Plugin Simple Ads Manager - Information Disclosuresimple ads manager5.3MEDIUM344370
CVE-2015-5471Swim Team <= v1.44.10777 - Local File Inclusionswim_team5.3medium347009
CVE-2017-9978QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilitiesquantastor5.3MEDIUM392301
CVE-2018-16059WirelessHART Fieldgate SWG70 3.0 - Local File Inclusionwirelesshart_fieldgate_swg70_firmware5.3medium392301
CVE-2018-3167Oracle E-Business Suite - Blind SSRFapplication_management_pack5.3medium392301
CVE-2019-17503Kirona Dynamic Resource Scheduler - Information Disclosuredynamic_resource_scheduling5.3medium312863
CVE-2019-18393Ignite Realtime Openfire <4.42 - Local File Inclusionopenfire5.3medium347019
CVE-2019-8446Jira Improper Authorizationjira_server5.3medium392301
CVE-2020-11798Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversalmicollab_audio,web&amp;_video_conferencing5.3medium347009
CVE-2021-20150Trendnet AC2600 TEW-827DRU - Credentials Disclosuretew-827dru_firmware5.3medium392301
CVE-2021-23241MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusionmercury_x18g_firmware5.3medium347009
CVE-2021-26085Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Readconfluence data center5.3MEDIUM390727, 392301, 392648
CVE-2021-26086Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Readjira data center5.3MEDIUM345113, 390727, 392301, 392648
CVE-2021-28377Joomla! ChronoForums 2.0.11 - Local File Inclusionchronoforums5.3medium347009
CVE-2021-34429Eclipse Jetty 11.0.5 - Sensitive File Disclosurejetty5.3MEDIUM390703
CVE-2021-4191GitLab GraphQL API User Enumerationgitlab5.3MEDIUM344361
CVE-2022-25356Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injectionsecuritygateway5.3medium390716
CVE-2022-25497Cuppa CMS v1.0 - Local File Inclusioncuppacms5.3MEDIUM344360
CVE-2022-28666Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update-5.3medium392301
CVE-2022-31062GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusionglpi inventory5.3MEDIUM344360
CVE-2023-2059DedeCMS 5.7.87 - Directory Traversaldedecms5.3medium347019
CVE-2023-30943Moodle - Cross-Site Scripting/Remote Code Executionmoodle5.3medium347198
CVE-2023-41599JFinalCMS v5.0.0 - Directory Traversaljfinalcms5.3medium347009
CVE-2023-44982WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposureperfect-images5.3medium390716
CVE-2024-2473WPS Hide Login <= 1.9.15.2 - Login Page Disclosurewps-hide-login5.3MEDIUM377360
CVE-2024-28397pyload-ng js2py - Remote Code Executionpyload5.3medium340014
CVE-2024-53586WebFileSys 2.31.0 - Directory Path Traversal-5.3MEDIUM340007, 390726, 392647
CVE-2024-7339TVT DVR Sensitive Device - Information Disclosure-5.3medium392301
CVE-2024-8852All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosureall-in-one wp migration5.3MEDIUM390716
CVE-2025-10493Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie-5.3MEDIUM390726, 392647
CVE-2025-11368LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposurelearnpress5.3MEDIUM344365
CVE-2025-14528D-Link DIR-803 - Authentication Bypass-5.3high390722
CVE-2025-1743Pichome 2.1.0 - Arbitrary File ReadPichome5.3high347009
CVE-2025-2710Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptingufida_erp-nc5.3MEDIUM341266
CVE-2025-31125Vite Development Server - Path Traversal-5.3medium347009
CVE-2025-31486Vite server.fs.deny Bypass - Local File Inclusion-5.3medium347009
CVE-2025-4427Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Executionendpoint_manager_mobile5.3critical393655
CVE-2025-46550YesWiki < 4.5.4 - Cross-Site Scriptingyeswiki5.3medium341266
CVE-2025-46565Vite Dev Server - Information Exposure-5.3medium390709
CVE-2025-5569IdeaCMS <= 1.7 - SQL InjectionIdeaCMS5.3MEDIUM341245
CVE-2026-23483Blinko <= 1.8.3 - Path Traversal via /pluginsblinko5.3medium347009
CVE-2026-8385WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosurewp-google-maps5.3MEDIUM344365
CVE-2026-50230Lyrion Music Server <= 9.2.0 - Cross-Site Scriptingthe server.log endpoint that5.1MEDIUM341266
CVE-2000-0114Microsoft FrontPage Extensions - Information Disclosureinternet_information_server5.0MEDIUM392301
CVE-2006-3392Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosurewebmin5.0MEDIUM347009
CVE-2006-3835toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilitiestomcat5.0MEDIUM392301
CVE-2007-4504Joomla! RSfiles <=1.0.2 - Local File Inclusionrsfiles5.0MEDIUM347009
CVE-2008-4764Joomla! <=2.0.0 RC2 - Local File Inclusioncom_extplorer5.0MEDIUM347009
CVE-2008-6080Joomla! ionFiles 4.4.2 - Local File Inclusioncom_ionfiles5.0MEDIUM347009
CVE-2008-6222Joomla! ProDesk 1.0/1.2 - Local File Inclusionpro_desk_support_center5.0MEDIUM347009
CVE-2008-6668nweb2fax <=0.2.7 - Local File Inclusionnweb2fax5.0MEDIUM347009
CVE-2009-1496Joomla! Cmimarketplace 0.1 - Local File Inclusionjoomla5.0MEDIUM347009
CVE-2009-2100Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusionjoomla5.0MEDIUM347009
CVE-2009-5114WebGlimpse 2.18.7 - Directory Traversalwebglimpse5.0MEDIUM347009
CVE-2010-0696Joomla! Component Jw_allVideos - Arbitrary File Retrievaljw_allvideos5.0MEDIUM347009
CVE-2010-0942Joomla! Component com_jvideodirect - Directory Traversalcom_jvideodirect5.0MEDIUM347009
CVE-2010-0943Joomla! Component com_jashowcase - Directory Traversalcom_jashowcase5.0MEDIUM347009
CVE-2010-0944Joomla! Component com_jcollection - Directory Traversalcom_jcollection5.0MEDIUM347009
CVE-2010-1081Joomla! Component com_communitypolls 1.5.2 - Local File Inclusioncom_communitypolls5.0MEDIUM347009
CVE-2010-1302Joomla! Component DW Graph - Local File Inclusioncom_dwgraphs5.0MEDIUM347009
CVE-2010-1304Joomla! Component User Status - Local File Inclusioncom_userstatus5.0MEDIUM347009
CVE-2010-1305Joomla! Component JInventory 1.23.02 - Local File Inclusioncom_jinventory5.0MEDIUM347009
CVE-2010-1307Joomla! Component Magic Updater - Local File Inclusioncom_joomlaupdater5.0MEDIUM347009
CVE-2010-1308Joomla! Component SVMap 1.1.1 - Local File Inclusioncom_svmap5.0MEDIUM347009
CVE-2010-1312Joomla! Component News Portal 1.5.x - Local File Inclusioncom_news_portal5.0MEDIUM347009
CVE-2010-1314Joomla! Component Highslide 1.5 - Local File Inclusioncom_hsconfig5.0MEDIUM347009
CVE-2010-1315Joomla! Component webERPcustomer - Local File Inclusioncom_weberpcustomer5.0MEDIUM347009
CVE-2010-1340Joomla! Component com_jresearch - 'Controller' Local File Inclusioncom_jresearch5.0MEDIUM347009
CVE-2010-1345Joomla! Component Cookex Agency CKForms - Local File Inclusioncom_ckforms5.0MEDIUM347009
CVE-2010-1352Joomla! Component Juke Box 1.7 - Local File Inclusioncom_jukebox5.0MEDIUM347009
CVE-2010-1353Joomla! Component LoginBox - Local File Inclusioncom_loginbox5.0MEDIUM347009
CVE-2010-1354Joomla! Component VJDEO 1.0 - Local File Inclusioncom_vjdeo5.0MEDIUM347009
CVE-2010-1429Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosurejboss_enterprise_application_platform5.0MEDIUM382240
CVE-2010-1461Joomla! Component Photo Battle 1.0.1 - Local File Inclusioncom_photobattle5.0MEDIUM347009
CVE-2010-1491Joomla! Component MMS Blog 2.3.0 - Local File Inclusioncom_mmsblog5.0MEDIUM347009
CVE-2010-1494Joomla! Component AWDwall 1.5.4 - Local File Inclusioncom_awdwall5.0MEDIUM347009
CVE-2010-1532Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusioncom_powermail5.0MEDIUM347009
CVE-2010-1534Joomla! Component Shoutbox Pro - Local File Inclusioncom_shoutbox5.0MEDIUM347009
CVE-2010-1540Joomla! Component com_blog - Directory Traversalcom_myblog5.0MEDIUM347009
CVE-2010-1601Joomla! Component JA Comment - Local File Inclusioncom_jacomment5.0MEDIUM347009
CVE-2010-1657Joomla! Component SmartSite 1.0.0 - Local File Inclusioncom_smartsite5.0MEDIUM347009
CVE-2010-1658Joomla! Component NoticeBoard 1.3 - Local File Inclusioncom_noticeboard5.0MEDIUM347009
CVE-2010-1659Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusioncom_ultimateportfolio5.0MEDIUM347009
CVE-2010-1714Joomla! Component Arcade Games 1.0 - Local File Inclusioncom_arcadegames5.0MEDIUM347009
CVE-2010-1858Joomla! Component SMEStorage - Local File Inclusioncom_smestorage5.0MEDIUM347009
CVE-2010-1982Joomla! Component JA Voice 2.0 - Local File Inclusioncom_javoice5.0MEDIUM347009
CVE-2010-2018Lokomedia CMS - Local File Inclusionlokomedia cms5.0MEDIUM347009
CVE-2010-2307Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversalsurfboard_sbv6120e5.0MEDIUM347009
CVE-2010-3203Joomla! Component PicSell 1.0 - Arbitrary File Retrievalcom_picsell5.0MEDIUM344360
CVE-2011-0049Majordomo2 - SMTP/HTTP Directory Traversalmajordomo_25.0medium347009
CVE-2011-1669WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)wp_custom_pages5.0medium347009
CVE-2011-2780Chyrp 2.x - Local File Inclusionchyrp5.0medium347009
CVE-2011-4804Joomla! Component com_kp - 'Controller' Local File Inclusioncom_obsuggest5.0medium347009
CVE-2011-4898WordPress Core 3.3.1 - Multiple Vulnerabilitieswordpress5.0MEDIUM340147, 390727, 392301, 392648
CVE-2012-0896Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Accesscount_per_day5.0medium347009
CVE-2012-0981phpShowtime 2.0 - Directory Traversalphpshowtime5.0medium347009
CVE-2012-099611in1 CMS 1.2.1 - Local File Inclusion (LFI)11in15.0medium347009
CVE-2012-5192Bitweaver 2.8.1 - Multiple Vulnerabilitiesbitweaver5.0MEDIUM340147, 380026
CVE-2012-5451TVMOBiLi 2.1.0.3557 - Denial of Servicetvmobili5.0MEDIUM390727, 392301, 392648
CVE-2012-5875FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereferencefirefly media server5.0MEDIUM390727, 392301, 392648
CVE-2012-5876Nero MediaHome 4.5.8.0 - Denial of Servicemediahome5.0MEDIUM390726, 390727, 392301, 392647, 392648
CVE-2012-5877Nero MediaHome 4.5.8.0 - Denial of Servicemediahome5.0MEDIUM390726, 390727, 392301, 392647, 392648
CVE-2013-5979Xibo 1.2.2/1.4.1 - Directory Traversalxibo5.0medium347009
CVE-2013-6043Webuzo 2.1.3 - Multiple Vulnerabilitieswebuzo5.0MEDIUM333140, 344360, 390726, 392647
CVE-2013-7091Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusionzimbra_collaboration_suite5.0medium347009, 390614
CVE-2013-7240WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversaladvanced_dewplayer5.0medium344360
CVE-2014-4577WP AmASIN – The Amazon Affiliate Shop - Local File Inclusionwp_amasin_-_the_amazon_affiliate_shop5.0MEDIUM347009
CVE-2014-4940WordPress Plugin Tera Charts - Local File Inclusiontera-charts5.0medium347009
CVE-2014-4941Cross RSS 1.7 - Local File Inclusionwp-cross-rss5.0MEDIUM347009
CVE-2014-5111Fonality trixbox - Local File Inclusiontrixbox5.0medium347009
CVE-2014-5181Last.fm Rotation 1.0 - Path Traversallastfm-rotation_plugin5.0MEDIUM347009
CVE-2014-5187Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversaltom-m8te_plugin5.0MEDIUM347009
CVE-2014-5368WordPress Plugin WP Content Source Control - Directory Traversalwp_content_source_control5.0medium344360
CVE-2014-6308Osclass Security Advisory 3.4.1 - Local File Inclusionosclass5.0medium347009
CVE-2014-8799WordPress Plugin DukaPress 2.5.2 - Directory Traversaldukapress5.0medium344360
CVE-2014-9119WordPress DB Backup <=4.5 - Local File Inclusiondb_backup5.0medium344360
CVE-2015-1579WordPress Slider Revolution - Local File Disclosuredivi5.0medium344360
CVE-2015-2067Magento Server MAGMI - Directory Traversalmagmi5.0medium347009
CVE-2015-2166Ericsson Drutt MSDP - Local File Inclusiondrutt_mobile_service_delivery_platform5.0medium347009
CVE-2015-3897Bonita BPM Portal <6.5.3 - Local File Inclusionbonita_bpm_portal5.0medium340007, 344360
CVE-2015-4414WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversalse_html5_album_audio_player5.0medium347009
CVE-2015-4666Xceedium Xsuite - Multiple Vulnerabilitiesxsuite5.0MEDIUM344360, 347009, 347198, 390726, 392647
CVE-2015-5285Kallithea 0.2.9 - 'came_from' HTTP Response Splittingkallithea5.0MEDIUM390722, 390727, 392648
CVE-2015-5531ElasticSearch <1.6.1 - Local File Inclusionelasticsearch5.0medium347009, 392301
CVE-2015-5688Geddy <13.0.8 - Local File Inclusiongeddy5.0medium347009
CVE-2014-0865IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.9MEDIUM392301
CVE-2014-0868IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.9MEDIUM392301
CVE-2015-4425Pimcore CMS Build 3450 - Directory Traversalpimcore4.9MEDIUM390726, 392647
CVE-2019-2588Oracle Business Intelligence - Path Traversalbusiness_intelligence_publisher4.9medium347019
CVE-2021-24966WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)error log viewer4.9MEDIUM344360
CVE-2022-2863WordPress WPvivid Backup <0.9.76 - Local File Inclusionmigration,_backup,_staging4.9MEDIUM377360
CVE-2022-40843Tenda AC1200 V-W15Ev2 - Authentication Bypassac1200_v-w15ev24.9medium390716
CVE-2023-34259Kyocera TASKalfa printer - Path Traversald-copia253mf_plus_firmware4.9medium347009
CVE-2024-10708System Dashboard < 2.8.15 - Admin+ Path Traversalsystem_dashboard4.9MEDIUM377360
CVE-2016-4807Web2py 2.14.5 - Multiple Vulnerabilitiesweb2py4.8MEDIUM344360
CVE-2017-14651WSO2 Data Analytics Server 3.1.0 - Cross-Site Scriptingapi_manager4.8medium347198
CVE-2018-1000856DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-1002001WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002002WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002003WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002004WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002005WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002006WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002007WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002008WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-1002009WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scriptingarigato autoresponder and newsletter4.8MEDIUM380122, 390726, 392647
CVE-2018-19749DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-19751DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-19752DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-19892DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-19914DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-19915DomainMOD <=4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-20009DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-20010DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2018-20011DomainMOD 4.11.01 - Cross-Site Scriptingdomainmod4.8medium340147
CVE-2019-15829Gallery Photoblocks < 1.1.43 - Cross-Site Scriptinggallery_photoblocks4.8medium347198
CVE-2020-29240LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scriptingleptoncms4.8MEDIUM333141
CVE-2020-29470OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scriptingopencart4.8MEDIUM342259
CVE-2020-29477Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scriptingcommunity4.8MEDIUM340147
CVE-2020-35241Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scriptingflatpress4.8MEDIUM344370, 390724
CVE-2020-9314Oracle iPlanet Web Server 7.0.x - Image Injectioniplanet_web_server4.8medium340162
CVE-2021-24681Duplicate Page WordPress - Stored Cross-Site Scriptingduplicate_page4.8MEDIUM377360
CVE-2021-24991WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scriptingwoocommerce_pdf_invoices&amp;_packing_slips4.8medium347198
CVE-2021-46068Vehicle Service Management System - Stored Cross-Site Scriptingvehicle_service_management_system4.8medium340147
CVE-2021-46069Vehicle Service Management System 1.0 - Stored Cross Site Scriptingvehicle_service_management_system4.8medium340147
CVE-2021-46071ehicle Service Management System 1.0 - Cross-Site Scriptingvehicle_service_management_system4.8medium340147
CVE-2021-46072Vehicle Service Management System 1.0 - Stored Cross Site Scriptingvehicle_service_management_system4.8medium340147
CVE-2021-46073Vehicle Service Management System 1.0 - Cross Site Scriptingvehicle_service_management_system4.8medium340147
CVE-2022-0535WordPress E2Pdf <1.16.45 - Cross-Site Scriptinge2pdf4.8MEDIUM377360
CVE-2022-0873WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scriptinggmedia_gallery4.8MEDIUM377360
CVE-2022-1029Limit Login Attempts - Stored Cross-Site Scriptinglimit login attempts4.8MEDIUM377360
CVE-2022-4260WordPress WP-Ban <1.69.1 - Stored Cross-Site Scriptingwp-ban4.8MEDIUM377360
CVE-2023-0563Bank Locker Management System - Cross-Site Scriptingbank_locker_management_system4.8medium340147
CVE-2023-2009Pretty Url <= 1.5.4 - Cross-Site Scriptingpretty_url4.8MEDIUM377360
CVE-2023-2178Aajoda Testimonials < 2.2.2 - Cross-Site Scriptingaajoda_testimonials4.8MEDIUM377360
CVE-2023-2224Seo By 10Web < 1.2.7 - Cross-Site Scriptingseo4.8MEDIUM377360
CVE-2022-2546WordPress All-in-One WP Migration <=7.62 - Cross-Site Scriptingall-in-one_wp_migration4.7MEDIUM377360
CVE-2023-45671Frigate < 0.13.0 Beta 3 - Cross-Site Scriptingfrigate4.7medium347198
CVE-2024-0986Issabel Authenticated - Remote Code Executionpbx4.7medium344362
CVE-2024-13627OWL Carousel Slider - Cross-Site Scriptingowl_carousel_slider4.7MEDIUM377360
CVE-2024-24050Workout Journal App 1.0 - Stored XSSworkout journal app4.7MEDIUM380026, 390727, 392301, 392648
CVE-2005-3128SquirrelMail Address Add 1.4.2 - Cross-Site Scriptingaddress add plugin4.3MEDIUM341266
CVE-2005-4385Cofax <=2.0RC3 - Cross-Site Scriptingcofax4.3MEDIUM341266
CVE-2006-1681Cherokee HTTPD <=0.5 - Cross-Site Scriptingcherokee_httpd4.3MEDIUM341266
CVE-2007-2449Apache Tomcat 4.x-7.x - Cross-Site Scriptingtomcat4.3MEDIUM341266
CVE-2007-3385Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosuretomcat4.3MEDIUM390727, 392301, 392648
CVE-2007-5728phpPgAdmin <=4.1.1 - Cross-Site Scriptingphppgadmin4.3MEDIUM341266
CVE-2008-1061WordPress Sniplets <=1.2.2 - Cross-Site Scriptingsniplets_plugin4.3MEDIUM341266
CVE-2008-1547Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirectionexchange_server4.3MEDIUM390716
CVE-2008-2398AppServ Open Project <=2.5.10 - Cross-Site Scriptingappserv4.3MEDIUM333141
CVE-2008-2938toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilitiestomcat4.3MEDIUM392301
CVE-2008-5587phpPgAdmin <=4.2.1 - Local File Inclusionphppgadmin4.3MEDIUM347009
CVE-2008-6465Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scriptingh-sphere4.3MEDIUM347198
CVE-2008-6982Devalcms 1.4a - Cross-Site Scriptingdevalcms4.3MEDIUM341266
CVE-2009-1872Adobe Coldfusion <=8.0.1 - Cross-Site Scriptingcoldfusion4.3MEDIUM341266
CVE-2010-0982Joomla! Component com_cartweberp - Local File Inclusioncom_cartweberp4.3MEDIUM347009
CVE-2010-1217Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusionje_form_creator4.3MEDIUM347009
CVE-2010-1313Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusioncom_sebercart4.3MEDIUM347009
CVE-2010-5278MODx manager - Local File Inclusionmodx_revolution4.3medium390614
CVE-2011-4451WikkaWiki 1.3.2 - Multiple Vulnerabilitieswikkawiki4.3MEDIUM344360, 390715, 390726, 392647
CVE-2011-4618Advanced Text Widget < 2.0.2 - Cross-Site Scriptingadvanced_text_widget_plugin4.3medium341266
CVE-2011-4624GRAND FlAGallery 1.57 - Cross-Site Scriptinggrand_flagallery4.3MEDIUM341266
CVE-2011-4926Adminimize 1.7.22 - Cross-Site Scriptingadminimize4.3MEDIUM341266
CVE-2011-5106WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scriptingflexible_custom_post_type4.3medium341266
CVE-2011-5107Alert Before Your Post <= 0.1.1 - Cross-Site Scriptingalert_before_you_post4.3MEDIUM341266
CVE-2011-5179Skysa App Bar 1.04 - Cross-Site Scriptingskysa_app_bar_integration_plugin4.3MEDIUM341266
CVE-2011-5181ClickDesk Live Support Live Chat 2.0 - Cross-Site Scriptingclickdesk_live_support-live_chat_plugin4.3MEDIUM341266
CVE-2011-5265Featurific For WordPress 1.6.2 - Cross-Site Scriptingfeaturific-for-wordpress4.3MEDIUM341266
CVE-2012-0285stoneware webnetwork6 - Multiple Vulnerabilitieswebnetwork4.3MEDIUM390726, 392301, 392647
CVE-2012-0782WordPress Core 3.3.1 - Multiple Vulnerabilitieswordpress4.3MEDIUM340147, 390727, 392301, 392648
CVE-2012-0901YouSayToo auto-publishing 1.0 - Cross-Site Scriptingyousaytoo4.3MEDIUM341266
CVE-2012-1835WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scriptingall-in-one_event_calendar4.3MEDIUM341266
CVE-2012-2371WP-FaceThumb 0.1 - Cross-Site Scriptingwp-facethumb4.3MEDIUM341266
CVE-2012-4242WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scriptingmf_gig_calendar4.3MEDIUM341266
CVE-2012-4253MySQLDumper 1.24.4 - Directory Traversalmysqldumper4.3medium347009
CVE-2012-42732 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting2-click-social-media-buttons4.3MEDIUM341266
CVE-2012-4547AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scriptingawstats4.3medium341266
CVE-2012-4768WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scriptingdownload_monitor4.3MEDIUM341266
CVE-2012-4889ManageEngine Firewall Analyzer 7.2 - Cross-Site Scriptingfirewall_analyzer4.3medium341266
CVE-2012-5913WordPress Integrator 1.32 - Cross-Site Scriptingwordpress_integrator4.3MEDIUM341266
CVE-2013-2287WordPress Plugin Uploader 1.0.4 - Cross-Site Scriptinguploader4.3MEDIUM341266
CVE-2013-2682Cisco Linksys E4200 - Multiple Vulnerabilitieslinksys e4200 firmware4.3MEDIUM392301
CVE-2013-3526WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scriptingtrafficanalyzer4.3MEDIUM341266
CVE-2013-4117WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scriptingcategory-grid-view-gallery4.3MEDIUM341266
CVE-2013-4625WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scriptingduplicator4.3MEDIUM341266
CVE-2013-6042Webuzo 2.1.3 - Multiple Vulnerabilitieswebuzo4.3MEDIUM333140, 344360, 390726, 392647
CVE-2013-6281WordPress Spreadsheet - Cross-Site Scriptingdhtmlxspreadsheet4.3medium341266
CVE-2014-0191eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injectionfusion middleware4.3MEDIUM390727, 392301, 392648
CVE-2014-0866IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.3MEDIUM392301
CVE-2014-0869IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.3MEDIUM392301
CVE-2014-0870IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.3MEDIUM392301
CVE-2014-0871IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits4.3MEDIUM392301
CVE-2014-1944Ilch CMS 2.0 - Persistent Cross-Site Scriptingilch cms4.3MEDIUM344370
CVE-2014-2908Siemens SIMATIC S7-1200 CPU - Cross-Site Scriptingsimatic_s7_cpu_1200_firmware4.3medium341266
CVE-2014-4513ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scriptingactivehelper_livehelp_live_chat4.3MEDIUM341266
CVE-2014-9094WordPress DZS-VideoGallery Plugin Cross-Site Scriptingvideo_gallery4.3MEDIUM341266
CVE-2014-9146Fiyo CMS 2.0.1.8 - Multiple Vulnerabilitiesfiyo cms4.3MEDIUM344360, 390720, 390726, 392647
CVE-2014-9444Frontend Uploader <= 0.9.2 - Cross-Site Scriptingfrontend_uploader4.3medium341266
CVE-2015-1389Aruba ClearPass Policy Manager - Persistent Cross-Site Scriptingclearpass policy manager4.3MEDIUM333141
CVE-2015-1880Fortinet FortiOS <=5.2.3 - Cross-Site Scriptingfortios4.3medium341266
CVE-2015-2068Magento Server Mass Importer - Cross-Site Scriptingmagmi4.3medium341266
CVE-2015-2275WoltLab Community Gallery - Persistent Cross-Site Scriptingcommunity gallery4.3MEDIUM340147, 390726, 392647
CVE-2015-2807Navis DocumentCloud <0.1.1 - Cross-Site Scriptingnavis_documentcloud4.3MEDIUM341266
CVE-2015-3337Elasticsearch - Local File Inclusionelasticsearch4.3medium347009
CVE-2015-4127WordPress Church Admin <0.810 - Cross-Site Scriptingchurch_admin4.3MEDIUM341266
CVE-2015-4665Xceedium Xsuite - Multiple Vulnerabilitiesxsuite4.3MEDIUM344360, 347198, 390726, 392647
CVE-2015-6402Cisco EPC 3928 - Multiple Vulnerabilitiesepc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter4.3MEDIUM333141, 340147, 344363, 390726, 392301, 392647
CVE-2015-6477Nordex NC2 - Cross-Site Scriptingnordex_control_2_scada4.3medium340147
CVE-2015-6920WordPress sourceAFRICA <=0.1.3 - Cross-Site Scriptingsourceafrica4.3MEDIUM341266
CVE-2018-18777Microstrategy Web 7 - Local File Inclusionmicrostrategy_web4.3medium347009
CVE-2020-7318McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scriptingepolicy_orchestrator4.3medium347198
CVE-2021-42663Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scriptingonline_event_booking_and_reservation_system4.3medium341266
CVE-2022-0377WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaminglearnpress4.3MEDIUM340007
CVE-2022-29495WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgerypopup builder4.3MEDIUM377360
CVE-2024-34061Changedetection.io <=v0.45.21 - Cross-Site Scripting-4.3medium333141
CVE-2024-4348osCommerce v4.0 - Cross-site Scriptingoscommerce4.3medium340147
CVE-2024-7928FastAdmin < V1.3.4.20220530 - Path Traversalfastadmin4.3medium340007
CVE-2025-2127JoomlaUX JUX Real Estate 3.4.0 - Reflected XSSjux_real_estate4.3medium341266
CVE-2025-41228VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)-4.3MEDIUM341266, 390727, 392648
CVE-2011-4640WebTitan < 3.60 - Local File Inclusionwebtitan4.0medium347009
CVE-2013-5528Cisco Unified Communications Manager 7/8/9 - Directory Traversalunified_communications_manager4.0medium347009
CVE-2014-1222Fiyo CMS 2.0.1.8 - Multiple Vulnerabilitiesvtiger crm4.0MEDIUM344360, 390720, 390726, 392647
CVE-2014-5258webEdition 6.3.8.0 - Directory Traversalwebedition_cms4.0medium347009
CVE-2026-55592Dashy <= 4.3.6 - Reflected XSS via Workspacedashy3.9LOW340112
CVE-2019-19411Huawei Firewall - Local File Inclusionusg95003.7low347009
CVE-2012-0991OpenEMR 4.1 - Local File Inclusionopenemr3.5low347009
CVE-2014-0894IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilitiesalgo credit limits3.5LOW392301
CVE-2015-4063NewStatPress <0.9.9 - Cross-Site Scriptingnewstatpress3.5low341266
CVE-2021-25075WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scriptingduplicate_page_or_post3.5LOW377360
CVE-2024-4841LoLLMS WebUI - Subfolder Prediction via Path Traversallollms-webui3.3LOW344365
CVE-2023-2252Directorist < 7.5.4 - Local File Inclusiondirectorist2.7low347009
CVE-2013-5759Yealink VoIP Phone SIP-T38G - Privilege Escalation-N/Ainfo344360, 390726, 392647
CVE-2018-10818LG NAS Devices - Remote Code Execution-N/Acritical340014
CVE-2018-25114osCommerce 2.3.4.1 - Remote Code Execution-N/Acritical344360
CVE-2020-26073Cisco SD-WAN vManage Software - Local File Inclusion-N/Ahigh347009
CVE-2021-40272IRTS OP5 Monitor - Cross-Site ScriptingmonitorN/Amedium347198
CVE-2021-41691openSIS Student Information System 8.0 SQL Injection-N/Ahigh340159
CVE-2022-29299SolarView Compact 6.00 - 'time_begin' Cross-Site Scriptingsolarview_compact_firmwareN/Amedium341266
CVE-2022-29301SolarView Compact 6.00 - 'pow' Cross-Site Scripting-N/Ahigh341266
CVE-2022-3254AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection-N/Acritical340016
CVE-2022-38322Temenos Transact - Cross-Site Scripting-N/Ahigh333141
CVE-2022-43128Dreamer CMS v4.0.0 - SQL Injection-N/Ainfo380122
CVE-2022-45836WordPress Download Manager <= 3.2.59 - Reflected XSS-N/Ahigh333141
CVE-2023-1434Odoo - Cross-Site ScriptingodooN/Amedium341266
CVE-2023-40600EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure-N/Amedium390716
CVE-2023-42343OpenCMS - Cross-Site ScriptingopencmsN/Amedium347198
CVE-2023-46391WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS)-N/Ainfo340147
CVE-2023-52163Digiever DS-2105 Pro - Command Injection-N/Ahigh390709
CVE-2024-0250Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect-N/Amedium340162
CVE-2024-12585PropertyHive < 2.1.1 - Cross-Site Scripting-N/Amedium341266
CVE-2024-14015Studiocart <= 2.9.0 - Cross-Site Scripting-N/Amedium341266
CVE-2024-22024Ivanti Connect Secure - XXEconnect_secureN/Ahigh380019
CVE-2024-24497Employee Management System 1.0 - txtusername and txtpassword SQL Injection (Admin Login)-N/Ainfo340156
CVE-2024-27564ChatGPT个人专用版 - Server Side Request Forgerychatgpt_webN/Ahigh347009
CVE-2024-28734Coda v.2024Q1 - Cross-Site ScriptingUnit4 Financials by Coda prior to 2023Q4N/Amedium340112
CVE-2024-2876Wordpress Email Subscribers by Icegram Express - SQL Injection-N/Acritical380122
CVE-2024-30490ProfileGrid <= 5.7.8 - SQL InjectionProfileGridN/Acritical380122
CVE-2024-31750F-logic DataCube3 - SQL Injectionf-logic datacube3 v.1.0N/Ahigh340016
CVE-2024-33113D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosuredir-845lN/Amedium390722
CVE-2024-33724SOPlanning 1.52.00 Cross Site ScriptingsoplanningN/Amedium341266
CVE-2024-34257TOTOLINK EX1800T TOTOLINK EX1800T - Command Injectiona3700r_firmwareN/Ahigh392301
CVE-2024-36527Puppeteer Renderer - Directory Traversal-N/Amedium347009
CVE-2024-36837CRMEB v.5.2.2 - SQL InjectioncrmebN/Ahigh340156
CVE-2024-38289TurboMeeting - Boolean-based SQL InjectionturbomeetingN/Acritical340016
CVE-2024-4879ServiceNow UI Macros - Template InjectionservicenowN/Acritical342259
CVE-2024-51483Changedetection.io <= 0.47.4 - Path TraversalchangedetectionN/Amedium340130
CVE-2024-51977Brother MFC-L9570CDW - Information Disclosure-N/Amedium390709
CVE-2024-5217ServiceNow - Incomplete Input ValidationservicenowN/Acritical340159
CVE-2024-52875Kerio Control v9.2.5 - CRLF Injection-N/Ahigh390716
CVE-2024-6265UsersWP <= 1.2.10 - Unauthenticated SQL Injection-N/Acritical380122
CVE-2024-9166TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution-N/Acritical340014
CVE-2025-0133PAN-OS - Reflected Cross-Site Scriptingpan-osN/Amedium341266
CVE-2025-1303Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting-N/Amedium341266
CVE-2025-13138WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection-N/Ahigh380122
CVE-2025-22214Landray EIS SQL注入漏洞-N/Acritical340155
CVE-2025-22785Course Booking System <= 6.0.6 - SQL InjectionComMotion Course Booking System course-booking-systemN/Acritical380122
CVE-2025-25231Omnissa Workspace ONE UEM - Path Traversalworkspace_one_uem_consoleN/Ahigh340007
CVE-2025-27222TRUfusion Enterprise <= 7.10.4.0 - Path Traversal-N/Acritical344360
CVE-2025-32101UNA CMS <= 14.0.0-RC4 - PHP Object Injection-N/Acritical390501, 390614
CVE-2025-322571 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure1-click-migrationN/Amedium390716
CVE-2025-34073Maltrail <=0.54 Username Parameter - Remote Command Execution-N/Acritical340014
CVE-2025-34152Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via time Parameter-N/Acritical393655
CVE-2025-4078Wangshen SecGate 3600 Path Traversal Vulnerability-N/Amedium347009
CVE-2025-46549YesWiki <= 4.5.1 - Cross-Site Scripting-N/Amedium341266
CVE-2025-47204Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting-N/Amedium340147
CVE-2025-55169WeGIA - Directory Traversal-N/Acritical344360
CVE-2025-61666Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion-N/Ahigh347019
CVE-2025-8266ChanCMS <= 3.1. - Remote Code Execution-N/Acritical380026
CVE-2025-9985Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File-N/Amedium390716
CVE-2026-35616FortiClient EMS - Authentication Bypassforticlient_emsN/Ahigh392301