Selected CVE-related research notes documenting testing results, engineering observations, attack-pattern analysis, and WAF rule interactions.
These notes are not a CVE coverage matrix, completeness claim, certification list, or list of all vulnerabilities mitigated by Atomicorp products.
A published CVE research note documents a positive research finding for that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Last updated: 2026-09-12
| CVE | Vulnerability Name | Product | CVSS | Severity | Rules Observed |
|---|---|---|---|---|---|
| CVE-2026-72710 | SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection | SPIP | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-89249 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89253 | AVideo Stored XSS via donationLink in watch page button | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89254 | AVideo CustomizeUser Stored XSS via field_name Parameter | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89256 | AVideo Bookmark Plugin Stored XSS via Chapter Names | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89243 | WWBN AVideo Stored XSS via UserGroups setGroup_name | AVideo | 9.2 (v4.0) | Critical | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72708 | SPIP < 4.4.18 Unauthenticated SQL Injection via sitemap annee Parameter | SPIP | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89250 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php | AVideo | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54166 | Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass | shelf.nu | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-89242 | WWBN AVideo Unauthenticated SSRF via login.json.php | AVideo | 6.9 (v4.0) | Medium | 337109 , 337110 , 398022 |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | AVideo | 5.3 (v4.0) | Medium | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 350147 , 380018 |
| CVE-2026-89148 | AVideo Open Redirect via playlistSort.php Referer Header | AVideo | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-88062 | OmniRoute ACP Custom-Agent Remote Code Execution (RCE) | OmniRoute | 9.5 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-88866 | WWBN AVideo LoginControl Stored XSS via User-Agent Header | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88867 | WWBN AVideo Stored XSS via Category Name and Icon Class | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88868 | AVideo LiveLinks Stored XSS via title and description fields | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84889 | A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbit | Langflow OSS | 8.8 (v3.1) | High | 340007 , 344360 , 390709 , 390719 |
| CVE-2026-64837 | ICEcoder through 8.1 OS Command Injection via lib/properties.php | ICEcoder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-64838 | ICEcoder through 8.1 Path Traversal via oldFileName Parameter | ICEcoder | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81213 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | Langflow OSS | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-88937 | knowns through 0.33.0 Path Traversal via Template Engine | knowns | 8.6 (v4.0) | High | 344360 , 390709 |
| CVE-2026-88890 | OpenPanel SQL Injection via unvalidated profile filter column identifier | openpanel | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-57231 | Path Traversal in avatar attachments in Docmost v0.21.0 Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-81265 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | Langflow OSS | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-88938 | knowns through 0.33.0 Path Traversal via code.find MCP tool | knowns | 7.1 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-88940 | knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint | knowns | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54054 | Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects | transmute | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-88055 | AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator | anything-llm | 5.5 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-36392 | FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88892 | OpenPanel SSRF via Unguarded Importer File URL Fetch | openpanel | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-79723 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | Langflow OSS | 5.0 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-87926 | Rizwan17 inventory-management-system Login Page index.php cross site scripting | inventory-management-system | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-38626 | Garlic-Hub v1.0.1 SQL Injection Vulnerability | - | N/A | N/A | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-71805 | Path Traversal | - | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-54694 | NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover | skills-service | 9.6 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-86775 | knowns before 0.30.0 Path Traversal via Document API | knowns | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-87927 | MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher | MaxSite CMS | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-87807 | siyuan before v3.8.2 SQL Injection via fullTextSearchBlock | siyuan | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-26212 | Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE | Rara One Click Demo Import | 8.6 (v4.0) | High | 351000 |
| CVE-2026-79322 | mageplaza blog SQL Injection Vulnerability | mageplaza blog | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | siyuan | 8.4 (v4.0) | High | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | siyuan | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86771 | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num | snipe-it | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-18147 | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | Red Hat Enterprise Linux 10 | 8.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87821 | Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch | laradashboard | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | open-webui | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75307 | zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86756 | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState | snipe-it | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-79569 | Movie_Recommend v1.0.0 SQL Injection Vulnerability | Movie Recommend v1.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79570 | mfish-nocode-pro v1.0.0 SQL Injection Vulnerability | mfish-nocode-pro v1.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86738 | Snipe-IT before 8.7.0 CSS Injection via Custom CSS | snipe-it | 9.3 (v4.0) | Critical | 333140 , 340095 , 342259 |
| CVE-2026-53581 | ntp: write path traversal | core | 9.0 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-78834 | Code Injection | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61517 | Netis NX10 OS Command Injection via Ping Diagnostic Handler | NX10 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86733 | Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore | snipe-it | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78837 | A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 Vulnerability | - | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86806 | opengeos GeoLibre _is_within_roots server-side request forgery | GeoLibre | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 350591 , 390722 , 398021 , 398022 |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86590 | Eclipse Che Server-Side Request Forgery Vulnerability | Eclipse Che | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78738 | Silverpeas Core 6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 340099 , 341099 |
| CVE-2026-78742 | Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86735 | snipe-it before 8.7.0 SSRF via IPv6 transition address bypass | snipe-it | 5.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54611 | InstantCMS has Remote Code Execution in package installer | icms2 | 5.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-86666 | aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload | iWebShop-5 | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48707 | InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning | icms2 | 3.1 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86517 | itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86518 | code-projects Student Crud Operation edit.php sql injection | Student Crud Operation | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86668 | aircheng-org iWebShop-5 pic.php uploadFile cross site scripting | iWebShop-5 | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86675 | itsourcecode Sales and Inventory System us_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86644 | star7th showdoc API Page Save Endpoint editormd.js cross site scripting | showdoc | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86667 | aircheng-org iWebShop-5 member.php member_list sql injection | iWebShop-5 | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86542 | knowns before 0.30.0 Path Traversal via Import Name | knowns | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-86538 | knowns before 0.30.0 Path Traversal via templateFile parameter | knowns | 8.7 (v4.0) | High | 344360 , 390709 |
| CVE-2026-86299 | Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection | RE7000 | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86437 | Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload | laradashboard | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-86438 | Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action | laradashboard | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86539 | knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint | knowns | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86237 | openagents-org openagents http.py test_default_model server-side request forgery | openagents | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86239 | liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload | FeehiCMS | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-86268 | itsourcecode School Management System User_Login.php sql injection | School Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86273 | projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery | siga | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86290 | SourceCodester Online Voting System ajax.php save_category sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86298 | SourceCodester Class and Exam Timetabling System delete_subject.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86305 | light0011 cms Upload.class.php upload unrestricted upload | cms | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-86233 | itsourcecode Sales and Inventory System us_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86234 | itsourcecode Sales and Inventory System cust_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86235 | itsourcecode Sales and Inventory System pos_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86236 | itsourcecode Sales and Inventory System pro_transac.php add sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86244 | FastAdmin User Controller User.php login cross site scripting | FastAdmin | 2.1 (v4.0) | Low | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86245 | itsourcecode Sales and Inventory System sup_transac.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86265 | itsourcecode Sales and Inventory System us_transac.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86267 | itsourcecode Information System Society Membership System check_student.php sql injection | Information System Society Membership System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86269 | itsourcecode Sales and Inventory System emp_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86270 | itsourcecode Sales and Inventory System settings_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86278 | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting | Syllabus-Aligned Learning Management & Examination System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-86291 | itsourcecode Sales and Inventory System us_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86294 | SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting | Simple Traffic Offense System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-86309 | itsourcecode Sales and Inventory System pro_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86310 | itsourcecode Sales and Inventory System cust_edit1.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86240 | liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery | FeehiCMS | 2.0 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86259 | OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation | OpenMAIC | 9.0 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-86159 | SourceCodester Online Voting System ajax.php save_user sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86160 | SourceCodester Online Voting System ajax.php delete_voting sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86161 | SourceCodester Online Voting System ajax.php delete_category sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-86162 | SourceCodester Online Voting System ajax.php login sql injection | Online Voting System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-86168 | code-projects Content Management System login.php sql injection | Content Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86180 | code-projects Task Management System In PHP Login index.php sql injection | Task Management System In PHP | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86208 | SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86209 | SourceCodester Class and Exam Timetabling System delete_user.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86210 | SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86211 | rabindralamsal inventory-management-system Login index.php sql injection | inventory-management-system | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86213 | Mstfakts College-Management-System Search university.php mysqli_query sql injection | College-Management-System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86220 | SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86221 | SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86222 | SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86223 | SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86224 | SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86225 | SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86205 | h3 before 2.0.1-rc.18 Open Redirect via redirectBack() | h3 | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-86256 | wger before 2.6 Open Redirect via trainer-login next parameter | wger | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-86163 | itsourcecode Sales and Inventory System pro_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86164 | itsourcecode Sales and Inventory System trans_view.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86170 | DefaultFuction CRM edit.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86171 | DefaultFuction CRM delete.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86172 | DefaultFuction CRM delete.php sql injection | CRM | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86232 | itsourcecode Sales and Inventory System sup_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86181 | code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting | Task Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86123 | SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints | sqlchat | 9.4 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86189 | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php | AVideo | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-86119 | Webstudio through 0.296.0 SSRF via /cgi proxy routes | webstudio | 9.2 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-52775 | YesWiki Authenticated SQL Injection in ReactionManager | yeswiki | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67281 | Unauthenticated file read in Mikrotik RouterOS | RouterOS | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-52769 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId | yeswiki | 8.3 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-52771 | YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (ApiController::deletePage) | yeswiki | 8.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86207 | N-able N-central - Authentication Bypass | N-central | 7.7 (v4.0) | High | 344365 |
| CVE-2026-52770 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki | yeswiki | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86206 | N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing | N-central | 6.9 (v4.0) | Medium | 344365 |
| CVE-2026-52773 | YesWiki Archived Revision - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 340148 |
| CVE-2026-52774 | YesWiki Bazar Widget - Reflected XSS via 'id' Parameter | yeswiki | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67066 | oasys sysoa version 1.0 Arbitrary Code Execution Vulnerability | oasys sysoa version 1.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-50894 | easyadmin v2.0.2.2 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-44402 | Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi | SNMP Web Pro | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker | openpanel | 9.2 (v4.0) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-79423 | seacms v13.6 Arbitrary Code Execution Vulnerability | seacms v13.6 | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53758 | Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized | emlog | 8.7 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85604 | Grav before 2.0.19 Remote Code Execution via sort filter | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85608 | Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter | Douyin TikTok Download API | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85610 | OpenPanel before 2.3.0 Remote Code Execution via chart formulas | openpanel | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints | openpanel | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85666 | ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url | ogx | 8.7 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85673 | LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding | LlamaFactory | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85685 | AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill | agentscope | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85691 | MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url | megaparse | 8.7 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-50553 | Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) | note-mark | 8.6 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19303 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing c | langflow | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63464 | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allow_private | nebula-mesh | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-61686 | SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop | SolidInvoice | 7.5 (v3.1) | High | 340014 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53757 | Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE | emlog | 6.9 (v4.0) | Medium | 344360 |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-74235 | GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler | GFI Exinda AI | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint | openpanel | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85662 | Marqo 2.26.0 Server-Side Request Forgery via Media URLs | marqo | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-14470 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9138 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing c | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-75170 | the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability | the HubCore platform (version 14.1.1) | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85379 | light0011 cms Query Builder ChapterController.class.php searchChapter sql injection | cms | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85380 | light0011 cms UEditor controller.php catchimage server-side request forgery | cms | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85397 | code-projects Hospital Information System addReq.php findBySearch sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85398 | code-projects Hospital Information System viewReq.php viewReq sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85399 | code-projects Hospital Information System PrespController.php getSinglePresp sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85402 | code-projects Doctor Appointment System booking.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85403 | code-projects Doctor Appointment System contactus.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85512 | SourceCodester Class and Exam Timetabling System session.php authorization | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85516 | code-projects Vehicle Management System busprofile.php sql injection | Vehicle Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-17621 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 5.4 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-85650 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel | trigger.dev | 5.3 (v4.0) | Medium | 334168 , 337109 , 337110 , 344360 , 390719 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85676 | Dub Open Redirect via Unrestricted redir_url Parameter | dub | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-85601 | Grav Admin before 2.0.20 Cross-Site Scripting via marked.js | grav | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-85382 | light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting | cms | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-85383 | itsourcecode Sales and Inventory System inv_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85643 | code-projects Online Shopping System adduser.php mysqli_query sql injection | Online Shopping System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78849 | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 | N/A | N/A | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82526 | R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint | R2R | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-58400 | GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter | core-geonetwork | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85199 | Eclipse aeriOS Path Traversal Vulnerability | Eclipse aeriOS | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-82527 | R2R 3.6.6 SQL Injection via Retrieval Search Filter Key | R2R | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85155 | WWBN AVideo SQL Injection via get.json.php APIName channels | AVideo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85223 | D-Link DNS-340L CGI dropbox.cgi os command injection | DNS-340L | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85222 | D-Link DNS-340L Add-On Center addon_center.cgi os command injection | DNS-340L | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-85224 | D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | DNS-320 ShareCenter | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-85160 | AVideo through c91b5975d CSRF and Path Traversal via stopLive.php | AVideo | 7.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-53728 | Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage | medplum | 7.1 (v3.1) | High | 340162 , 340163 , 344365 |
| CVE-2026-85163 | AVideo Server-Side Request Forgery via epg_link parameter | AVideo | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | AVideo | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-75602 | OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool | OpenList | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-85137 | SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection | SeaCMS | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85138 | SeaCMS WeChat index.php addslashes sql injection | SeaCMS | 5.5 (v4.0) | Medium | 340156 |
| CVE-2026-85187 | itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85208 | itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-85225 | code-projects Doctor Appointment System patient_login.php sql injection | Doctor Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85205 | itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection | Online Medicine Delivery System | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56126 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56127 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-56128 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php | pfSense Plus | 5.1 (v4.0) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85186 | itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload | Online Medicine Delivery System | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85040 | ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection | CRMEB | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-85207 | itsourcecode Online Medicine Delivery System index.php cross site scripting | Online Medicine Delivery System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9314 | Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload | The Developer Tools WordPress plugin through 1.1.3 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-53649 | Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE | joro | 9.6 (v3.1) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-79756 | Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform | nuclio | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82524 | UnoPim File Upload RCE via TinyMCE Image Upload Endpoint | unopim | 8.6 (v4.0) | High | 351000 |
| CVE-2026-84803 | SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist | siyuan | 8.6 (v4.0) | High | 333140 , 333141 |
| CVE-2026-52831 | Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE | nuclio | 8.0 (v3.1) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 |
| CVE-2026-79755 | Nuclio: Unauthenticated OS command injection via function namespace in docker ps –filter label (local Docker platform) | nuclio | 8.0 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55421 | Open edX Platform: SSRF in Studio Video Download Endpoint | openedx-platform | 6.8 (v3.1) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-10821 | Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE | Yoast SEO Premium | 6.6 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2026-84441 | Piwigo Image Derivative i.php path traversal | Piwigo | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-84175 | Eclipse Ditto Uncontrolled Recursion Vulnerability | Eclipse Ditto | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-52832 | Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container | nuclio | 4.9 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-53683 | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html | Red Hat Enterprise Linux 10 | 4.3 (v3.1) | Medium | 340163 , 344365 |
| CVE-2023-3360 | Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection | Weaver Show Posts | 3.3 (v3.1) | Low | 340014 , 340023 , 344362 , 344363 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-84437 | OpenCart Autocomplete Workflow address.php cross site scripting | OpenCart | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 340247 , 340248 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84372 | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | predis | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390722 , 393655 |
| CVE-2026-84189 | LibreNMS before 26.7.0 Stored XSS via Oxidized API | librenms | 9.2 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-84208 | AVideo User_Location Plugin Unauthenticated SQL Injection | AVideo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84194 | LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname | librenms | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-84196 | Kyverno before 1.18.0 Server-Side Request Forgery via apiCall | kyverno | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19914 | Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter | Welcart e-Commerce | 7.2 (v3.1) | High | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-84199 | Kyverno before 1.16.2 SSRF via APICall Feature | kyverno | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-8712 | Wyoming < 1.10.2 SSRF via uri Query Parameter | wyoming | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84111 | Chanjet CRM jxf_dump_table.php sql injection | CRM | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84191 | LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields | librenms | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84207 | Heym before 0.0.98 SSRF via WebSocket endpoints | heym | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-84477 | AVideo Stored XSS via Live Schedule Title Description | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-83744 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery | Invoice Ninja | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-84109 | Xinhu Rainrock RockOA webmainAction.php getOrder sql injection | Rainrock RockOA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-84153 | Xinhu Rainrock RockOA index.php toaddval sql injection | Rainrock RockOA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79408 | MetaGPT 0.8.1 Command Injection Vulnerability | MetaGPT 0.8.1 | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-59111 | Command Injection vulnerability in eObčanka-Identifikace | eObčanka-Identifikace | 9.3 (v3.1) | Critical | 340014 , 347009 , 393655 |
| CVE-2026-51152 | Server-Side Request Forgery | - | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-77956 | EEx template evaluation of prompt content in AshAi enables remote code execution | ash ai | 8.9 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-82866 | @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch | common | 8.9 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82217 | Eclipse Theia Path Traversal Vulnerability | Eclipse Theia | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback | elFinder | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82692 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | DNS-340L | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | Wallos | 8.5 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82690 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | DNS-327L | 8.5 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-82691 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | DNS-320L | 8.5 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-77850 | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | ash admin | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-82673 | Path traversal in AshAdmin file uploads via unsanitized client filename | ash admin | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port | Wallos | 8.2 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | 8.2 (v3.1) | High | 337109 , 337110 , 340790 , 340791 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-53553 | Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise | goploy | 7.7 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | mcphub | 7.6 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-79407 | the SPO extension of MetaGPT 0.8.1 Path Traversal Vulnerability | the SPO extension of MetaGPT 0.8.1 | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2026-75132 | WAPT Server SQL Injection via /api/v3/hosts Endpoint | WAPT | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79747 | MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy | mcphub | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82877 | ILIAS before 9.22 Arbitrary File Read via SOAP addFile | ILIAS | 7.1 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75592 | Kirby: Access to image files outside of the site root via path traversal in the media handling | kirby | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79743 | MCPHub: Path Traversal via Malicious MCPB Manifest Name | mcphub | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82598 | SeaCMS Template search.php parseIf code injection | SeaCMS | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82600 | SeaCMS zyapi.php sql injection | SeaCMS | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82610 | itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82611 | itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82612 | itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82613 | itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82614 | itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82615 | itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection | Online Medicine Delivery System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82630 | PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery | PowerJob | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82701 | code-projects Online Shopping System Search Functionality action.php sql injection | Online Shopping System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82801 | NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82802 | NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) | Wallos | 4.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings | Wallos | 3.5 (v3.1) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82599 | SeaCMS Avatar Upload member.php unlink path traversal | SeaCMS | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-82603 | SeaCMS Comment Cache member.php del_pl path traversal | SeaCMS | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82609 | itsourcecode Sales and Inventory System inv_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82625 | code-projects Simple Inventory System User Registration register.php cross site scripting | Simple Inventory System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82679 | diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload | diem | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-82696 | itsourcecode Sales and Inventory System inv_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82700 | code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-82905 | sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery | chats | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82622 | code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting | Employee Leave Managing System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-82629 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload | jeewx-boot | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82678 | diem-project diem Administrative Console actions.class.php executeCommand os command injection | diem | 2.0 (v4.0) | Low | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-82702 | Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection | BR-6214K | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82703 | Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection | BR-6214K | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82638 | jina-ai reader Server-Side Request Forgery via disabled private-address guard | reader | 8.7 (v4.0) | High | 344360 , 347009 , 390719 , 390722 , 398001 , 398021 |
| CVE-2026-82655 | Admidio before 5.0.12 SQL Injection via relation_type_list | admidio | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82650 | SiYuan before v3.8.1 Path Traversal via /api/template/render | siyuan | 5.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82484 | itsourcecode Sales and Inventory System emp_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82485 | itsourcecode Sales and Inventory System pro_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82540 | itsourcecode Sales and Inventory System cust_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82541 | itsourcecode Sales and Inventory System sup_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82545 | itsourcecode Sales and Inventory System sup_searchfrm.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82656 | Admidio before 5.0.12 Path Traversal via Photo ZIP Download | admidio | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-82483 | coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting | Coppermine Photo Gallery | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82488 | Beetel 450TC3 User Management cross site scripting | 450TC3 | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16061 | Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name} | Rest Routes | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82451 | Formwork through 2.3.14 Stored XSS via Referer Header | Formwork | 5.3 (v4.0) | Medium | 333140 , 333141 , 340003 , 340087 , 340095 , 340099 , 340147 , 340158 , 341099 , 341266 , 342259 |
| CVE-2026-82421 | itsourcecode Sales and Inventory System emp_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82422 | itsourcecode Sales and Inventory System emp_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82424 | PHPGurukul Student Information System student_edit1.php sql injection | Student Information System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54745 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENAB | pipelines | 10.0 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-55565 | Yamcs: Authenticated remote code execution via unescaped StreamSQL LIKE pattern compiled by Janino (LikeExpression) | yamcs | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55634 | Pimcore: Remote Code Execution via DataObject Class-Definition Field Name | pimcore | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55559 | Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) | yamcs | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75337 | Yu AI Code Mother v4.3 is vulnerable to path traversal Vulnerability | Yu AI Code Mother v4.3 is vulnerable to path traversal | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-82329 | JFrog Artifactory Access Blank Join Key Authentication Bypass | artifactory | 9.8 (v3.1) | Critical | 300022 |
| CVE-2026-82244 | Budibase before 3.41.3 Remote Code Execution via Plugin eval() | server | 9.4 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-55511 | Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs executeSql | yamcs | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55509 | WsgiDAV: Blind SQL injection in the MySQL provider | wsgidav | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82286 | gpt-crawler Arbitrary File Write via outputFileName Parameter | gpt-crawler | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-55245 | Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL | bifrost | 8.7 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-76060 | OS Command Injection in PayRange API | Zoneminder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-82270 | Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* | gateway | 8.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82278 | BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once | bisheng | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75121 | PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75122 | PLANET GS-4210-16P2S Command Injection via httpuploadcert.cgi | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75123 | PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-82243 | Budibase Server before 3.41.3 SSRF with Credential Leakage | server | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82262 | Logto Server-Side Request Forgery via webhook test endpoint | logto | 8.2 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-54083 | Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion | wazuh | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-55552 | Yamcs: Unauthenticated Directory Traversal | yamcs | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-77939 | Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint | flextype | 7.1 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | server | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82246 | Budibase Server before 3.41.3 SSRF via Query Import | server | 7.1 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-82233 | SiYuan before v3.8.1 Path Traversal via asset.upload | siyuan | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-55549 | Yamcs: Reflected XSS in the URL of the Authorize Endpoint | yamcs | 6.5 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82081 | wallabag Server-Side Request Forgery Vulnerability | wallabag | 6.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-38725 | xipblog module 2.0.1 and Earlier for PrestaShop Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium | 346755 |
| CVE-2026-82274 | Twenty Open Redirect via OAuth Propagator Callback | twenty | 5.3 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-82112 | houtini-ai houtini-lm code_task_files index.ts path traversal | houtini-lm | 5.1 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55834 | Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none | pocket-id | 4.3 (v3.1) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-81845 | arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal | mcp-sequential-thinking | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-81835 | RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection | Roo-Code | 2.0 (v4.0) | Low | 340014 , 344360 , 347009 , 393655 |
| CVE-2026-81847 | MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal | MaaMCP | 2.0 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-81735 | UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Executi | UI-TARS-desktop | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-81672 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81673 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81674 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81675 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57499 | Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE) | core | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-26899 | OS Command Injection | - | 8.8 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-81676 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81677 | Multiple Vulnerabilities in TOOOLS' iSquad | iSquad | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-81730 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename | dolibarr erp/crm | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-81093 | Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton | actors-mcp-server | 8.7 (v4.0) | High | 340162 , 340165 , 347009 , 390722 |
| CVE-2026-81728 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys | dolibarr erp/crm | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-53580 | Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature | Trilium | 8.1 (v3.1) | High | 340007 , 347009 |
| CVE-2026-40526 | Volmarg Personal Management System Path Traversal via get-file Endpoint | personal-management-system | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | AVideo | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79653 | Eclipse SW360 Path Traversal Vulnerability | Eclipse SW360 | 6.0 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81421 | ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery | sentry-selfhosted-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-81486 | bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal | mcp-file-context-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81491 | boxpositron with-context-mcp index.ts project_folder path traversal | with-context-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-81931 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting | Prospero Flow CRM | 4.8 (v4.0) | Medium | 351000 |
| CVE-2026-60004 | Gitea <= 1.27.0 - Pre-Auth Remote Code Execution | gitea | 9.8 (v3.1) | Critical | 330907 , 330908 , 330909 |
| CVE-2026-68000 | MCMS <=6.2.0 is vulnerable to SQL injection Vulnerability | MCMS <=6.2.0 is vulnerable to SQL injection | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75327 | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java Arbitrary File Upload Vulnerability | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-75330 | super-diamond-server <= 1.3.3 is vulnerable to SQL injection Vulnerability | super-diamond-server <= 1.3.3 is vulnerable to SQL injection | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75336 | Funiture 1.0.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340145 , 380122 |
| CVE-2026-75411 | JeecgBoot v3.9.2 Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75414 | In AntFlow V2.0.0, ActivitiTest.java Code Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-75332 | Zyplayer-Doc <=1.0.0 Server-Side Request Forgery Vulnerability | - | 9.1 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2020-15874 | Command Injection | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2020-15876 | SQL Injection | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-15878 | SQL Injection | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 393655 |
| CVE-2026-47665 | Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML | penpot | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55182 | LibreNMS: Remote Code Execution by Signal Alert Transportation Module | librenms | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-80214 | LibreNMS Virtualisation Discovery Module RCE | librenms | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-81029 | OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI | OpenMetadata | 8.5 (v4.0) | High | 344365 |
| CVE-2026-81036 | Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri | stalwart | 8.5 (v4.0) | High | 344365 |
| CVE-2026-15973 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries | LimeSurvey | 8.4 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36851 | UnPoller 2.33.0 password field Path Traversal Vulnerability | UnPoller 2.33.0 password field | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-75328 | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java Path Traversal Vulnerability | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75333 | yx-image-recognition v1.0 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16809 | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering | LimeSurvey | 7.2 (v4.0) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-80350 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL | OneUptime | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-81030 | Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint | mage-ai | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-80426 | FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description | fiftyone | 7.0 (v4.0) | High | 333140 , 333141 |
| CVE-2026-39275 | Cockpit CMS v.2.13.5 and before Arbitrary Code Execution Vulnerability | Cockpit CMS v.2.13.5 and before | 6.1 (v3.1) | Medium | 340099 , 341099 |
| CVE-2026-81203 | SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-80200 | Kimai before 2.53.0 Open Redirect via RelayState | kimai | 5.3 (v4.0) | Medium | 344365 |
| CVE-2026-65930 | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields | LimeSurvey | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-75331 | tamguo 1.5.3 Cross-Site Scripting Vulnerability | - | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-45018 | Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution | chainlit | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-80104 | DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename | DB-GPT | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-80138 | ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter | clipbucket-v5 | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55585 | QWED: Authenticated Remote Code Execution via Unsafe SymPy parse_expr() | qwed-verification | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-79662 | Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass | Ech0 | 8.8 (v4.0) | High | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-57863 | Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint | crater | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-62865 | TypeBot: Arbitrary server file read via Send Email block attachment path | typebot.io | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75574 | Grav before 4.2.2 Remote Code Execution via Email Twig | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-56703 | Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO | adminer | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-79659 | Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo | Ech0 | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-34968 | Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop | adminer | 7.2 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-45019 | Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access | chainlit | 7.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55537 | PraisonAI: Webhook SSRF via DNS fail-open in JobSubmitRequest.validate_webhook_url() — bypass of CVE-2026-40114 | PraisonAI | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56702 | Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload | adminer | 7.1 (v4.0) | High | 351000 |
| CVE-2026-72695 | Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile | grav | 7.1 (v4.0) | High | 344360 |
| CVE-2026-79788 | Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address | dradis-ce | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-79786 | Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration | coroot | 7.0 (v4.0) | High | 344365 |
| CVE-2026-34964 | Adminer before 5.5.0 SSRF via PDO DSN Injection | adminer | 6.9 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79773 | Winter CMS before 1.2.13 Local File Inclusion via JavaScript | winter | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79781 | rclone serve s3 Path Traversal via dot-dot object keys | rclone | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-79717 | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction | Red Hat Ansible Automation Platform 2 | 6.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78886 | liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal | TREK | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-79804 | SililaWijesinghe Food Ordering System search.php sql injection | Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79845 | code-projects Simple Inventory System edit.php sql injection | Simple Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-38467 | the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 SQL Injection Vulnerability | the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34959 | Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix | adminer | 5.3 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-34967 | Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write | adminer | 5.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55419 | Reachy Mini: Unrestricted Upload of File with Dangerous Type | reachy mini | 5.3 (v3.1) | Medium | 351000 |
| CVE-2026-78864 | liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection | TREK | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79671 | Ech0 before 4.4.3 SSRF via DNS Resolution Bypass | Ech0 | 5.1 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26211 | Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field | Ekushey Project Manager CRM | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-79663 | Ech0 before 4.7.3 Stored XSS via RSS feed tag names | Ech0 | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-79670 | Ech0 before 4.4.3 Stored XSS via SVG Upload | Ech0 | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38468 | the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 SQL Injection Vulnerability | the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 4.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16434 | Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass | adminer | 2.3 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78656 | itsourcecode Sales and Inventory System cust_del.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71921 | DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi | VigorSwitch G2540xs | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-76070 | Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter | NC63 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76071 | Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter | NC63 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76842 | Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients | mercadopago | 8.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-76836 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | AzuraCast | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-78416 | Authenticated RCE via condition.config JSON cleanse bypass | cms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71906 | DrayTek VigorAP Multiple Models OS Command Injection via setLan | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71907 | DrayTek VigorAP Multiple Models OS Command Injection via setcamset | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71908 | DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71913 | DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi | VigorAP 918R | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71915 | DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71918 | DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71919 | DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-71923 | DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71924 | DrayTek VigorSwitch Multiple Models OS Command Injection via getVid | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71925 | DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71926 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71927 | DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71928 | DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71929 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71930 | DrayTek VigorSwitch Multiple Models OS Command Injection via setTime | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71931 | DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71943 | DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet | VigorSwitch G2540xs | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76844 | webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath | webpack-dev-middleware | 8.3 (v4.0) | High | 347009 |
| CVE-2026-71932 | DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile | VigorSwitch G2540xs | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-30983 | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-78171 | itsourcecode Sales and Inventory System processlogin.php sql injection | Sales and Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78197 | SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-78198 | SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-78199 | SourceCodester Simple Online Food Ordering System view_prod.php sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78201 | itsourcecode Payroll System admin_class.php login sql injection | Payroll System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78202 | itsourcecode Payroll System admin_class.php save_settings unrestricted upload | Payroll System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-78244 | itsourcecode Real Estate Management System search.php sql injection | Real Estate Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78245 | itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload | Online Pharmacy System | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-78246 | itsourcecode Online Clinic Management System Admin Login login.php sql injection | Online Clinic Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78247 | SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-78248 | SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-76837 | Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name | Baserow | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78337 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG | Prospero Flow CRM | 4.8 (v4.0) | Medium | 351000 |
| CVE-2026-78166 | provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection | kafka-ui | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-78185 | itsourcecode Sales and Inventory System cust_edit.php sql injection | Sales and Inventory System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78200 | itsourcecode Library Management System editbooks.php sql injection | Library Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78435 | Faveo Helpdesk Logo SettingsController.php unlink path traversal | Helpdesk | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78143 | code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection | Barangay Resident Profiling Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78056 | sambitraj Student-Management-System Dashboard sql injection | Student-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78057 | sambitraj Student-Management-System Management Mutation sql injection | Student-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78059 | SourceCodester Stock Management System printOrder.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78060 | SourceCodester Stock Management System getOrderReport.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-78112 | itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection | Hospital Management System Project in PHP | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78140 | Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine | UJCMS | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | siyuan | 6.9 (v4.0) | Medium | 337109 , 347009 , 390722 |
| CVE-2026-77806 | SPIP < 4.4.22 - Unauthenticated RCE | SPIP | 9.8 (v3.1) | Critical | 380018 , 380026 |
| CVE-2026-77086 | SiYuan before v3.7.4 Path Traversal via packageName | siyuan | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-49849 | xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution | xshop | 9.1 (v3.1) | Critical | 351000 |
| CVE-2026-62674 | Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE | omnigent | 9.0 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-62675 | Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools | omnigent | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62677 | Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUN | omnigent | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-75933 | Jet Admin Stored XSS | Jet Admin | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-22681 | OpenViking < 0.3.4 SSRF via /api/v1/resources | OpenViking | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48105 | Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path | arc | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-63135 | YOURLS: Stored XSS in referrer statistics chart via crafted Referer header | YOURLS | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-64679 | Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation | atlantis | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-77775 | Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation | Headroom | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47735 | Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks | arc | 7.1 (v4.0) | High | 340007 , 344360 , 390709 , 390719 |
| CVE-2026-54134 | OctoPrint: File exfiltration possible via query parameters on upload endpoints | OctoPrint | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55185 | Miniflux 2: Open Redirect Bypass | v2 | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-53468 | Typemill has Stored HTML Attribute Injection in Metadata Fields | typemill | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-77681 | CodeAstro Online Job Portal update-profile.php unrestricted upload | Online Job Portal | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-18482 | neo-mjs Command Injection Vulnerability | neo-mjs | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19586 | Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways | er7212pc firmware | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53804 | OTRS Community Edition OS Command Injection via PGP Configuration | OTRS Community Edition | 8.6 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-76635 | baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php | basercms | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15686 | Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability | Adminer | 7.2 (v3.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-18274 | Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability | Database Proxy | 7.2 (v3.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-73255 | Mongoose: Path traversal in SSI #include directives enables arbitrary file read | mongoose | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72860 | 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unre | 9router | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-49244 | SFTPGo: Path confinement bypass in public browsable share partial ZIP download | sftpgo | 5.9 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75628 | Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_pa | - | 5.7 (v3.1) | Medium | 344365 |
| CVE-2026-76762 | code-projects Assessment Management welcome.php sql injection | Assessment Management | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76764 | code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection | Employee Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76795 | AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery | PullMD | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76990 | code-projects Simple Inventory System delete.php sql injection | Simple Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76996 | SourceCodester Simple Online Food Ordering System view_order.php sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76998 | SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-77019 | CodeAstro Apartment Visitor Management System forgotpw.php sql injection | Apartment Visitor Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-77020 | CodeAstro Apartment Visitor Management System password-recovery.php sql injection | Apartment Visitor Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-54508 | TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution | TREK | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-72846 | Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery | lightdash | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77067 | Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation | omnivore | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77648 | Glance Server-Side Request Forgery Vulnerability | Glance | 2.2 (v3.1) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76785 | amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection | Mini-Inventory-and-Sales-Management-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76991 | itsourcecode Hospital Management System viewappointmentapproved.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76997 | SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection | Simple Online Food Ordering System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-77025 | itsourcecode Hospital Management System viewappointmentpending.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76995 | SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload | Simple Online Food Ordering System | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-51366 | Bottinelli Informatica Vedo Suite v.1.2.5 Arbitrary Code Execution Vulnerability | Bottinelli Informatica Vedo Suite v.1.2.5 | 9.9 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-53545 | Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection | Termix | 9.8 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45272 | MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File | talebook | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62668 | Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols | grav | 9.4 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-66794 | Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route | multicluster engine for Kubernetes 2.1 | 9.3 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48024 | Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager | wazuh | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-48162 | Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file pa | wazuh | 9.1 (v3.1) | Critical | 340007 , 344360 , 350591 , 390709 |
| CVE-2026-32475 | Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler | Elementor Pro | 9.0 (v3.1) | Critical | 398001 |
| CVE-2026-44829 | Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename | gotenberg | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-61518 | ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter | ispconfig3 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63722 | ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php | ICEcoder | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-64850 | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | grav | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344365 , 344366 , 344370 , 393655 |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback | wekan | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76205 | phpMyFAQ before 4.1.7 SQL Injection via Glossary | phpmyfaq | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-64851 | Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers | grav-plugin-shortcode-core | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68558 | Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) | wekan | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76225 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV | arcadedb | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 390109 , 398021 , 398022 |
| CVE-2026-53549 | Termix: Server-Side Request Forgery via Proxy Connectivity Test | Termix | 7.7 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18430 | HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason | HumHub | 7.2 (v4.0) | High | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | phpmyfaq | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75986 | code-projects Online Job Portal System Password Recovery ForPass.php sql injection | Online Job Portal System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76048 | SourceCodester Simple Online Food Ordering System ajax.php login sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-76049 | SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection | Simple Online Food Ordering System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-76574 | code-projects Hospital Information System User Login UsersController.php login sql injection | Hospital Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-76760 | chenhg5 cc-connect webhook.go authenticate code injection | cc-connect | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-76761 | chenhg5 cc-connect Management API engine.go shellExecCommand os command injection | cc-connect | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-53452 | Ground Station: Unauthenticated out-of-containment file read via sigmfplayback recordingPath | ground-station | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-76239 | Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address | stigmem-node | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76614 | OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore | openemr | 5.3 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal | openemr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76203 | CSS sanitizer bypass in Pentestify report themes allows forced outbound requests | Pentestify | 5.1 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76576 | yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal | RuoYi-Vue | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and cr | lemur | 9.9 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12564 | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credenti | Red Hat Ansible Automation Platform 2 | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical | 333140 , 333141 , 340003 , 340087 , 340095 , 340099 , 340147 , 340148 , 340158 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | siyuan | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-52610 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-50186 | 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export | 4gaBoards | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75914 | CodeWhale before 0.8.64 Path Traversal via image_analyze symlink | CodeWhale | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75833 | Grav API Plugin Open Redirect via Backslash Bypass | grav | 8.6 (v4.0) | High | 344365 |
| CVE-2026-75855 | ArcadeDB before 26.8.1 Path Traversal via create/drop database | arcadedb | 8.4 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-75898 | RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component | ragflow | 8.4 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75842 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV | arcadedb | 8.3 (v4.0) | High | 340007 , 340029 , 344360 , 344370 , 390109 , 390709 |
| CVE-2026-74907 | Grav before 2.0.15 Path Traversal via plugin-asset-map.php | grav | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-50143 | Actor MCP path authority injection leaks Apify token | apify-mcp-server | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71303 | Lemur: Incomplete fix for CVE-2026-55166 – ACME authority update endpoint allows non-admin to replace acme_url with i | lemur | 7.7 (v3.1) | High | 337109 , 337110 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71365 | Awx: webhook status callback ssrf leaks the git pat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-70666 | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs | lemur | 7.4 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75830 | grav-plugin-api before 1.0.15 Path Traversal via batchCopy | grav | 7.1 (v4.0) | High | 340007 , 344360 |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | arcadedb | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-74038 | Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment | wazuh-manager | 7.0 (v4.0) | High | 340007 , 344360 |
| CVE-2026-52607 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63643 | MagicMirror: ssrf calendar .js | MagicMirror | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-70667 | Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fi | lemur | 6.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-68922 | MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads | Mobile-Security-Framework-MobSF | 5.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-75079 | SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75080 | SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75089 | PHPGurukul Complaint Management System check_availability.php sql injection | Complaint Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-75778 | code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-54543 | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | froxlor | 5.4 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-47720 | FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString | FUXA | 5.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74908 | Grav plugin-api before 1.0.15 Script Injection via SVG | grav | 5.1 (v4.0) | Medium | 351000 |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68927 | MobSF: SSRF port restriction bypass in assetlinks_check | Mobile-Security-Framework-MobSF | 3.0 (v3.1) | Low | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2024-14046 | OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload | OpenBoxes | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-75086 | itsourcecode Hospital Management System viewroom.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75087 | itsourcecode Hospital Management System viewdepartment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75088 | itsourcecode Hospital Management System viewbilling.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-75876 | xianrendzw EasyReport Move Operations ModuleController.java sql injection | EasyReport | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67678 | RainyGao-Hithub DocSys v.2.02.80 Arbitrary Code Execution Vulnerability | RainyGao-Hithub DocSys v.2.02.80 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-67919 | Halo 2.25.4 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67926 | JeecgBoot v.3.9.2 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-15623 | Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service | Google SecOps (Chronicle SOAR) | 9.4 (v4.0) | Critical | 341245 , 344367 |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirect | mlflow | 9.3 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-74798 | SiYuan kernel Path Traversal via database_clean MCP tool | siyuan | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-75111 | Evidently UI Path Traversal via Dataset Materialization Filename | evidently | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-75482 | SWE-agent Trajectory Inspector Path Traversal File Disclosure | SWE-agent | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-56677 | 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint | 9router | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-64657 | Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL | budibase | 8.4 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-33437 | Stirling PDF: Stored XSS in Info Summary | Stirling-PDF | 8.1 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-27621 | UpTrain has a Constant Default API Key | uptrain | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50776 | Pronis Loisirs Billetterie CSE - < 04/2026 Arbitrary Code Execution Vulnerability | Pronis Loisirs Billetterie CSE - < 04/2026 | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40506 | OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php | openemr | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19983 | GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection | A1300 | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63667 | ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal | apostrophe | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-48053 | Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset | kolibri | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-75014 | SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection | Pet Grooming Management Software | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74858 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery | fetcher-mcp | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19972 | itsourcecode Hospital Management System viewpatient.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19973 | itsourcecode Hospital Management System viewpaymentreport.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19984 | jkawamoto mcp-florence2 init.py get_images server-side request forgery | mcp-florence2 | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19998 | code-projects Online Shopping System offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-20000 | itsourcecode Hospital Management System viewprescriptionrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-74842 | Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery | PromptShopMCP | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19964 | Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection | Jij-MCP-Server | 2.0 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73058 | stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass | stoatchat | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19919 | code-projects Online Shopping System Login login.php sql injection | Online Shopping System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19926 | Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection | Evergreen | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19956 | gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery | facebook-ads-mcp-server | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19920 | code-projects Online Shopping System action.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19921 | code-projects Online Shopping System homeaction.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19923 | code-projects Online Shopping System checkout_process.php sql injection | Online Shopping System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19927 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery | OpenBoxes | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19932 | DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection | Notice-System-Managent | 2.1 (v4.0) | Low | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19934 | itsourcecode Hospital Management System vieworder.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19958 | iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection | pptr-mcp | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-19922 | code-projects Online Shopping System checkout.php cross site scripting | Online Shopping System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19925 | SourceCodester Stock Management System Master.php delete_supplier sql injection | Stock Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19598 | Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router | pods | 9.8 (v3.1) | Critical | 377360 |
| CVE-2026-73041 | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations | siyuan | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73042 | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata | siyuan | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | siyuan | 9.4 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19900 | LB-LINK Routers - Unauthenticated Command Injection | bl-wr9000 firmware | 8.2 (v4.0) | High | 390904 |
| CVE-2026-16007 | Authenticated SQL Injection in AppFlowy | AppFlowy-Cloud | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19899 | SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19894 | itsourcecode Hospital Management System viewmedicine.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19917 | code-projects Online Food Order System delete_food_items1.php sql injection | Online Food Order System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19188 | Haiwell IoT Cloud HMI Gateway OS Command Injection | Haiwell IoT Cloud HMI Gateway | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-48528 | Metacat has an unauthenticated SQL injection vulnerability | metacat | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72819 | Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload | grav | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72827 | Grav CMS before 2.0.13 Remote Code Execution via Twig | grav | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72830 | Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass | grav | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73680 | Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename | Cockpit CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73850 | Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function | emlog | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-69101 | Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint | tis | 8.3 (v4.0) | High | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 398008 |
| CVE-2026-19771 | Baicells EG3661M LuCI Web luci os command injection | EG3661M | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-74247 | Quay: ssrf via build archive_url in quay build api | openshift update service | 7.1 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-72814 | actix-web before 0.6.10 Information Disclosure via Files | actix-web | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-18403 | LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB | LimeSurvey | 6.0 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19758 | dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal | lamp-cloud | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19762 | DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal | Taier | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19827 | alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal | alldata | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19785 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection | RosarioSIS | 5.3 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-73845 | CKAN MCP Server: MQA server allowlist bypass via unanchored regex (isValidMqaServer) | ckan-mcp-server | 5.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19761 | DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal | Taier | 5.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19763 | DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal | Taier | 5.1 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72821 | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72832 | Grav before 2.0.12 Stored XSS via quoted-attribute bypass | grav | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-19767 | itsourcecode Hospital Management System viewdoctortimings.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19828 | 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-19829 | 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low | 344360 , 347009 , 390709 |
| CVE-2026-19787 | SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection | Air Cargo Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19839 | SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload | Simple Doctors Appointment System | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-49819 | UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd | UpSnap | 9.8 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-49827 | WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) | WebErpMesv2 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-72850 | Budibase before 3.40.0 Arbitrary File Write via Path Traversal | server | 9.4 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73483 | Flowise before 3.1.3 Sandbox Escape via Puppeteer | flowise | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72851 | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook | server | 9.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-73485 | Flowise before 3.1.3 Remote Code Execution via Airtable Agent | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73486 | Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73487 | Flowise before 3.1.3 Prompt Injection RCE via CSV Agent | flowise | 9.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73570 | zimbra collaboration suite Arbitrary Code Execution Vulnerability | zimbra collaboration suite | 8.9 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2019-25765 | ASP-CMS SQL Injection via commentList.asp id Parameter | ASP-CMS | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-58374 | Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree | e-HR | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 344365 , 346755 , 350147 , 350148 |
| CVE-2026-73664 | FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module | backup | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73670 | CMS Admin SQL Injection via db_data.php table_name Parameter | Saurus CMS Community Edition | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 380026 , 380122 , 390572 |
| CVE-2026-57894 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil | Gitea Open Source Git Server | 8.5 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | server | 8.4 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73629 | Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses | Serendipity | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73658 | Trigger.dev: Cross-tenant object store read and write via URL path traversal | trigger.dev | 8.2 (v3.1) | High | 347009 |
| CVE-2026-61979 | WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability | SAML SP Single Sign On | 8.1 (v3.1) | High | 300022 |
| CVE-2026-73659 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API | trigger.dev | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-58314 | Two SSRF findings in Gitea 1.26.2 | Gitea Open Source Git Server | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59765 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | Gitea Open Source Git Server | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-49857 | auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback | auth-fetch-mcp | 7.4 (v3.1) | High | 337109 , 337110 , 344360 , 398004 , 398021 , 398022 |
| CVE-2026-45725 | compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal | compliance-trestle | 7.1 (v4.0) | High | 347009 |
| CVE-2026-45774 | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal | compliance-trestle | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-58442 | Repository migration SSRF via multi-answer DNS allow-list bypass | Gitea Open Source Git Server | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73573 | zimbra collaboration suite Path Traversal Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73574 | zimbra collaboration suite Incorrect Resource Transfer Between Spheres Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-73530 | Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() | flyto-core | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19710 | SourceCodester Simple Student Information System view_department.php sql injection | Simple Student Information System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery | mcp-rdf-explorer | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73038 | NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name | NodeBB | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19716 | Stored Cross-site Scripting in Pentestify user account deletion via unescaped username | Pentestify | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-73671 | Saurus CMS Unauthenticated Open Redirect via logout url parameter | Saurus CMS Community Edition | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-49856 | @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization | jshookmcp | 4.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-73657 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay | trigger.dev | 4.2 (v3.1) | Medium | 347009 |
| CVE-2026-23603 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | Gitea Open Source Git Server | 3.1 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19752 | EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery | mcp-dominican-layer | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19756 | Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal | lamp-cloud | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-63298 | LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration | lxd | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-66898 | Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE | lxd | 9.9 (v3.1) | Critical | 390719 |
| CVE-2026-73263 | Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path | prowler | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73294 | Semaphore U: OS Command Injection | semaphore | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-44741 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parame | pimcore | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15217 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16033 | Arbitrary file read+write on host via templates/ symlink in malicious image | lxd | 8.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-65937 | WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI | whatsup gold | 8.0 (v3.1) | High | 340147 , 340148 , 340149 |
| CVE-2026-73498 | MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_at | mcp-atlassian | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-64826 | rConfig < 8.2.13 Path Traversal File Read via FileDownloadController | rConfig | 7.1 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | astro | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium | 333140 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-70560 | Ultimate POS Stored XSS via First Name Field in Leave Notifications | Ultimate POS (Stock Management & Point of Sale) | 4.8 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49262 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | pagible | 3.0 (v3.1) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-46670 | YesWiki: Unauthenticated SQL Injection | yeswiki | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-31114 | Fooocus webui vulnerable to Remote Code Execution | Fooocus | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73069 | Twenty: SQL Injection in the searchVector Field Settings Allows Arbitrary PostgreSQL Execution | twenty | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-55676 | Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component | Malcolm | 8.8 (v3.1) | High | 351000 |
| CVE-2026-72557 | Cockpit CMS Cockpit CMS - Unrestricted File Upload | Cockpit CMS | 8.8 (v3.1) | High | 351000 |
| CVE-2026-73222 | Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (–studio) | claude-code-templates | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2016-20097 | Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad | E-cology 8.0 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-50997 | Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp | E-cology 9.0 | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72713 | XAgent Path Traversal Arbitrary File Read via /workspace/file | XAgent | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-5917 | libgit2 Shell Command Injection via ssh_libssh2 Backend | libgit2 | 8.6 (v4.0) | High | 340014 , 347009 , 393655 |
| CVE-2026-51583 | usememos through v0.30.0 Server-Side Request Forgery Vulnerability | - | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73079 | Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstrea | sub2api | 8.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67179 | Genkit improper host header validation | genkit | 7.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72607 | Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age | Koha | 7.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72609 | Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl | Koha | 7.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-71475 | Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path | advanced cluster management for kubernetes | 6.8 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-72608 | Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name | Koha | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-73243 | kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass | kkFileView | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48483 | TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server | typebot.io | 5.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48762 | TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler | typebot.io | 5.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73082 | Activepieces: Server-side request forgery in MCP tool validation endpoint | activepieces | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73244 | kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing | kkFileView | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-19434 | Stored Cross-site Scripting in Pentestify finding severity field | Pentestify | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72747 | AVideo Stored Cross-Site Scripting via Unauthenticated Registration | AVideo | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72610 | Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation | Koha | 4.3 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-73087 | Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher | dozzle | 2.3 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-72899 | Metabase SQL injection via public card or dashboard | Metabase | 10.0 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72738 | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72740 | Dokploy: OS Command Injection via SSH-form customGitUrl domain in ssh-keyscan | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72865 | Dokploy: OS Command Injection via compose composePath | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72868 | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72869 | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72872 | Dokploy: OS Command Injection via Bitbucket owner/repository in git clone | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-72882 | Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72902 | Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72592 | dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload | phpfm | 9.8 (v3.1) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72878 | Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments | dokploy | 9.6 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72879 | Dokploy: Command Injection via Registry Credentials in Swarm Upload | dokploy | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-47754 | unauthenticated path traversal in Metacat 2.x | metacat | 9.3 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63106 | ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php | Ready eCommerce | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-72875 | Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile | dokploy | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71966 | CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer | cyberpanel | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72870 | Dokploy: Command Injection via Docker Credentials in buildRemoteDocker | dokploy | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-72874 | Dokploy: Command Injection via Unescaped Git URL in Clone Commands | dokploy | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-66738 | SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite | SPIP | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-71964 | CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload | cyberpanel | 7.1 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-73033 | Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php | sucuri-wordpress-plugin | 7.0 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72739 | Dokploy: Command Injection via Compose Shell Execution | dokploy | 6.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-16949 | Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup | Term Pages | 5.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-19379 | EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection | ipTIME AX8004M | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-19384 | SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection | Simple Doctors Appointment System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-17010 | Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta | Saitama Addon Pack | 5.4 (v3.1) | Medium | 346755 |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14860 | Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery | Podcast Player | 5.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-69116 | FlyEnv < 4.18.0 Cross-Site Scripting via v-html | FlyEnv | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | SQLBot | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-14238 | Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report | vitepos | 4.1 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19375 | dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery | article-scraper-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19378 | code-projects Task Management System CommentSave.php cross site scripting | Task Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19383 | saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload | SaiAdmin | 2.0 (v4.0) | Low | 351000 |
| CVE-2026-71984 | MSI Radix AXE6600 v781521 Command Injection via urlfilter | Radix AXE6600 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71992 | MSI Radix AXE6600 v781521 Command Injection via macfilter | Radix AXE6600 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-19343 | code-projects Task Management System AdminLogin.php sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19344 | code-projects Task Management System comment_count_user.php sql injection | Task Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19374 | adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery | api-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-17011 | Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection | Nexter Blocks | 3.8 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-19340 | anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery | ProjectHub-Mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19347 | itsourcecode Hospital Management System viewdoctor.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19364 | itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19369 | KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery | jira-mcp-server | 1.9 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19373 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery | KoboldCPP-MCP-Server | 1.9 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19353 | DedeCMS Installation Wizard index.php _4_Setup file inclusion | DedeCMS | 1.3 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-71944 | D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71945 | D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71946 | D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71947 | D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71948 | D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71949 | D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71950 | D-Link DWR-M961 Command Injection via /boafrm/formSmsManage | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71951 | D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71952 | D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71953 | D-Link DWR-M961 Command Injection via /boafrm/formNtp | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71954 | D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-71955 | D-Link DWR-M961 Command Injection via /boafrm/formWsc | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-71956 | D-Link DWR-M961 Command Injection via app.cgi | DWR-M961 | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-16559 | YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload | YMC Filter | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | flowise | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16558 | YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema | YMC Filter | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-16955 | AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription | AI Engine | 5.0 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-64637 | All Plesk Versions below 18.0.79.5 Reseller Privilege Escalation to Root | Plesk | 9.9 (v3.0) | Critical | 341245 , 344366 |
| CVE-2022-4995 | Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp | E-cology 9.0 | 9.3 (v4.0) | Critical | 351000 |
| CVE-2026-64638 | WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) | WordPress | 8.9 (v4.0) | High | 344370 |
| CVE-2026-47659 | Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} | pathling | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-47661 | Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read | pathling | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-64636 | Plesk 18.0.51 up to 18.0.79.4 Blind SQL Injection | Plesk | 7.7 (v3.1) | High | 341245 |
| CVE-2026-48093 | Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed | code-embed | 6.5 (v3.1) | Medium | 333140 |
| CVE-2026-19196 | SourceCodester Photo Share Website ajax.php login sql injection | Photo Share Website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-19211 | SourceCodester Photo Share Website ajax.php signup sql injection | Photo Share Website | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17597 | Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification | Nexus Repository 3 | 5.1 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19210 | SourceCodester Photo Share Website ajax.php save_upload unrestricted upload | Photo Share Website | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-19246 | HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery | nanobot | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19209 | SourceCodester Photo Share Website index.php home cross site scripting | Photo Share Website | 2.0 (v4.0) | Low | 333140 , 333141 , 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2026-19207 | PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting | Company Visitor Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15732 | WGDashboard Server-Side Request Forgery Vulnerability | WGDashboard | 9.8 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-15733 | WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read | WGDashboard | 9.8 (v3.1) | Critical | 344360 , 393655 |
| CVE-2026-67688 | ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability | ICS-Park Smart Park Management System v2.0 | 9.8 (v3.1) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67689 | FineAdmin V1.0 Arbitrary Code Execution Vulnerability | FineAdmin V1.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12605 | glassfish Server-Side Request Forgery Vulnerability | glassfish | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53975 | OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec | OpenChamber | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-53976 | OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read | OpenChamber | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-70558 | Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token | Dinky | 9.3 (v4.0) | Critical | 351000 |
| CVE-2024-39024 | In Packetfence 13.2.0, the WebGui interface setting Arbitrary Code Execution Vulnerability | - | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62857 | Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources | fedify | 8.8 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-3430 | Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi | Creative Mail | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-63725 | sysPass FileBackupService Authenticated OS Command Injection via Backup Path | sysPass | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-16268 | Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler | Newsletters | 8.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48081 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer | appointment-booking-software | 8.1 (v3.1) | High | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-16065 | Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import | Welcart e-Commerce | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-45573 | Decidim: Push subscriptions can be abused for server-side requests | decidim | 6.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-11588 | EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation | EONSR AEO Agent | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18973 | heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery | super-agent-party | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19000 | JeecgBoot Anonymous Chat Attachment send server-side request forgery | JeecgBoot | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19021 | SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection | Computer Repair Shop Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-19020 | itsourcecode Hospital Management System servicetype.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19040 | MissionSquad mcp-api dcrClients.ts server-side request forgery | mcp-api | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19067 | itsourcecode Hospital Management System treatment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19068 | itsourcecode Hospital Management System treatmentdetail.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19069 | itsourcecode Hospital Management System treatmentrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19070 | itsourcecode Hospital Management System viewadmin.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19071 | itsourcecode Hospital Management System viewappointment.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-19110 | DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting | DataGear | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15360 | Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args | Ajax Load More | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-17623 | Langflow is affected OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-17625 | Langflow is affected by OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-60009 | theia Arbitrary Code Execution Vulnerability | theia | 8.8 (v3.1) | High | 351000 |
| CVE-2026-34966 | Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass | Gitea | 8.3 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71320 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props | nuxt | 8.1 (v3.1) | High | 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8183 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10716 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation | Directus | 7.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16573 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload | Bit Form | 7.5 (v3.1) | High | 346755 |
| CVE-2026-46581 | mojarra Path Traversal Vulnerability | mojarra | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-61891 | theia Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | theia | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-71209 | audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Trave | audiobookshelf | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-18900 | H3C NX15 Backend RPC esps file.exec os command injection | NX15 | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-71284 | Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename | fledge | 7.2 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7646 | Langflow is affected by security vulnerabilities in Model Context Protocol features | langflow | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2026-7658 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-17505 | WordPress TranslatePress < 3.2.6 - Cross-Site Scripting | translatepress-multilingual | 6.1 (v3.1) | Medium | 333141 , 341256 , 346755 , 347198 , 350148 |
| CVE-2026-17532 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting | Seraphinite Accelerator | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-7869 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 5.4 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-71283 | Fledge IoT Gateway Backup Restore Tar Path Traversal | fledge | 4.9 (v3.1) | Medium | 344360 , 390709 |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | GeoDirectory | 3.5 (v3.1) | Low | 346755 |
| CVE-2026-18896 | lavkush-maurya Student-Registration-System changepass.php sql injection | Student-Registration-System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-18959 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal | InnoShop | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-18856 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | Rhymix CMS | 2.0 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-70477 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | flowise | 9.5 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69256 | Flowise: Remote Code Execution Vulnerability in CSVAgent | Flowise | 9.4 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-69110 | OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music | opencode-studio | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-70553 | MaxSite CMS Unauthenticated RCE via Install Endpoint | MaxSite CMS | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69251 | Flowise RCE via TypeORM DataSource | Flowise | 9.0 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-70369 | Koha - SQL Injection in reports/acquisitions_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-70370 | Koha - SQL Injection in reports/catalogue_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-70373 | Koha - SQL Injection in reports/issues_stats.pl | Koha | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-67200 | Perspective 5.0.0 Path Traversal via cwd_static_file_handler | perspective | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69100 | LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution | lamp-cloud | 8.7 (v4.0) | High | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-70492 | Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages | open-webui | 8.7 (v3.1) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-65986 | CVAT has stored XSS via annotation guide assets | cvat | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 341256 , 342259 , 350147 , 350148 |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | Flowise | 8.5 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-69704 | Atals-Livre SQL Injection via Unsanitized GET Parameter in supp() | Atals-Livre | 7.0 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14872 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter | Database for Contact Form 7, WPforms, Elementor forms | 6.8 (v3.1) | Medium | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | Brizy | 6.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-16548 | Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat | 6.5 (v3.1) | Medium | 351000 |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | open-webui | 6.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-70620 | Odysseus SSRF via Embedding Endpoint Configuration | odysseus | 6.1 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | EmbedPress | 5.8 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18788 | Trippo ResponsiveFilemanager dialog.php unrestricted upload | ResponsiveFilemanager | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id | Simple Google Calendar Outlook Events Widget | 5.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15233 | Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title | Nested Pages | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18766 | chetans9 core-php-admin-panel customers.php sql injection | core-php-admin-panel | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-18774 | NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery | hermes-agent | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-69083 | SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69084 | SiYuan - SQL Execution | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344366 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69085 | SiYuan before v3.7.3 SQL Injection via searchDocs | siyuan | 9.9 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-51775 | Fastadmin v.1.6.1.20250430 SQL Injection Vulnerability | Fastadmin v.1.6.1.20250430 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69240 | Sequelize: SQL Injection (Oracle DB) | sequelize | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39932 | OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection | openemr | 9.4 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-16532 | Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form | Link Library | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41453 | Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter | laravel-crm | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69089 | Grav CMS before 2.0.11 Path Traversal via watermark | grav | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69095 | OpenWrt luci-app-bmx7 Path Traversal via bmx7-info | luci | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-69096 | OpenWrt luci-app-dockerman Read ACL Remote Code Execution | luci | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 350147 , 390904 , 393655 |
| CVE-2026-39931 | OpenEMR Authenticated SQL Injection via backup.php Import Feature | openemr | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-61523 | WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor | WebsiteBaker CMS | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67599 | ClearOS 7.9 OS Command Injection via Log Viewer filter parameter | ClearOS | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-67608 | Telenia TVox 26.5.3 OS Command Injection via action_audio.php | TVox | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 |
| CVE-2026-69088 | Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint | grav | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-69086 | SiYuan before v3.7.3 Path Traversal via unvalidated avID | siyuan | 8.3 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-69192 | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trus | ip-address | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18737 | Shlink Blind SQL Injection via tags/stats orderBy Parameter | Shlink | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38444 | osTicket v1.18.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-38446 | Cross-Site Scripting | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-18641 | Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginC | Operation and Maintenance Security Management System | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-18646 | danpros HTMLy Author Name htmly.php path traversal | HTMLy | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 |
| CVE-2026-49131 | OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field | OPNsense | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-49132 | OPNsense < 26.1.9 Stored XSS via Certificate Description Field | OPNsense | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15673 | Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read | Import and export users and customers | 4.9 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16297 | Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import | Clearfy Cache | 4.1 (v3.1) | Medium | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390904 , 398008 |
| CVE-2026-18644 | danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal | HTMLy | 2.1 (v4.0) | Low | 344360 |
| CVE-2026-18645 | danpros HTMLy Admin Content Endpoint admin.php add_content path traversal | HTMLy | 2.1 (v4.0) | Low | 344360 |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | AcyMailing | 8.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | King Addons for Elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | JetEngine | 5.4 (v3.1) | Medium | 333140 , 340095 , 340147 , 342259 , 346755 |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-68583 | luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name | luci | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | Narrative Publisher | 4.6 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 346755 , 350147 , 350148 |
| CVE-2026-67308 | Wazuh GitHub Actions Shell Injection via Fork Pull Request | wazuh | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | sso | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-67309 | Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass | traefik | 7.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | Theme Demo Import | 7.2 (v3.1) | High | 351000 |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | Everest Toolkit | 7.2 (v3.1) | High | 351000 , 382238 , 390501 |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search | HUSKY | 7.2 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-13725 | Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax | Dynamic Pricing With Discount Rules for WooCommerce | 7.1 (v3.1) | High | 346755 |
| CVE-2026-67352 | luci-app-https-dns-proxy Stored XSS via resolver_url | luci | 6.8 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | Codeless Page Builder | 5.4 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | Admin Columns for ACF Fields | 5.4 (v3.1) | Medium | 333141 , 340087 , 340095 , 340099 , 341099 , 341266 |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | Support Genix | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes | Spectra Legacy | 3.5 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 , 350147 , 350148 |
| CVE-2025-69946 | SourceCodester Modern Loan Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69948 | SourceCodester Modern Loan Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | Kirki | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | Product Feed Manager For WooCommerce | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | Kirki | 7.5 (v3.1) | High | 340014 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo | core | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-56671 | ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read | ComfyUI | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite) | ElementsKit Elementor Addons | 7.2 (v3.1) | High | 340014 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14833 | Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute | Lightbox with PhotoSwipe | 6.8 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-14554 | Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters | Check & Log Email | 6.5 (v3.1) | Medium | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-52371 | xxl-job v3.4.0 Server-Side Request Forgery Vulnerability | xxl-job v3.4.0 | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-14845 | NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget | NewStatPress | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode | Ultimate Addons for WPBakery Page Builder | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-52232 | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-45376 | Decidim: Admin user search allows SQL injection through similarity-based sorting | decidim | 5.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-59231 | Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs | Pentestify | 5.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59232 | Stored Cross-site Scripting in Prospero Flow CRM lead name field | Prospero Flow CRM | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-55495 | Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account | cloudreve | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | WP Go Maps | 3.7 (v3.1) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) | ElementsKit Elementor Addons | 3.5 (v3.1) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-55825 | Contao: Possible path traversal in job download URIs | contao | 3.1 (v3.1) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-67350 | Serendipity < 2.6.1 Open Redirect via exit.php | Serendipity | 2.1 (v4.0) | Low | 344365 |
| CVE-2025-65336 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69930 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69931 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69933 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69934 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69935 | SQL Injection | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69936 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69937 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69938 | CodeAstro Membership Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69941 | SourceCodester Tailor Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69947 | SourceCodester Tailor Management System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12940 | Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint | langflow | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-35847 | the CheckUils.php file Arbitrary Code Execution Vulnerability | the CheckUils.php file | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-66418 | OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field | openclaw agent dashboard | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-67206 | Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload | wolfcms | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2026-57862 | Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation | Kanboard | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-67346 | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass | swarms | 7.7 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16969 | DFIR-IRIS Stored XSS in Assets | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18360 | DFIR-IRIS Stored XSS in Custom Attributes | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-18361 | DFIR-IRIS Stored XSS in Datastore Upload | iris-web | 7.6 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | tourmaster | 7.1 (v3.1) | High | 333141 , 340087 , 340095 , 340099 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | boruta | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15153 | WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search | WP Hotel Booking | 6.8 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15974 | sglang Server-Side Request Forgery Vulnerability | sglang | 6.5 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-65341 | Ecommerce Fruits Bazar 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | Animation Addons for Elementor | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14207 | LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information | LifterLMS | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16531 | Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet | Red Hat Enterprise Linux 10 | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-64870 | MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation | MaxKB | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-66414 | Leantime Open Redirect in Login Controller via redirectUrl Parameter | Leantime | 5.1 (v4.0) | Medium | 344365 |
| CVE-2025-65340 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67403 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67404 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69942 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69943 | SQL Injection | - | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41939 | Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly | Care Everywhere Gateway | 9.3 (v4.0) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-67426 | Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration | flyto-core | 9.3 (v3.1) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-11974 | Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download | wp-media-folder-addon | 8.6 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-67424 | Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation | flyto-core | 8.5 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-67428 | Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF | flyto-core | 8.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-5487 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5491 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-67405 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67406 | Advocate office management system Arbitrary Code Execution Vulnerability | Advocate office management system | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67407 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67408 | Sourcecodester CASAP Automated Enrollment System 1.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69944 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69945 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69949 | kishan0725 Hospital Management System 4.0 SQL Injection Vulnerability | - | 7.3 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | WOLF | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | PhotoSwipe | 6.8 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability | Dify | 5.4 (v3.0) | Medium | 344365 |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17524 | zip-lib Path Traversal Vulnerability | zip-lib | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54650 | openhole-server vulnerable to path traversal via URL-decoded request path | openhole | 8.6 (v3.1) | High | 347009 |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | 8.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54691 | datamodel-code-generator vulnerable to SSRF via –url: no host/IP validation, follows redirects | datamodel-code-generator | 8.2 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | Database for Contact Form 7, WPforms, Elementor forms | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-56722 | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | dompdf | 6.3 (v4.0) | Medium | 344360 , 390709 |
| CVE-2026-63302 | Local File Inclusion in Quick.CMS | Quick.CMS | 5.1 (v4.0) | Medium | 344360 , 347009 |
| CVE-2026-55554 | Dompdf: Chroot Validation Bypass | dompdf | 2.3 (v4.0) | Low | 344360 , 390709 |
| CVE-2026-48030 | Pheditor 2.0.1-2.0.3 - OS Command Injection | pheditor | 9.9 (v3.1) | Critical | 320008 , 320019 , 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-66395 | SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol | siyuan | 9.4 (v4.0) | Critical | 333140 , 340095 , 341266 |
| CVE-2026-66398 | phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API | phpMyFAQ | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61511 | vBulletin 6.x - Remote Code Execution | vBulletin | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360151 , 393655 |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical | 300013 , 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | siyuan | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-50455 | the CodeIgniter Query Builder Arbitrary Code Execution Vulnerability | the CodeIgniter Query Builder | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-17552 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten | Plack::App::Prerender | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-59239 | Stored XSS in Prospero Flow CRM email body allows administrator account takeover | Prospero Flow CRM | 8.6 (v4.0) | High | 333140 , 333141 , 340095 |
| CVE-2026-66397 | phpMyFAQ before 4.1.6 Path Traversal via category image deletion | phpMyFAQ | 8.6 (v4.0) | High | 344360 , 390109 |
| CVE-2026-51077 | Dede CMS v.5.7.118 SQL Injection Vulnerability | Dede CMS v.5.7.118 | 7.5 (v3.1) | High | 340145 , 380122 |
| CVE-2026-51078 | Dede CMS v.5.7.118 Information Disclosure Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14827 | Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter | Calendar | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-12982 | Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery | Document Gallery | 6.1 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-13400 | Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information | Simply Schedule Appointments | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14190 | Sina Extension for Elementor < 3.10.2 - Reflected XSS | Sina Extension for Elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-51564 | the redirect parameter in Milk admin <=0.9.8 Open Redirect Vulnerability | - | 4.9 (v3.1) | Medium | 344365 |
| CVE-2026-14203 | Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title | Smart Manager | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-14236 | Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect | Contact Form 7 | 4.7 (v3.1) | Medium | 344365 |
| CVE-2026-14189 | WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields | WPBot | 3.8 (v3.1) | Low | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-48051 | Papra: SSRF via HTTP redirect bypass in webhook delivery | papra | 3.5 (v3.1) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | astro | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-17458 | mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery | openclaw-cn | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-65693 | Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates | microweber | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-65711 | sysPass 3.2.11 Authenticated OS Command Injection via Backup Path | sysPass | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-65707 | Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint | likeshop | 8.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-66004 | BlenderMCP Path Traversal via download_polyhaven_asset API | blender-mcp | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16910 | Quay: ssrf in red hat quay notification webhooks (slack/generic) | Red Hat OpenShift Update Service | 5.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47668 | DbGate - Remote Code Execution via Anonymous JWT | dbgate | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 360151 , 380026 |
| CVE-2026-47670 | DbGate - Remote Code Execution via Dynamic Import Bypass | dbgate | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 340149 , 340162 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 346755 , 380026 , 393655 |
| CVE-2026-63732 | 9router before 0.4.60 Remote Code Execution via default password | 9router | 9.4 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47669 | DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE | dbgate | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-65700 | h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API | h2ogpt | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 , 390719 |
| CVE-2026-65701 | SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route | so-vits-svc | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-65761 | Joomla Easy Store - SQL Injection | Easy Store | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-65760 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0 | Easy Store extension for Joomla | 9.2 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65702 | Vanna 2.0.2 Path Traversal via FileSystemConversationStore | vanna | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | nebula-mesh | 8.7 (v4.0) | High | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 , 398008 |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | shopper | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-65694 | Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read | microweber | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65759 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 | Easy Store extension for Joomla | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65919 | Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload | meshery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-63313 | 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch | 9router | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65695 | Office-Word-MCP-Server 1.1.11 Path Traversal via document tools | Office-Word-MCP-Server | 7.6 (v4.0) | High | 344360 , 390709 |
| CVE-2026-65698 | Void 1.3.4 Path Traversal via AI Agent File-Reading Tools | void | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16765 | CodeAstro Online Classroom loginlinkadmin.php sql injection | Online Classroom | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48530 | GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48531 | GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48532 | GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48534 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48535 | GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48536 | GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48537 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-48539 | GFI Archiver < 15.13 Stored XSS via MailInsights.aspx | GFI Archiver | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9577 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter | Post Status Notifier Lite | 4.8 (v3.1) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-48012 | Shopware SSO referer trust leading to an arbitrary redirect target | shopware | 4.3 (v3.1) | Medium | 344365 |
| CVE-2026-48013 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | shopware | 4.1 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-12968 | Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload | Product Addons and Product Options With Custom Fields | 8.8 (v3.1) | High | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | traefik | 7.8 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-12987 | Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration | Events Manager | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-65012 | InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder | InvokeAI | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-65593 | n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters | n8n | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-8984 | Unauthenticated RCE | maxicharger single charger firmware | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8985 | Unauthenticated Command Injection | maxicharger single charger firmware | 10.0 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-47391 | PraisonAI's unauthenticated A2A official example can reach real LLM-driven eval() tool execution | PraisonAI | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-52472 | Wgcloud 3.6.4 SQL Injection Vulnerability | Wgcloud 3.6.4 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8986 | Command Injection via Malicious OCPP Server | maxicharger single charger firmware | 9.5 (v4.0) | Critical | 340014 , 340023 , 340193 , 344360 , 344361 , 344362 , 344363 , 344364 , 344366 , 344370 |
| CVE-2016-20096 | Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp | Linknat VOS3000 | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-64824 | Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore | Home Assistant Core | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-65008 | Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData | grav | 9.3 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344365 , 344366 , 344370 , 393655 |
| CVE-2026-65057 | Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck | keep | 9.2 (v4.0) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65317 | Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass | Verba | 9.2 (v4.0) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-65318 | Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader | Verba | 9.2 (v4.0) | Critical | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47731 | NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by u | AIT-Core | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-43945 | FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection | FUXA | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55084 | SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read | dhis2-core | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-47394 | PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate | PraisonAI | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-65056 | mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering | mcp-webresearch | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47398 | PraisonAI: Arbitrary code execution via unguarded spec.loader.exec_module in agents_generator.py - sibling of CVE-20 | PraisonAI | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50758 | DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability | DayuanJiang next-ai-draw-io 0.4.13 | 8.1 (v3.1) | High | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass | lmdeploy | 7.7 (v4.0) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-52476 | aiflowy <= 2.1.2 SQL Injection Vulnerability | aiflowy <= 2.1.2 | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63080 | Aptabase SQL Injection via ClickHouse query backend | aptabase | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46556 | FlaskBB: SSRF in get_image_info() via unrestricted avatar URL | flaskbb | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-52475 | aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability | aiflowy <= 2.1.2 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13693 | Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal | Bit Form | 5.9 (v3.1) | Medium | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-16484 | SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16336 | trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect | trino | 5.3 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-64628 | Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers | grav | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16334 | itsourcecode Hospital Management System prescriptionorder.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16449 | zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection | ZS-Admin | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16451 | zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload | ZS-Admin | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-51027 | FileThingie v.2.5.7 Information Disclosure Vulnerability | - | 9.9 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-35048 | Piwigo RCE via PHP Code Injection into Config File in Installer | Piwigo | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-63766 | GPT-SoVITS 20250606v2pro OS Command Injection via webui.py | GPT-SoVITS | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-64625 | AVideo before 29.0 OS Command Injection via execAsync | AVideo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-13147 | WordPress Kirki < 6.0.12 - Server-Side Request Forgery | kirki | 9.1 (v3.1) | Critical | 320010 , 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35198 | HeyForm vulnerable to stored XSS via form field titles | heyform | 9.0 (v3.1) | Critical | 333140 , 333141 , 340095 , 342259 , 350147 , 350148 |
| CVE-2026-45270 | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | ci4ms | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-11349 | Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more | Modern Event Calendar Pro | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-40187 | Authenticated RCE via Malicious eTemplate Upload in EGroupware | egroupware | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63429 | HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context | heyform | 8.6 (v3.1) | High | 351000 |
| CVE-2026-45711 | Mailpit: Path traversal & arbitrary file write in mailpit dump –http via attacker-controlled message IDs | mailpit | 8.2 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-54910 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files | filebrowser | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | SlimStat Analytics | 7.5 (v3.1) | High | 333141 , 334168 , 340003 , 340099 , 340158 , 341099 , 342259 |
| CVE-2026-32820 | dataCycle Public Markdown Path Traversal Via /docs/*path | dataCycle-CORE | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34239 | Chamilo Authenticated Remote Code Execution | chamilo-lms | 7.5 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-46555 | WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration | whatsapp mcp server | 7.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 7.1 (v3.1) | High | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-59238 | Stored XSS in Pentestify via unsanitized finding images and report client logo | Pentestify | 6.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write | all-in-one-wp-migration | 6.5 (v3.1) | Medium | 330791 , 340152 , 340748 , 344360 , 347006 , 390709 , 390716 |
| CVE-2026-45797 | HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload | heyform | 6.4 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-63107 | LimeSurvey SSRF via REST API Survey Template Host Header | LimeSurvey | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63731 | HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint | hyperdx | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63769 | Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method | huginn | 6.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26483 | Mettle SendPortal 3.0.1 and earlier Cross-Site Scripting Vulnerability | Mettle SendPortal 3.0.1 and earlier | 6.1 (v3.1) | Medium | 333140 |
| CVE-2026-45709 | Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filte | mailpit | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63428 | HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's dec | heyform | 5.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 342259 , 350147 , 350148 |
| CVE-2026-16252 | Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection | Multimedia Integrated Business Display System | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-45138 | CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule | ci4ms | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-44583 | Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module | Paymenter | 5.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-63730 | HyperDX < 2.31.0 SSRF via Webhook Test Endpoint | hyperdx | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63768 | cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State | cal.diy | 5.3 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | AVideo | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53594 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path | freescout | 4.9 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-46516 | Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) | frogman | 4.8 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password | Kirki | 4.3 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16244 | itsourcecode Hospital Management System prescriptionorderreport.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16227 | SourceCodester Class and Exam Timetabling System edit_subject.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16228 | SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16219 | Croogo CMS Admin File Manager FileManager.php isEditable path traversal | CMS | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16222 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery | CordysCRM | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16223 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery | CordysCRM | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16229 | itsourcecode Courier Management System index.php cross site scripting | Courier Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16205 | Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting | CMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16125 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16127 | zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16128 | zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery | rt-claw | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16152 | SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16154 | SourceCodester Class and Exam Timetabling System edit_room1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57857 | Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter | Flow Payment | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 |
| CVE-2026-16124 | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery | GoClaw | 2.1 (v4.0) | Low | 334168 , 390719 |
| CVE-2026-16131 | itsourcecode Hospital Management System prescriptionrecord.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16194 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery | CowAgent | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16088 | halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal | halo | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16129 | princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist | SafestClaw | 1.9 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8481 | Remote Code Execution via Code Validation Endpoint | langflow | 9.9 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-36669 | ck_upload_handler.php in Feng Office 3.11.13.11 Arbitrary File Upload Vulnerability | ck upload handler.php in Feng Office 3.11.13.11 | 9.8 (v3.1) | Critical | 351000 |
| CVE-2026-52348 | cool-admin-java 8.0.0 SQL Injection Vulnerability | cool-admin-java 8.0.0 | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-63030 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | WordPress | 9.8 (v3.1) | Critical | 340156 , 344370 |
| CVE-2026-9198 | IBM Langflow - Remote Code Execution | langflow | 9.8 (v3.1) | Critical | 300008 , 340095 |
| CVE-2026-9586 | Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection | switchvox | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-58195 | Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into ex | agentic-flow | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44739 | Pimcore: SQL Injection in Custom Reports Column Configuration | pimcore | 8.7 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-62234 | Grav < 2.0.4 SSRF via Unrestricted cURL Protocols | grav | 8.4 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63094 | SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft | signoz | 7.6 (v4.0) | High | 344365 |
| CVE-2026-39359 | Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name | wazuh | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-50151 | oras-go: credential forwarding via unvalidated Location header in blob upload | oras | 7.5 (v3.1) | High | 390719 |
| CVE-2026-15094 | WP Hotel Booking <= 2.3.2 - Cross-Site Scripting | wp-hotel-booking | 6.1 (v3.1) | Medium | 300002 |
| CVE-2026-60137 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | WordPress | 5.9 (v3.1) | Medium | 340156 , 344370 |
| CVE-2026-16074 | AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery | AstrBot | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44181 | Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution | enterprise gateway | 10.0 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44182 | Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering | enterprise gateway | 10.0 (v4.0) | Critical | 340014 , 344362 , 344363 , 344364 , 344366 |
| CVE-2026-45695 | Kopia Server 0.23.0 - Remote Code Execution | kopia | 9.8 (v3.1) | Critical | 393655 |
| CVE-2026-46562 | Yamcs: Remote Code Execution via Mission Database algorithm override | yamcs | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63304 | AVideo through 29.0 OS Command Injection via listFFmpegProcesses | AVideo | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-63305 | AVideo through 29.0 OS Command Injection via ffmpeg.json.php | AVideo | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-46621 | Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection | yamcs | 9.1 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-45868 | LogicalDOC Enterprise up to and for v9.1.1 SQL Injection Vulnerability | - | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-45870 | LogicalDOC Enterprise up to and for v9.1.1 Path Traversal Vulnerability | - | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-30623 | LiteLLM 1.18.10 - Command Injection | LiteLLM 1.18.10 | 9.8 (v3.1) | Critical | 320009 |
| CVE-2026-53513 | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration | better-auth/sso | 9.6 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-45806 | Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url | penpot | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | directus | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-20297 | Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise | splunk | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33213 | Redash: Open redirect vulnerability in post-login redirect handling | redash | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-41580 | Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) | stirling pdf | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36214 | osTicket Cross-Site Scripting Vulnerability | osTicket | 6.4 (v3.1) | Medium | 333140 , 342259 |
| CVE-2026-6875 | ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE | servicenow | 9.5 (v4.0) | Critical | 380026 |
| CVE-2026-60121 | Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php | flamingo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61498 | Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php | flamingo | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-57827 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 | rsfiles! | 10.0 (v4.0) | Critical | 351000 |
| CVE-2026-9282 | W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read | W3 Total Cache | 7.5 (v3.1) | High | 336461 , 344360 |
| CVE-2026-3576 | Planyo Online Reservation System <= 3.0 - Arbitrary File Read | Planyo online reservation system | 7.2 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2026-14894 | WordPress Super Forms <= 6.3.313 - Arbitrary File Upload | super-forms | 9.8 (v3.1) | Critical | 340748 |
| CVE-2025-30007 | HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management | control panel | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-56292 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection | acymailing | 9.2 (v4.0) | Critical | 340157 , 360147 , 360148 |
| CVE-2026-58192 | Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin | appium/storage-plugin | 10.0 (v3.1) | Critical | 340007 , 344360 |
| CVE-2026-41042 | Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution | gravitino | 9.1 (v3.1) | Critical | 344370 |
| CVE-2026-6854 | My Calendar < 3.7.9 - Unauthenticated SQL Injection | My Calendar – Accessible Event Manager | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2026-49471 | Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE | serena | 8.3 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55592 | Dashy <= 4.3.6 - Reflected XSS via Workspace | dashy | 3.9 (v3.1) | Low | 340112 , 346755 , 350148 |
| CVE-2026-58455 | Dockwatch <= 0.6.567 - OS Command Injection | dockwatch | 9.2 (v4.0) | Critical | 344361 , 344363 |
| CVE-2026-11387 | SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation | sms-alert | 9.8 (v3.1) | Critical | 377360 |
| CVE-2026-34100 | Guardian Language-System SQL Injection via id Parameter in media.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34101 | Guardian Language-System SQL Injection via id Parameter in text_file.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34102 | Guardian Language-System SQL Injection via id Parameter in job_info_get.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34103 | Guardian Language-System SQL Injection via id Parameter in subtitles.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34104 | Guardian Language-System SQL Injection via name Parameter in designer.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34105 | Guardian Language-System SQL Injection via id Parameter in translate_text.php | language-system | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13731 | WPBot <= 8.4.9 - Cross-Site Scripting | chatbot | 7.2 (v3.1) | High | 346755 |
| CVE-2026-58138 | Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution | conductor | 9.3 (v4.0) | Critical | 337209 , 337211 , 344366 , 380026 , 393655 |
| CVE-2026-56782 | Gorse < 0.5.10 - Unauthenticated Database Dump | gorse | 9.3 (v4.0) | Critical | 301007 |
| CVE-2026-50229 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilter | kestra | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-53576 | Kestra <= 1.3.20 - Remote Code Execution | kestra | 10.0 (v3.1) | Critical | 391213 |
| CVE-2025-71334 | Flowise - Path Traversal | flowise | 9.3 (v4.0) | Critical | 340007 |
| CVE-2026-54836 | YMC Filter - SQL Injection | YMC Filter | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2025-71324 | Flowise - Path Traversal | flowise | 8.7 (v4.0) | High | 340007 |
| CVE-2026-53753 | Crawl4AI <= 0.8.6 - Remote Code Execution | crawl4ai | 10.0 (v3.1) | Critical | 350147 , 360151 , 380026 , 393655 |
| CVE-2026-28496 | FOSSBilling - Server-Side Template Injection | FOSSBilling | 9.4 (v4.0) | Critical | 340130 , 340155 , 341155 |
| CVE-2026-54157 | LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery | lobe-chat | 9.0 (v3.1) | Critical | 392301 |
| CVE-2026-54293 | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read | nltk | 7.5 (v3.1) | High | 347009 |
| CVE-2026-6858 | Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS | Transbank Webpay | 7.1 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8713 | Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion | fusion-builder | 9.1 (v3.1) | Critical | 344360 |
| CVE-2017-20260 | Joomla! Component Price Alert 3.0.2 SQL Injection | price alert | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20261 | Joomla! Component Bargain Product VM3 1.0 SQL Injection | bargain product vm3 | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20263 | Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location | focalpoint | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20266 | Joomla SP Movie Database 1.3 SQL Injection via searchword | standard pro movie database | 8.8 (v4.0) | High | 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20267 | Joomla! Component Calendar Planner 1.0.1 SQL Injection | calendar planner | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20268 | Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection | zap calendar lite | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20269 | Joomla! Component KissGallery 1.0.0 SQL Injection | kissgallery | 8.8 (v4.0) | High | 340145 , 380122 |
| CVE-2017-20271 | Joomla StreetGuessr Game 1.1.8 SQL Injection via catid | streetguessr game | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20272 | Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id | ultimate property listing | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20273 | Joomla Event Registration Pro Calendar 4.1.3 SQL Injection | event registration pro calendar | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20274 | Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath | learning management system king | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20275 | Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter | bridge | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20276 | Joomla! Component SIMGenealogy 2.1.5 SQL Injection | simgenealogy | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20277 | Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author | joomla joomrecipe | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20278 | Joomla JoomRecipe 1.0.3 SQL Injection via category parameter | joomrecipe | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20279 | Joomla Payage 2.05 SQL Injection via aid Parameter | joomla payage | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20280 | Joomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter | myportfolio | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20281 | Joomla! Component Extra Search 2.2.8 SQL Injection | extra search | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20282 | Joomla! Component jCart for OpenCart 2.0 SQL Injection | jcart for opencart | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25748 | Joomla JHotelReservation 6.0.7 SQL Injection via search-hotels | jhotelreservation | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25750 | Joomla J-MultipleHotelReservation 6.0.7 SQL Injection | multiplehotelreservation | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25751 | Joomla J-ClassifiedsManager 3.0.5 SQL Injection | classifiedsmanager | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25752 | Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection | j-businessdirectory | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25756 | Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard | vaccount | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25749 | Joomla J-CruisePortal 6.0.4 SQL Injection via cruises | j-cruiseportal | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25761 | Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id | joomcrm | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25760 | Joomla! Component Easy Shop 1.2.3 Local File Inclusion | easy shop | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55746 | Cotonti stored XSS via PFS folder title | Cotonti | 7.0 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48017 | DbGate: Remote Code Execution via functionName injection in loadReader endpoint | dbgate | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9278 | Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure | Form Builder CP | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8385 | WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure | wp-google-maps | 5.3 (v3.1) | Medium | 344365 |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | python-utcp | 2.1 (v4.0) | Low | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12211 | Intelbras iNVU 7016 FT Web syslog path traversal | iNVU 7016 FT | 2.0 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-11442 | Allegra exportReport Directory Traversal Information Disclosure Vulnerability | Allegra | 6.5 (v3.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-6428 | Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter | Koha | 5.6 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Store Locator WordPress | 3.5 (v3.1) | Low | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-9062 | Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal | Store Locator WordPress | 3.4 (v3.1) | Low | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-35273 | Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE | peoplesoft enterprise peopletools | 9.8 (v3.1) | Critical | 331032 |
| CVE-2026-42647 | JoomSport <= 5.7.7 - SQL Injection | joomsport-sports-league-results-management | 9.3 (v3.1) | Critical | 341245 , 344366 , 380122 |
| CVE-2026-8071 | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass | Anti-Spam by CleanTalk. Spam protection | 8.8 (v3.1) | High | 331702 , 333140 , 333141 , 344370 , 346755 |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics | openemr | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-3326 | XStore Theme < 9.7.3 - SQL Injection | Xstore | 8.6 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46491 | SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditi | simplesamlphp-module-casserver | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-3018 | WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection | Newsletters | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122 |
| CVE-2026-49069 | WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) | WPZOOM Portfolio | 7.1 (v3.1) | High | 300026 |
| CVE-2026-9060 | Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style | Store Locator WordPress | 3.5 (v3.1) | Low | 346755 |
| CVE-2017-20251 | WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API | Woody Code Snippets | 9.3 (v4.0) | Critical | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2016-20062 | Simply Poll 1.4.1 Plugin for WordPress SQL Injection | Simply Poll | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2017-20243 | WordPress Car Park Booking Plugin SQL Injection via space_id | Car Park Booking System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20247 | WordPress Plugin PICA Photo Gallery 1.0 SQL Injection | PICA Photo Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2017-20249 | WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection | Apptha Slider Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-36723 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | 8.8 (v3.1) | High | 340007 , 344360 , 390109 , 390709 |
| CVE-2017-20248 | WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download | Apptha Slider Gallery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-20250 | WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download | Mac Photo Gallery | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-46746 | sinec ins OS Command Injection Vulnerability | sinec ins | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50636 | LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection | LimeSurvey | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-36783 | Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-36796 | Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-36725 | FastapiAdmin v2.2.0 Cross-Site Scripting Vulnerability | FastapiAdmin v2.2.0 | 6.1 (v3.1) | Medium | 333140 |
| CVE-2026-36722 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | 5.4 (v3.1) | Medium | 351000 |
| CVE-2026-25860 | OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler | OpenClinic GA | 5.3 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-36726 | bookcars v8.3 Path Traversal Vulnerability | bookcars v8.3 | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-47106 | Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API | Banner Self-Service | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-46442 | Flowise < 3.1.2 - node-custom-function Unauthorized RCE | flowise | 9.4 (v4.0) | Critical | 345240 |
| CVE-2024-58348 | WordPress Background Image Cropper 1.2 Remote Code Execution | Background Image Cropper | 9.3 (v4.0) | Critical | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54350 | WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated | Augmented Reality | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 , 393781 |
| CVE-2026-25559 | OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25855 | OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25856 | OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface | openbullet2 | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9506 | Path Traversal Vulnerability in Bagisto | Bagisto | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2026-46484 | Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user | headplane | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40519 | Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins() | nginx-proxy-manager | 7.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-11474 | Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload | student-management-system | 5.5 (v4.0) | Medium | 351000 , 393655 |
| CVE-2026-11482 | SourceCodester Class and Exam Timetabling System archive5.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11483 | SourceCodester Class and Exam Timetabling System archive4.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11484 | SourceCodester Class and Exam Timetabling System archive3.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11485 | SourceCodester Class and Exam Timetabling System archive2.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11486 | SourceCodester Class and Exam Timetabling System archive1.php sql injection | Class and Exam Timetabling System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11488 | code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection | Simple Flight Ticket Booking System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11489 | code-projects Online Music Site AdminDeleteAlbum.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11490 | code-projects Online Music Site Search.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11501 | SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11582 | CodeAstro Student Attendance Management System index.php sql injection | Student Attendance Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11569 | Quay: quay: stored xss via filedrop svg upload | Red Hat Quay 3 | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-47983 | WordPress Plugin Stripe Payments 2.0.39 Stored XSS via currency_code | Accept Stripe Payments | 5.1 (v4.0) | Medium | 340095 , 346755 |
| CVE-2026-11467 | jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal | jshERP | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-11475 | Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection | student-management-system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11476 | Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization | student-management-system | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11477 | hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect | hsweb-framework | 2.1 (v4.0) | Low | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-11495 | CodeAstro Ingredients Stock Management System add_stock.php sql injection | Ingredients Stock Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11506 | CodeAstro Leave Management System search_staff_for_deletion.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11507 | CodeAstro Leave Management System delete_leave_type.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11508 | CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11510 | CodeAstro Leave Management System add_leave.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11513 | itsourcecode Hospital Management System adminaccount.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11514 | itsourcecode Hospital Management System addpatient.php sql injection | Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11518 | SourceCodester Inventory System User Management users.php cross site scripting | Inventory System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2026-11529 | designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection | mysql-mcp-server | 2.1 (v4.0) | Low | 340016 , 380122 |
| CVE-2026-11558 | CodeAstro Payroll System home_salary.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11559 | CodeAstro Payroll System view_account.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11583 | CodeAstro Student Attendance Management System createClass.php sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11584 | CodeAstro Student Attendance Management System createClass.php edit sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11585 | CodeAstro Student Attendance Management System createClassArms.php sql injection | Student Attendance Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11502 | JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect | JeecgBoot | 1.3 (v4.0) | Low | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-11450 | GL.iNet GL-MT3000 Path Normalization dlopen command injection | GL-MT3000 | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-11456 | Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection | CRM | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9290 | WP User Manager – User Profile Builder & Membership - Local File Inclusion | wp-user-manager | 7.5 (v3.1) | High | 320017 |
| CVE-2026-7537 | MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Par | MDJM Event Management | 7.2 (v3.1) | High | 351000 |
| CVE-2026-11435 | Jinher OA nextselectplan.aspx sql injection | OA | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11408 | vertex-app vertex Log Viewer Endpoint LogMod.js os command injection | vertex | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-11412 | Jinher OA GetFormSn.aspx sql injection | OA | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11434 | FluentCMS Blocks Plugin blocks cross site scripting | FluentCMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-48907 | Joomla! JCE extension < 2.9.99.5 unauthenticated RCE | jce | 10.0 (v4.0) | Critical | 333360 , 383871 |
| CVE-2026-49777 | WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE | Product Slider Pro for WooCommerce | 10.0 (v3.1) | Critical | 301006 |
| CVE-2026-10580 | Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover | Hippoo Mobile App for WooCommerce | 9.8 (v3.1) | Critical | 320008 , 330919 |
| CVE-2026-11419 | Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write | on-prem enterprise server | 9.4 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-11423 | Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation | Altium Enterprise Server | 9.4 (v4.0) | Critical | 344360 , 390709 |
| CVE-2026-46397 | haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 | haxcms-php | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-50230 | Lyrion Music Server <= 9.2.0 - Cross-Site Scripting | Lyrion Music Server | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390716 |
| CVE-2026-43986 | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | Tautulli | 9.9 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10880 | Unauthenticated SQL Injection in Osnexus Quantastor | QuantaStor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8037 | Progress ADC LoadMaster - Command Injection | connection manager for objectscale | 9.8 (v3.1) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35906 | An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability | - | 9.6 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2019-25727 | WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download | Ad Manager WD | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-25728 | Care2x 2.7 Hospital Information System SQL Injection via ck_config | Care2x | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25730 | Listing Hub CMS 1.0 SQL Injection via pages.php id | Listing Hub CMS | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25732 | PHP EI-Tube Script 3 SQL Injection via search parameter | EI-Tube | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25745 | WordPress Plugin Google Review Slider 6.1 SQL Injection via tid | Google Review Slider | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-69755 | Neterbit NW-431F Router vNW-431F-20241014-IR03 Arbitrary Code Execution Vulnerability | - | 8.2 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-11111 | chrome Security Vulnerability | ExampleProduct | 8.1 (v3.1) | High | 340016 , 340162 |
| CVE-2026-10870 | Shibby Tomato Web UI rc start_dhcpc os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10871 | Shibby Tomato Web UI rc start_6rd_tunnel os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10873 | Shibby Tomato Web UI rstats rstats_path os command injection | Tomato | 7.3 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42538 | IRIS has an Insecure File Upload | iris-web | 6.3 (v3.1) | Medium | 351000 |
| CVE-2026-40605 | Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API | Tautulli | 5.7 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-25731 | Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact | Zuz Music | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2019-25739 | GigToDo Freelance Marketplace Script 1.3 Persistent XSS | GigToDo | 5.1 (v4.0) | Medium | 333140 , 333141 |
| CVE-2026-42329 | Iris has an Open Redirect issue | iris-web | 4.7 (v3.1) | Medium | 344365 |
| CVE-2026-10806 | mjperpinosa stumasy add_post.php unrestricted upload | stumasy | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-10807 | mjperpinosa stumasy change_profile_image.php unrestricted upload | stumasy | 2.1 (v4.0) | Low | 351000 |
| CVE-2026-10808 | itsourcecode Fees Management System manage_student.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10809 | itsourcecode Fees Management System manage_user.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10810 | itsourcecode Fees Management System navbar.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-10811 | itsourcecode Fees Management System receipt.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10874 | projectworlds Online Art Gallery Shop Project adminHome.php sql injection | Online Art Gallery Shop Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10875 | projectworlds Online Art Gallery Shop Project adminHome.ph sql injection | Online Art Gallery Shop Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-26379 | koha Server-Side Request Forgery Vulnerability | koha | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10694 | SourceCodester Online Food Ordering System index.php include file inclusion | Online Food Ordering System | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10704 | SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection | Pizzafy E-Commerce System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-26378 | koha Arbitrary Code Execution Vulnerability | koha | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42840 | ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals | ERPNext | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-43924 | FOSSBilling has an open redirect via administrator-configured redirect targets | FOSSBilling | 4.8 (v4.0) | Medium | 344365 |
| CVE-2026-10690 | wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery | DesktopCommanderMCP | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49143 | BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler | browserstack-runner | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5073 | WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection | armember | 7.5 (v3.1) | High | 320011 |
| CVE-2026-35718 | fd8136 firmware Path Traversal Vulnerability | fd8136 firmware | 6.5 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-49120 | Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint | medplum | 6.3 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10620 | code-projects Student Admission System index.php sql injection | Student Admission System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41412 | alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script | alf.io | 4.9 (v3.1) | Medium | 344360 |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10301 | itsourcecode Fees Management System index.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-10302 | itsourcecode Fees Management System manage_fee.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10558 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low | 344360 , 347009 |
| CVE-2026-10559 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10568 | itsourcecode Fees Management System manage_payment.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10662 | ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery | blender-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10567 | 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting | CordysCRM | 2.0 (v4.0) | Low | 333140 , 333141 |
| CVE-2026-10583 | nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery | GoClaw | 2.0 (v4.0) | Low | 334168 , 390719 |
| CVE-2026-10514 | 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting | CordysCRM | 1.9 (v4.0) | Low | 333140 |
| CVE-2026-10529 | westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting | CicadasCMS | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2026-44825 | Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials | solr | 9.8 (v3.1) | Critical | 330925 |
| CVE-2018-25428 | Paroiciel 11.20 SQL Injection via tRecIdListe Parameter | Paroiciel | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25433 | Joomla JE Photo Gallery 1.1 SQL Injection via categoryid | JE Photo Gallery | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25434 | WP AutoSuggest 0.24 SQL Injection via autosuggest.php | WP AutoSuggest | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-43624 | F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project() | F5-TTS | 8.8 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-45505 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia addNetworkConnector Discovery Wrapper Bypass | activemq | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42588 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector | activemq | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25429 | Paroiciel 11.20 SQL Injection via zProIdPro Parameter | Paroiciel | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25430 | Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter | Paroiciel | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25431 | No-Cms 1.0 SQL Injection via order_by Parameter | No-CMS | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42253 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties | activemq | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-10214 | zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection | chatgpt-on-wechat | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-10249 | itsourcecode Online Blood Bank Management System viewrequest.php sql injection | Online Blood Bank Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10250 | itsourcecode Online Blood Bank Management System campsdetails.php sql injection | Online Blood Bank Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10251 | itsourcecode Online House Rental System ajax.php login sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-10252 | itsourcecode Online House Rental System manage_tenant.php sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10253 | itsourcecode Online House Rental System manage_payment.php sql injection | Online House Rental System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10260 | CodeAstro Online Job Portal delete-jobs.php sql injection | Online Job Portal | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10261 | CodeAstro Online Job Portal application_status.php sql injection | Online Job Portal | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10262 | code-projects Real State Services Login loginuser.php sql injection | Real State Services | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10263 | SourceCodester Computer Repair Shop Management System manage_product.php sql injection | Computer Repair Shop Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10280 | horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery | mcpilot | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10287 | SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery | SEO Meta Tag Extractor | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-49138 | Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following | nanobot | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48559 | Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags | lms | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10202 | OFCMS JSON Query SystemDictController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10203 | OFCMS JSON Query SystemParamController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10204 | OFCMS JSON Query SysUserController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10209 | code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection | Online Hospital Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10213 | AstrBotDevs AstrBot API Endpoint delete path traversal | AstrBot | 2.1 (v4.0) | Low | 340007 , 344360 |
| CVE-2026-10239 | JeecgBoot edit WordUtil.addImage server-side request forgery | JeecgBoot | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10240 | JeecgBoot test server-side request forgery | the file /airag/airagModel/test | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10241 | jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet | The server processes these URLs | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10256 | itsourcecode Content Management System save_comment.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10258 | itsourcecode Content Management System add_sub_topic.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10265 | itsourcecode Content Management System edit_topic.php sql injection | Content Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10274 | indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery | aem-mcp-server | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10276 | hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery | Jenkins-server-mcp | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10278 | ishayoyo excel-mcp read_file/write_file index.ts path traversal | excel-mcp | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-10279 | hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection | wezterm-mcp | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10286 | CodeAstro Payroll System home_employee.php sql injection | Payroll System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10289 | code-projects Hotel and Tourism Reservation System tour.php cross site scripting | Hotel and Tourism Reservation System | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10296 | itsourcecode Fees Management System ajax.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-10297 | itsourcecode Fees Management System manage_course.php sql injection | Fees Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10228 | raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting | student management system by php | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49489 | OpenCATS - SQL Injection in DataGrid sortDirection Parameter | OpenCATS | 8.4 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10178 | code-projects Online Music Site AdminEditAlbum.php sql injection | Online Music Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10186 | code-projects Online Hospital Management System patient.php sql injection | Online Hospital Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10170 | code-projects Visitor Management System phone_0.php sql injection | Visitor Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10172 | Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload | Multi-Store Inventory Management System | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10193 | OFCMS ComnController ComnController.java query sql injection | OFCMS | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10155 | Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection | Multi-Store Inventory Management System | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-10171 | code-projects Online Music Site AdminUpdateAlbum.php sql injection | Online Music Site | 2.0 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25412 | Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php | deltasql | 9.3 (v4.0) | Critical | 351000 |
| CVE-2018-25411 | MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php | MGB OpenSource Guestbook | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25413 | AiOPMSD Final 1.0.0 SQL Injection via search.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25414 | AiOPMSD Final 1.0.0 SQL Injection via actor.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25416 | AiOPMSD Final 1.0.0 SQL Injection via country.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25417 | AiOPMSD Final 1.0.0 SQL Injection via quality.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25418 | AiOPMSD Final 1.0.0 SQL Injection via year.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25419 | AiOPMSD Final 1.0.0 SQL Injection via genre.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25420 | AiOPMSD Final 1.0.0 SQL Injection via watch.php | AiOPMSD Final | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25422 | MOGG web simulator Script All Version SQL Injection via play.php | MOGG web simulator Script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25424 | Gate Pass Management System 2.1 SQL Injection via login-exec.php | Gate Pass Management System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25425 | Yot CMS 3.3.1 SQL Injection via aid and cid Parameters | Yot CMS | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25409 | SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php | SIM-PKH | 8.7 (v4.0) | High | 351000 |
| CVE-2018-25410 | SIM-PKH 2.4.1 SQL Injection via media.php id Parameter | SIM-PKH | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25421 | Open STA Manager 2.3 Arbitrary File Download via Path Traversal | Open STA Manager | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10112 | sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting | STUDENT-MANAGEMENT-SYSTEM | 1.9 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-45629 | Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint | dokploy | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-45632 | Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution | dokploy | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45668 | Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) | Trilium | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-45630 | Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement | dokploy | 9.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25385 | E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai | Registrasi Pencak Silat | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25386 | HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php | HaPe PKH | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25394 | Kados R10 GreenBee SQL Injection via update_release.php | Kados R10 GreenBee | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25395 | Kados R10 GreenBee SQL Injection via update_feature.php | Kados R10 GreenBee | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-45578 | WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | avideo | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45662 | Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) | dokploy | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10108 | xiaomusic 0.5.7 Path Traversal via GET /music endpoint | xiaomusic | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | haxcms-nodejs | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-44238 | FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | freepbx | 8.5 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-46372 | SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl | SillyTavern | 8.5 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44285 | FastGPT: SSRF Protection Bypass via externalFile in Dataset Preview API | FastGPT | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-47179 | Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane | arcane | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard Module | freepbx | 7.6 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-25392 | MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter | MaxOn ERP | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25393 | Navigate CMS 2.8.5 Path Traversal via navigate_download.php | Navigate CMS | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-10107 | MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint | MoviePilot | 7.0 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44652 | SillyTavern: SSRF vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45731 | WWBN AVideo: Authenticated Arbitrary File Read in view/update.php | avideo | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-46337 | WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in view/img/image404Raw.php | avideo | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39229 | Bolt CMS through 3.7.0 SQL Injection Vulnerability | - | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-44287 | FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*(/ is bypassable | FastGPT | 6.3 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45626 | Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter | arcane | 6.3 (v3.1) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-36324 | SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45580 | WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | avideo | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write | groupoffice | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-10052 | Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints | Red Hat Quay 3 | 4.1 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44881 | Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update | portainer | 8.5 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-45344 | LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances | LinkAce | 8.1 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-8054 | dotCMS Core Publish Audit API - Unauthenticated SQL Injection | dotcms | 10.0 (v4.0) | Critical | 340145 , 340156 , 344366 |
| CVE-2026-44886 | Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection | Pi.Alert | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-3001 | Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting | gutenverse | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2026-9606 | itsourcecode Courier Management System manage_user.php sql injection | Courier Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9607 | itsourcecode Courier Management System parcel_list.php sql injection | Courier Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9608 | QianFox FoxCMS Administrator Backend edit cross site scripting | FoxCMS | 1.9 (v4.0) | Low | 340095 , 346755 |
| CVE-2026-44450 | Lumiverse: RCE via MCP stdio argument injection | Lumiverse | 9.9 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-48687 | fastnetmon Command Injection Vulnerability | fastnetmon | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-43982 | Algernon: Path traversal file write via savein() | algernon | 8.7 (v4.0) | High | 340007 , 344360 , 390709 |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44669 | Faction: Stored XSS in Assessment Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42425 | OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery | OpenKM Community Edition | 8.6 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42785 | OpenKM 6.3.12 Remote Code Execution via Administrative Scripting | OpenKM Community Edition | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-45298 | Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) | dozzle | 8.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-44706 | Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values | chatwoot | 8.5 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48126 | Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir | algernon | 8.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48695 | fastnetmon Command Injection Vulnerability | fastnetmon | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-45082 | Karakeep has a SSRF Protection Bypass via Redirect Handling | karakeep | 7.6 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-41917 | OpenKM 6.3.12 Local File Inclusion via Admin Scripting | OpenKM Community Edition | 6.9 (v4.0) | Medium | 344360 , 347009 |
| CVE-2026-48710 | Starlette - Improper Validation of Unsafe Equivalence in Input | starlette | 6.5 (v3.1) | Medium | 320009 |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy | MaxKB | 6.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-9525 | itsourcecode Electronic Judging System edit_judge.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9526 | itsourcecode Electronic Judging System edit_team.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9528 | itsourcecode Electronic Judging System delete_judge.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9573 | itsourcecode Student Transcript Processing System index.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9574 | itsourcecode Student Transcript Processing System trans.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9575 | itsourcecode Student Transcript Processing System index.php sql injection | Student Transcript Processing System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9584 | code-projects Project Management System Login chk.php sql injection | Project Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9524 | xianrendzw EasyReport REST Endpoint execute sql injection | EasyReport | 5.3 (v4.0) | Medium | 340017 , 340145 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch | MaxKB | 5.1 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-36239 | PbootCMS v.3.2.11 Cross-site Scripting Vulnerability | PbootCMS v.3.2.11 | 4.3 (v3.1) | Medium | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-43936 | e107: Server-Side Request Forgery (SSRF) in the remote file fetcher | e107 | 4.3 (v3.1) | Medium | 337109 , 337110 , 341737 , 341738 , 344360 , 398021 , 398022 |
| CVE-2026-9515 | Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9518 | hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting | CodeIgniter-StudentManagementSystem | 2.1 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9531 | Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9532 | Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9533 | Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9534 | Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9542 | CodeAstro Leave Management System add_staff.php sql injection | Leave Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9405 | Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9406 | Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9407 | Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9408 | Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9432 | Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9433 | Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9434 | Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9435 | Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9436 | Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9454 | Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9455 | Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9456 | Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9457 | Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9458 | Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9475 | Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-9476 | Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9477 | Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9478 | Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25362 | Twitter-Clone 1 SQL Injection via follow.php | PHP-Twitter-Clone | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25364 | Twitter-Clone 1 SQL Injection via search.php | PHP-Twitter-Clone | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25371 | mooSocial Store Plugin 2.6 SQL Injection via product parameter | mooSocial Store Plugin | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25372 | MedDream PACS Server Premium 6.7.1.1 SQL Injection via email | PACS Server Premium | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2018-25374 | Softneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal | MedDream PACS Server Premium | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9469 | yashpokharna2555 StudentManagementSystem success.php sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9470 | yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9474 | yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9424 | Edimax EW-7438RPn Content-Type formWlanMP os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9450 | code-projects Employee Management System psubmit.php sql injection | Employee Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9451 | code-projects Employee Management System applyleaveprocess.php sql injection | Employee Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9473 | c-rick jimeng-mcp api.ts generateVideo path traversal | jimeng-mcp | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2026-9511 | Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9512 | Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9514 | Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection | CA750-PoE | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9464 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery | yudao-cloud | 2.0 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-9384 | Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9385 | Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-9386 | Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9387 | Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9388 | Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9404 | Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9355 | SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9356 | SourceCodester Hospitals Patient Records Management System manage_history.php sql injection | Hospitals Patient Records Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9364 | projectworlds Online Art Gallery Shop adminHome.php sql injection | Online Art Gallery Shop | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9372 | ItzCrazyKns Vane Model Provider API route.ts server-side request forgery | Vane | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-9383 | itsourcecode Electronic Judging System login.php sql injection | Electronic Judging System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9347 | Edimax EW-7438RPn webs formWizSurvey os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-25357 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | dolibarr erp/crm | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 |
| CVE-2018-25340 | Smartshop 1 SQL Injection via category.php | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25341 | Smartshop 1 SQL Injection via product.php id Parameter | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25342 | Smartshop 1 SQL Injection via search.php | Smartshop | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25348 | Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail | Ek Rishta | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25351 | Joomla! Component EkRishta 2.10 SQL Injection via username | EkRishta | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25346 | WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php | Form Maker | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2018-25352 | WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id | Ultimate Form Builder Lite | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9302 | 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection | vps-inventory-monitoring | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9342 | SourceCodester Hospitals Patient Records Management System view_history.php sql injection | Hospitals Patient Records Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-9343 | Edimax EW-7438RPn webs formWpsStart os command injection | EW-7438RPn | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls | typebot.io | 10.0 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41075 | RT: SQL injection via entry_aggregator parameter in JSON search | rt | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-28445 | Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview | typebot.io | 8.7 (v3.1) | High | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-41147 | NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class | nukeviet | 8.7 (v3.1) | High | 333140 |
| CVE-2026-39965 | TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks | typebot.io | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-45145 | Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 Path Traversal Vulnerability | - | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40598 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | mantisbt | 6.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-36227 | Easy Chat Server 3.1 Arbitrary Code Execution Vulnerability | Easy Chat Server 3.1 | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-40295 | Devise: Open Redirect via Unvalidated request.referrer in Timeoutable Session Timeout Handler | devise | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7798 | FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 5.4 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 340464 , 340465 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48231 | Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48232 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48233 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48234 | Open ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48236 | Open ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48237 | Open ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48238 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48239 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48240 | Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters | Tickets | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-4093 | Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) | taxonomy term reference tree widget | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 |
| CVE-2026-48214 | Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48215 | Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48218 | Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48219 | Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48220 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48221 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48222 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48223 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48224 | Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48225 | Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48226 | Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7890 | Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block | concrete cms | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-8139 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName | concrete cms | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-9082 | Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query | drupal | 9.8 (v3.1) | Critical | 340156 , 341245 |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | xwiki-commons | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-7467 | Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation | expand-maker | 8.8 (v3.1) | High | 377360 |
| CVE-2026-39352 | Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal | frappe | 8.7 (v4.0) | High | 340007 , 340029 , 344360 , 344370 , 390709 |
| CVE-2026-9133 | Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read | RabbitMQ AWS | 8.3 (v4.0) | High | 344360 |
| CVE-2026-7460 | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | mailcow-dockerized | 7.4 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 , 350147 , 350148 |
| CVE-2026-35593 | Trilium Notes has Local File Inclusion via upload modified file API endpoint | Trilium | 6.8 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-39311 | Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments | Trilium | 6.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340099 , 341099 , 342259 , 344363 |
| CVE-2026-26028 | CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS | cryptpad | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5776 | Email Encoder < 2.4.7 - Unauthenticated Stored XSS | Email Encoder | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 |
| CVE-2026-39960 | MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values | mantisbt | 5.4 (v3.1) | Medium | 333140 , 341256 |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35016 | Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter | tickets | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34234 | CtrlPanel: Unauthenticated RCE using installer script | panel | 10.0 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-30118 | scalar/astro v0.1.13 was discovered to Server-Side Request Forgery Vulnerability | - | 9.8 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-37281 | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-46725 | TYPO3 ceselector Extension - Insecure Deserialization | ceselector | 9.2 (v4.0) | Critical | 360153 |
| CVE-2026-31069 | BillaBear (all versions prior to Jan 2026) SQL Injection Vulnerability | BillaBear (all versions prior to Jan 2026) | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34216 | CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php | panel | 6.6 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34246 | CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output | panel | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2026-29962 | HSC MailInspector - Local File Inclusion | mailinspector | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | facturascripts | 7.2 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-42596 | Gotenberg < 8.31.0 - Server-Side Request Forgery | gotenberg | 9.4 (v3.1) | Critical | 344362 , 398004 |
| CVE-2026-42281 | MagicMirror <= 2.35.0 - Server-Side Request Forgery | magicmirror | 9.2 (v4.0) | Critical | 398001 |
| CVE-2026-42578 | Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation | netty | 2.9 (v4.0) | Low | 390719 |
| CVE-2026-44262 | Scramble Laravel - Remote Code Execution | scramble | 9.4 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2026-44343 | WGDashboard < 4.3.2 - Unauthenticated File Read | wgdashboard | 9.3 (v4.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-2614 | MLflow <= 3.9.0 - Arbitrary File Read | mlflow | 7.5 (v3.1) | High | 398008 |
| CVE-2026-6433 | FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution | custom-css-js-php | 7.3 (v3.1) | High | 340016 , 340017 , 360147 , 360148 |
| CVE-2026-42188 | Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL | geyser | 4.3 (v3.1) | Medium | 337109 , 337110 , 398021 , 398022 |
| CVE-2026-8264 | Tenda AC6 httpd WifiApScan formWifiApScan os command injection | ac6 firmware | 2.1 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8259 | Tenda AC6 httpd telnet os command injection | ac6 firmware | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8265 | Tenda AC6 httpd getLogFile get_log_file os command injection | ac6 firmware | 2.0 (v4.0) | Low | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2021-47940 | WordPress Download From Files 1.48 Arbitrary File Upload | Download From Files | 9.3 (v4.0) | Critical | 351000 |
| CVE-2021-47928 | Opencart TMD Vendor System 3.x Blind SQL Injection via product route | Extension TMD Vendor System | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-47930 | Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated | Balbooa Joomla Forms Builder | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-47938 | ImpressCMS 1.4.2 Remote Code Execution via Autotasks | ImpressCMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2021-47939 | Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation | Evolution CMS | 8.7 (v4.0) | High | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2021-47943 | TextPattern CMS 4.8.7 Remote Code Execution via File Upload | TextPattern CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2022-50944 | Aero CMS 0.0.1 PHP Code Injection via posts.php | Aero CMS | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50954 | WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion | cab-fare-calculator | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-50956 | WordPress Plugin amministrazione-aperta 3.7.3 Local File Read | amministrazione-aperta | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-47931 | Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication | Exponent CMS | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-47947 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php | Projectsend | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50948 | Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting | Motopress Hotel Booking Lite | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50958 | WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php | Jetpack | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50959 | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php | Contact Form Builder | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2022-50960 | WordPress International Sms Contact Form 7 Integration 1.2 XSS | International Sms For Contact Form | 5.1 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 |
| CVE-2022-50961 | WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS | IP2Location Country Blocker | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-50970 | WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter | WordPress Plugin AAWP | 5.1 (v4.0) | Medium | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-8227 | Wavlink NU516U1 adm.cgi wzdapMesh os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8228 | Wavlink NU516U1 wireless.cgi advance os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8229 | Wavlink NU516U1 wireless.cgi WifiBasic os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8230 | Wavlink NU516U1 login.cgi sys_login1 os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8231 | CodeAstro Online Catering Ordering System deleteorder.php sql injection | Online Catering Ordering System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-44313 | LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function | linkwarden | 9.1 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42455 | LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) | linkwarden | 8.8 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-42605 | AzuraCast: Path Traversal in currentDirectory Parameter Enables Remote Code Execution via Media Upload | azuracast | 8.8 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-8188 | Wavlink NU516U1 adm.cgi change_wifi_password os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8189 | Wavlink NU516U1 adm.cgi wzdrepeater os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8190 | Wavlink NU516U1 adm.cgi wan os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-8191 | Wavlink NU516U1 adm.cgi wifi_region os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-8192 | Wavlink NU516U1 adm.cgi wzdap os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42454 | Termix: OS Command Injection in Docker Container Management Endpoints | Termix | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42345 | FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, a | FastGPT | 7.7 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-42344 | OpenCMS - XML external entity (XXE) | opencms | 7.3 (v3.1) | High | 330791 , 340152 , 344372 |
| CVE-2024-33288 | Prison Management System - SQL Injection Authentication Bypass | prison management system | 7.3 (v3.1) | High | 341245 |
| CVE-2024-46507 | Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE | yeti | 7.3 (v3.1) | High | 340130 , 360151 |
| CVE-2026-42339 | New API: SSRF Filter Bypass via 0.0.0.0 | new api | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42344 | FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints | FastGPT | 6.3 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44284 | FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution | FastGPT | 6.3 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2023-42343 | OpenCMS - Cross-Site Scripting | opencms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2024-33724 | SOPlanning 1.52.00 Cross Site Scripting | soplanning | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-42350 | Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter | kargo | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-44286 | FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation | FastGPT | 2.3 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-38428 | kestra SQL Injection Vulnerability | kestra | 9.8 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-38431 | erpnext Code Injection Vulnerability | erpnext | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-33324 | SQLBot prompt injection allows arbitrary SQL execution and remote code execution | sqlbot | 9.4 (v4.0) | Critical | 340014 , 340016 , 340017 , 340023 , 340029 , 340157 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-40329 | SQL Injection vulnerability via sortBy in beanFeed | MasaCMS | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-40330 | Masa CMS SQL injection via sortDirection parameter in beanFeed | MasaCMS | 9.3 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7412 | Eclipse BaSyx SSRF Vulnerability | Eclipse BaSyx | 8.6 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2026-40075 | OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet | openmrs | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-40280 | Gotenberg <= 8.30.1 - Server Side Request Forgery | gotenberg | 7.8 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 344362 , 398021 , 398022 |
| CVE-2026-39383 | Gotenberg unauthenticated blind SSRF via unfiltered webhook URL | gotenberg | 6.9 (v4.0) | Medium | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-38432 | erpnext Cross-Site Scripting Vulnerability | erpnext | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-38947 | FluentCMS 1.2.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-42796 | Arelle < 2.39.10 - Remote Code Execution | arelle | 9.2 (v4.0) | Critical | 340162 , 340163 |
| CVE-2026-4060 | Geo Mashup <= 1.13.18 - SQL Injection | Geo Mashup | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2026-6229 | Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter | Royal Addons for Elementor – Addons and Templates Kit for Elementor | 7.2 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-41940 | cPanel & WHM - Authentication Bypass via Session-File CRLF Injection | cpanel | 9.3 (v4.0) | Critical | 377364 |
| CVE-2026-27760 | OpenCATS - Command Injection | OpenCATS | 9.2 (v4.0) | Critical | 344363 , 344370 |
| CVE-2026-7202 | Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7203 | Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7204 | Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | A8000RU | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41363 | OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter | openclaw | 6.0 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-7205 | duartium papers-mcp-server main.py search_papers path traversal | papers-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7206 | dubydu sqlite-mcp entry.py extract_to_json sql injection | sqlite-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7212 | edvardlindelof notes-mcp notes_mcp.py path traversal | notes-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7214 | eghuzefa engineer-your-data server.py file_inf path traversal | engineer-your-data | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7216 | donchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal | processing-claude-mcp-bridge | 5.5 (v4.0) | Medium | 344360 , 390709 |
| CVE-2026-7217 | Deepractice PromptX Document File index.ts read_pdf absolute path traversal | PromptX | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7220 | jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection | FastlyMCP | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery | CloudBase-MCP | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7223 | BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery | HyperChat | 5.5 (v4.0) | Medium | 334168 , 390719 |
| CVE-2026-7314 | eiceblue spire-doc-mcp-server base.py get_doc_path path traversal | spire-doc-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7315 | eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal | spire-pdf-mcp-server | 5.5 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-7319 | elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal | execution-system-mcp | 5.5 (v4.0) | Medium | 340007 , 344360 |
| CVE-2026-7196 | CodeAstro Online Classroom guestdetails sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7222 | code-projects Coaching Management System Complaint Form complaint.php cross site scripting | Coaching Management System | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery | nextchat | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7194 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection | Pharmacy Sales and Inventory System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-40466 | Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass | activemq | 8.8 (v3.1) | High | 330925 , 340162 , 340163 |
| CVE-2026-41473 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints | cyberpanel | 8.8 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41472 | CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard | cyberpanel | 5.3 (v4.0) | Medium | 333140 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41179 | RClone RC - Command Injection | rclone | 9.2 (v4.0) | Critical | 340014 , 344370 |
| CVE-2026-40887 | Vendure Core - SQL Injection | vendure | 9.1 (v3.1) | Critical | 340156 , 340157 , 341245 , 344361 , 344363 , 360147 , 360148 |
| CVE-2026-41456 | Bludit CMS <= 3.20.0 - Cross-Site Scripting | bludit | 5.1 (v4.0) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2026-5718 | Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution | drag-and-drop-multiple-file-upload-contact-form-7 | 8.1 (v3.1) | High | 382238 |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-40105 | XWiki - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39808 | Fortinet FortiSandbox - Command Injection | fortisandbox | 9.8 (v3.1) | Critical | 344363 |
| CVE-2026-24893 | openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion | openitcockpit | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35031 | Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain | jellyfin | 8.8 (v3.1) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35196 | Chamilo LMS has OS Command Injection via export_all_certificates action | chamilo lms | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | 8.6 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35032 | Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner | jellyfin | 8.6 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action | chamilo lms | 7.2 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-39387 | BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter | boidcms | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33714 | Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) | chamilo lms | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34212 | Docmost page content has stored XSS via unsanitized attachment URLs | docmost | 5.4 (v3.1) | Medium | 333140 |
| CVE-2026-34161 | Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution | chamilo lms | 5.1 (v4.0) | Medium | 333140 |
| CVE-2026-4810 | Google ADK-Python - Unauthenticated Builder Endpoint | adk-python | 9.3 (v4.0) | Critical | 390726 , 392647 |
| CVE-2026-33534 | EspoCRM <= 9.3.3 - Server-Side Request Forgery | espocrm | 4.3 (v3.1) | Medium | 398003 |
| CVE-2026-5814 | PHPGurukul Online Course Registration check_availability.php sql injection | Online Course Registration | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5824 | code-projects Simple Laundry System userchecklogin.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5827 | code-projects Simple IT Discussion Forum question-function.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340147 , 340148 , 340156 , 341256 , 342259 , 346755 |
| CVE-2026-5829 | code-projects Simple IT Discussion Forum content.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2026-5832 | atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery | api-lab-mcp | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5823 | itsourcecode Construction Management System borrowed_tool_report.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5834 | code-projects Online Shoe Store admin_running.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-5835 | code-projects Online Shoe Store admin_football.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-5836 | code-projects Online Shoe Store admin_product.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-31040 | stata-mcp Code Injection Vulnerability | stata-mcp | 9.8 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-3296 | Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder | 9.8 (v3.1) | Critical | 300007 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2026-39394 | CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controller | ci4ms | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 |
| CVE-2026-3396 | WCAPF WooCommerce Ajax Product Filter - SQL Injection | WCAPF – Ajax Product Filter for WooCommerce | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2026-39844 | NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization | nicegui | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-5802 | idachev mcp-javadc HTTP os command injection | mcp-javadc | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5805 | code-projects Easy Blog Site contact_us.php sql injection | Easy Blog Site | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5813 | PHPGurukul Online Course Registration check_availability.php sql injection | Online Course Registration | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35455 | immich has Stored XSS via OCR Text in 360° Panorama Viewer | immich | 5.4 (v3.1) | Medium | 333140 , 333141 , 340147 , 341256 , 346755 |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39390 | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | ci4ms | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39392 | CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization | ci4ms | 4.8 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-5803 | bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery | openai-realtime-ui | 2.1 (v4.0) | Low | 337109 , 340162 , 347009 , 390722 |
| CVE-2026-5806 | code-projects Easy Blog Site update.php cross site scripting | Easy Blog Site | 2.0 (v4.0) | Low | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-0740 | Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload | ninja forms file uploads | 9.8 (v3.1) | Critical | 382238 |
| CVE-2026-23696 | Windmill < 1.603.3 - SQL Injection | windmill | 9.4 (v4.0) | Critical | 341245 |
| CVE-2026-39342 | ChurchCRM has a SQL injection searchwhat parameter via QueryView.php | churchcrm | 9.4 (v4.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34197 | Apache ActiveMQ - Remote Code Execution | activemq | 8.8 (v3.1) | High | 330925 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | vite | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39364 | Vite Dev Server - Directory Traversal | vite | 8.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39341 | SQL injection in ChurchCRM.0 | churchcrm | 8.1 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39361 | OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url | openobserve | 7.7 (v3.1) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39369 | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | avideo | 7.6 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-39847 | Emmett has a path traversal in internal assets handler | emmett | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-39343 | ChurchCRM has a SQL Injection in Event Type Editor (Admin) | churchcrm | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39370 | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr | avideo | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5739 | PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection | PowerJob | 6.9 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39368 | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | avideo | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34371 | LibreChat Affected by Arbitrary File Write via execute_code Artifact Filename Traversal | librechat | 6.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-39365 | Vite has a Path Traversal in Optimized Deps .map Handling | vite | 6.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5692 | Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5736 | PowerJob detailPlus Endpoint InstanceController.java sql injection | PowerJob | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5741 | suvarchal docker-mcp-server HTTP index.ts pull_image os command injection | docker-mcp-server | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39380 | Open Source Point of Sale has Stored XSS in Stock Location (Configuration) | open source point of sale | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5719 | itsourcecode Construction Management System borrowedtool.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340145 , 340156 , 341145 , 380122 , 390572 |
| CVE-2026-34976 | Dgraph <=v25.3.0 - Admin Mutation Missing Authorization | dgraph | 10.0 (v3.1) | Critical | 398008 |
| CVE-2026-35471 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs | goshs | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-35395 | WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter | wegia | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35470 | OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals | openstamanager | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35029 | LiteLLM - Arbitrary File Read | litellm | 8.7 (v4.0) | High | 344360 , 390709 |
| CVE-2026-35184 | EcclesiaCRM has a Critical SQL Injection | ecclesiacrm | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34885 | WordPress Media Library Assistant <= 3.34 - SQL Injection | Media LIbrary Assistant | 8.5 (v3.1) | High | 377360 |
| CVE-2026-35174 | Chyrp Lite has a Path Traversal to Remote Code Execution | chyrp lite | 7.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-35404 | Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter | openedx | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-5631 | assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection | gpt-researcher | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5634 | projectworlds Car Rental Project Parameter book_car.php sql injection | Car Rental Project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5672 | code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5677 | Totolink A7100RU cstecgi.cgi CsteSystem os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5678 | Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5688 | Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5689 | Totolink A7100RU cstecgi.cgi setNtpCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5690 | Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5691 | Totolink A7100RU cstecgi.cgi setFirewallType os command injection | A7100RU | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-5606 | PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection | Online Shopping Portal Project | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-35396 | WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35398 | WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35472 | WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35473 | WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] | wegia | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-35474 | WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect'] | wegia | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-35475 | WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect'] | wegia | 5.1 (v4.0) | Medium | 340165 , 344365 |
| CVE-2026-35411 | Directus is an Open Redirect in Admin 2FA Setup Page | directus | 4.3 (v3.1) | Medium | 344365 |
| CVE-2026-5607 | imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery | mcp-browser-agent | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5620 | itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5635 | PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5636 | PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5675 | itsourcecode Construction Management System Parameter borrowed_tool.php sql injection | Construction Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5681 | itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection | sanitize or validate this input | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5621 | ChrisChinchilla Vale-MCP HTTP index.ts os command injection | Vale-MCP | 1.9 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2019-25687 | Pegasus CMS 1.0 Remote Code Execution via extra_fields.php | pegasus cms | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2019-25662 | ResourceSpace 8.6 SQL Injection via watched_searches.php | resourcespace | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25668 | News Website Script 2.0.5 SQL Injection via index.php | news website script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25669 | qdPM 9.1 SQL Injection via search_by_extrafields Parameter | qdpm | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25675 | eDirectory All Versions SQL Injection Authentication Bypass | edirectory | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25678 | C4G BLIS 3.4 SQL Injection via users_select.php | computing for good's basic laboratory information system | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25680 | Advance Gift Shop Pro Script 2.0.3 SQL Injection via search | advance gift shop pro script | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25684 | OpenDocMan 1.3.4 SQL Injection via where Parameter | opendocman | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25694 | Kados R10 GreenBee SQL Injection via user2reset | kados | 8.8 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25671 | VA MAX 8.3.4 Remote Code Execution via changeip.php | VA MAX | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2019-25673 | UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload | Laravel File Manager | 8.7 (v4.0) | High | 351000 |
| CVE-2019-25664 | SuiteCRM 7.10.7 SQL Injection via record Parameter | suitecrm | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5551 | itsourcecode Free Hotel Reservation System Parameter login.php sql injection | Free Hotel Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5554 | code-projects Concert Ticket Reservation System Parameter process_search.php sql injection | Concert Ticket Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5555 | code-projects Concert Ticket Reservation System Parameter login.php sql injection | Concert Ticket Reservation System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5564 | code-projects Simple Laundry System Parameter searchguest.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5565 | code-projects Simple Laundry System Parameter delmemberinfo.php sql injection | Simple Laundry System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5573 | Technostrobe HI-LED-WR120-G2 fs unrestricted upload | hi-led-wr120-g2 firmware | 5.5 (v4.0) | Medium | 351000 |
| CVE-2026-5575 | SourceCodester/jkev Record Management System Login index.php sql injection | Record Management System | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5577 | Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection | cross browser fingerprinting | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5538 | QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery | OnlineJudge | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5547 | Tenda AC10 httpd formAddMacfilterRule os command injection | ac10 firmware | 5.3 (v4.0) | Medium | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5537 | halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection | CourseSEL | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5543 | PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection | User Registration & Login and User Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5552 | PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5553 | itsourcecode Online Cellphone System Parameter available.php sql injection | Online Cellphone System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5558 | PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection | PHPGurukul Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5560 | PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5578 | CodeAstro Online Classroom Parameter addassessment.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5579 | CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5580 | CodeAstro Online Classroom Parameter addvideos.php sql injection | Online Classroom | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5583 | PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection | Online Shopping Portal Project | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5576 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload | Record Management System | 2.0 (v4.0) | Low | 340156 , 341245 , 351000 , 390501 |
| CVE-2026-35616 | FortiClient EMS - Authentication Bypass | forticlient ems | 9.8 (v3.1) | Critical | 392301 |
| CVE-2016-20052 | Snews CMS 1.7 Unrestricted File Upload via snews_files | snews | 9.3 (v4.0) | Critical | 351000 |
| CVE-2025-15064 | Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 6.4 (v3.1) | Medium | 346755 |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-0738 | Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2018-25248 | MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php | mybb downloads | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-31818 | Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | budibase | 9.9 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34612 | Kestra: Remote Code Execution via SQL Injection | kestra | 9.0 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59710 | biztalk360 Arbitrary Code Execution Vulnerability | biztalk360 | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-27634 | Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter | piwigo | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-28797 | RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Compone | ragflow | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34228 | Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write | emlog | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-35214 | Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write | budibase | 8.7 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2025-59711 | biztalk360 Path Traversal Vulnerability | biztalk360 | 8.3 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34936 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | praisonai | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-27834 | Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter | piwigo | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-27885 | Piwigo: SQL Injection in Activity.getList | piwigo | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34607 | Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE | emlog | 7.2 (v3.1) | High | 344360 , 347009 |
| CVE-2026-22664 | prompts.chat SSRF via Fal.ai Media Status Polling | prompts.chat | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-59709 | biztalk360 Path Traversal Vulnerability | biztalk360 | 6.8 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34787 | Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter | emlog | 6.5 (v3.1) | Medium | 344360 , 347009 |
| CVE-2026-34788 | Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters | emlog | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34229 | Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass | emlog | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-22662 | prompts.chat Blind SSRF via media-generate | prompts.chat | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-26477 | dokuwiki Denial of Service Vulnerability | dokuwiki | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5470 | mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request for | Google-Research-MCP | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-34745 | Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public | fireshare | 9.1 (v3.1) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-34524 | SillyTavern: Path traversal in /api/chats/export and /api/chats/delete allows arbitrary file read/delete within user | sillytavern | 8.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-34735 | Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in FileController | wiki | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34792 | Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34793 | Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34794 | Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34795 | Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34796 | Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34797 | Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | postiz | 8.6 (v3.1) | High | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34931 | hoppscotch: Improper loopback redirect_uri validation in device-login flow | hoppscotch | 8.5 (v4.0) | High | 344365 |
| CVE-2026-34932 | hoppscotch: Stored XSS via mock server responses on backend origin | hoppscotch | 8.5 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34576 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | postiz | 8.3 (v4.0) | High | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34725 | dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration | dbgate | 8.2 (v3.1) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34522 | SillyTavern: Path traversal in /api/chats/import allows arbitrary file write outside intended chat directory | sillytavern | 8.1 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2026-34847 | hoppscotch: Open redirect via /enter?redirect= | hoppscotch | 6.1 (v3.1) | Medium | 344365 |
| CVE-2026-5346 | huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery | hm editor | 5.5 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5368 | projectworlds Car Rental Project Parameter login.php sql injection | car rental project | 5.5 (v4.0) | Medium | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34590 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | postiz | 5.4 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34848 | hoppscotch: Stored XSS in team member overflow tooltip via display name | hoppscotch | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34523 | SillyTavern: Path traversal allows file existence oracle | sillytavern | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-34798 | Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34799 | Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34800 | Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34801 | Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34802 | Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34805 | Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34806 | Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34807 | Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34808 | Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34809 | Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34810 | Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34811 | Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34812 | Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34813 | Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34814 | Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34815 | Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34817 | Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34819 | Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34821 | Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-5351 | Trendnet TEW-657BRM setup.cgi add_wps_client os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5352 | Trendnet TEW-657BRM setup.cgi edit os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5353 | Trendnet TEW-657BRM setup.cgi ping_test os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5354 | Trendnet TEW-657BRM setup.cgi vpn_connect os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-5355 | Trendnet TEW-657BRM setup.cgi vpn_drop os command injection | tew-657brm firmware | 2.1 (v4.0) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-29014 | MetInfo CMS <= 8.1 - Remote Code Execution | metinfo | 9.3 (v4.0) | Critical | 340121 , 344363 , 360152 , 380026 , 390635 , 393655 |
| CVE-2026-34156 | NocoBase - VM Sandbox Escape to Remote Code Execution | nocobase | 9.9 (v3.1) | Critical | 344370 , 345240 , 360151 |
| CVE-2026-3300 | Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection | Everest Forms Pro | 9.8 (v3.1) | Critical | 300021 |
| CVE-2026-34243 | wenxian: Command Injection in GitHub Actions Workflow via issue_comment.body | wenxian | 9.8 (v3.1) | Critical | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-34449 | SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection | siyuan | 9.6 (v3.1) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 345240 , 393655 |
| CVE-2026-34361 | HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft | hl7 fhir core | 9.3 (v3.1) | Critical | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34367 | InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.7 (v3.1) | High | 337109 , 337110 , 340147 , 340162 , 340163 , 340165 , 344360 , 344370 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34605 | SiYuan Note - Cross-Site Scripting | siyuan | 8.6 (v4.0) | High | 300013 |
| CVE-2026-34365 | InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34366 | InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34163 | Server-Side Request Forgery via MCP Tools Endpoint in FastGPT | fastgpt | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-4267 | Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI | Query Monitor | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-34740 | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | avideo | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34396 | AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | avideo | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34442 | FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout | freescout | 6.1 (v3.1) | Medium | 340165 , 344365 |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34360 | HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing | hl7 fhir core | 5.8 (v3.1) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-30520 | loan management system SQL Injection Vulnerability | loan management system | 5.4 (v3.1) | Medium | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-32113 | Discourse: Open redirect via sso_destination_url cookie in enter | discourse | 5.1 (v4.0) | Medium | 344365 |
| CVE-2026-5206 | code-projects Simple Gym Management System Payment sql injection | Simple Gym Management System | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-31831 | Tautulli <= 2.16.1 - Path Traversal | tautulli | 8.7 (v4.0) | High | 346019 |
| CVE-2026-0560 | LolLMS < 2.2.0 - Server-Side Request Forgery | lollms | 7.5 (v3.1) | High | 360151 |
| CVE-2026-5027 | Langflow <= 1.8.4 - Path Traversal to RCE via File Upload | langflow | 8.8 (v3.1) | High | 300008 |
| CVE-2026-23921 | Blind, read-only SQL injection in Zabbix API via sortfield parameter | zabbix | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-33497 | Langflow < 1.7.0 - Path Traversal | langflow | 8.7 (v4.0) | High | 300006 |
| CVE-2026-22739 | Spring Cloud Config Server - Path Traversal | spring cloud config | 8.6 (v3.1) | High | 346019 |
| CVE-2026-23482 | Blinko < 1.8.4 - Path Traversal | blinko | 8.2 (v4.0) | High | 347009 |
| CVE-2026-23483 | Blinko <= 1.8.3 - Path Traversal via /plugins | blinko | 6.9 (v4.0) | Medium | 347009 |
| CVE-2026-3335 | Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload | Canto | 5.3 (v3.1) | Medium | 300007 |
| CVE-2026-3584 | WordPress Kali Forms <= 2.4.9 - Remote Code Execution | kali-forms | 9.8 (v3.1) | Critical | 300223 |
| CVE-2026-33236 | NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite | nltk | 8.1 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-23536 | Feast Feature Server <=0.58.0 - Arbitrary File Read | feast | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2026-22557 | UniFi Network Application - Path Traversal | UniFi Network Application | 10.0 (v3.1) | Critical | 340007 |
| CVE-2025-71260 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE | footprints | 8.7 (v4.0) | High | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2025-71257 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass | footprints itsm | 6.9 (v4.0) | Medium | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344382 , 344385 , 390613 , 390614 , 390722 , 398008 |
| CVE-2026-29066 | TinaCMS - Path Traversal | tinacms | 6.2 (v3.1) | Medium | 347009 , 390709 |
| CVE-2026-31844 | Authenticated SQL Injection in Koha displayby parameter of suggestion.pl | koha | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-2413 | Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection | Ally – Web Accessibility & Usability | 7.5 (v3.1) | High | 380026 , 380122 |
| CVE-2026-30958 | OneUptime < 10.0.21 - Path Traversal | oneuptime | 8.6 (v3.1) | High | 347009 |
| CVE-2026-31807 | SiYuan <= v3.5.9 - SVG Animate Element XSS | siyuan | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-31809 | SiYuan <= v3.5.9 - Cross Site Scripting | siyuan | 6.4 (v4.0) | Medium | 300013 |
| CVE-2026-29059 | Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal | windmill | 6.9 (v4.0) | Medium | 347009 |
| CVE-2026-29183 | SiYuan Note - Cross-Site Scripting | siyuan | 6.1 (v3.1) | Medium | 300013 , 340147 , 341266 , 347198 |
| CVE-2025-69411 | ionCube Tester Plus <= 1.3 - Local File Inclusion | ionCube tester plus | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-66024 | XWiki Blog Application home page vulnerable to Stored XSS via Post Title | blog application | 8.6 (v4.0) | High | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-1492 | WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 9.8 (v3.1) | Critical | 300020 |
| CVE-2026-27971 | Qwik - Unauthenticated RCE via server$ Deserialization | qwik | 9.2 (v4.0) | Critical | 391213 |
| CVE-2026-3395 | MaxSite CMS <=109.1 - Remote Code Execution | maxsite cms | 5.5 (v4.0) | Medium | 344364 , 344370 |
| CVE-2026-28414 | Gradio - Absolute Path Traversal | gradio | 7.5 (v3.1) | High | 390716 |
| CVE-2026-28409 | WeGIA <= 3.6.4 - Remote Code Execution | wegia | 7.2 (v3.1) | High | 344363 , 390700 , 393655 |
| CVE-2026-1557 | WP Responsive Images <= 1.0 - Arbitrary File Read | WP Responsive Images | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2026-2416 | Geo Mashup <= 1.13.17 - SQL Injection | Geo Mashup | 7.5 (v3.1) | High | 380122 |
| CVE-2026-0926 | Prodigy Commerce <= 3.3.0 - Local File Inclusion | Prodigy Commerce | 9.8 (v3.1) | Critical | 344360 |
| CVE-2026-1581 | wpForo Forum <= 2.4.14 - SQL Injection | wpForo Forum | 7.5 (v3.1) | High | 341245 , 380122 |
| CVE-2026-0561 | Shield Security <= 21.0.8 - Unauthenticated Reflected XSS | shield-security | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2025-70149 | membership management system SQL Injection Vulnerability | membership management system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-70150 | membership management system Missing Authorization Vulnerability | membership management system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-70152 | scholars tracking system SQL Injection Vulnerability | scholars tracking system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-27174 | MajorDoMo - Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical | 344360 , 344370 , 347009 , 390904 |
| CVE-2025-70151 | scholars tracking system Arbitrary Code Execution Vulnerability | scholars tracking system | 8.8 (v3.1) | High | 351000 |
| CVE-2025-14340 | Payara Server - Cross-Site Scripting | Payara Server | 7.3 (v4.0) | High | 341266 , 346755 |
| CVE-2026-1296 | Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect | Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin | 6.1 (v3.1) | Medium | 377360 |
| CVE-2026-27176 | MajorDoMo - Cross-Site Scripting | majordomo | 5.1 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 , 390501 |
| CVE-2026-26217 | Crawl4AI < 0.8.0 - Local File Inclusion | crawl4ai | 9.2 (v4.0) | Critical | 344360 |
| CVE-2026-25895 | FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write | fuxa | 9.5 (v4.0) | Critical | 340007 |
| CVE-2020-37123 | Pinger 1.0 - Remote Code Execution | Pinger | 9.3 (v4.0) | Critical | 344363 |
| CVE-2026-25512 | Group-Office < 26.0.5 - Remote Code Execution | group office | 9.4 (v4.0) | Critical | 344363 |
| CVE-2026-0743 | WP Content Permission <= 1.2 - Cross-Site Scripting | WP Content Permission | 4.4 (v3.1) | Medium | 346755 , 377360 , 390585 |
| CVE-2026-25616 | Blesta <= 5.13.1 - Cross-Site Scripting | blesta | 6.1 (v3.1) | Medium | 340112 , 346755 , 350148 |
| CVE-2026-1207 | Django RasterField - SQL Injection | django | 5.4 (v3.1) | Medium | 341245 |
| CVE-2025-40552 | SolarWinds Web Help Desk - Authentication Bypass | web help desk | 9.8 (v3.1) | Critical | 392301 |
| CVE-2026-0702 | VidShop for WooCommerce <= 1.1.4 - SQL Injection | VidShop – Shoppable Videos for WooCommerce | 7.5 (v3.1) | High | 341245 |
| CVE-2026-24128 | XWiki Platform Distribution Flavor Main - Cross-Site Scripting | xwiki-platform-distribution-flavor-main | 6.5 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2026-0770 | Langflow < 1.3.0 - Remote Code Execution via validate_code() exec() | langflow | 9.8 (v3.0) | Critical | 344360 , 344370 |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-47795 | GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting | geowebserver | 8.7 (v4.0) | High | 340007 , 340147 , 340148 , 341266 , 342259 , 344365 , 350148 , 390716 |
| CVE-2026-0594 | WordPress List Site Contributors < 1.1.8 - Reflected XSS | List Site Contributors | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-22200 | osTicket - Arbitrary File Read | osticket | 8.7 (v4.0) | High | 340147 , 340148 |
| CVE-2025-68493 | Apache Struts XWork - XML External Entity Injection | struts | 8.1 (v3.1) | High | 344370 , 344372 |
| CVE-2025-66744 | Yonyou YonBIP - Path Traversal | - | 7.5 (v3.1) | High | 340007 |
| CVE-2026-21875 | ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection | clipbucket | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2026-22244 | OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE | openmetadata | 8.5 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13801 | Yoco Payments <= 3.8.8 - Path Traversal | Yoco Payments | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13418 | Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting | Responsive Pricing Table | 6.4 (v3.1) | Medium | 346755 , 377360 |
| CVE-2025-13652 | WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection | CBX Bookmark & Favorite | 6.5 (v3.1) | Medium | 340016 , 377360 , 380122 |
| CVE-2025-14998 | Branda WordPress plugin - Privilege Escalation | Branda – White Label & Branding, Free Login Page Customizer | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-15098 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery | yudao-cloud | 2.1 (v4.0) | Low | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2019-25246 | BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure | N100 H.264 VGA IP Camera | 7.1 (v4.0) | High | 330925 , 344360 , 347009 , 390709 |
| CVE-2025-68613 | n8n - Remote Code Execution via Expression Injection | n8n | 8.8 (v3.1) | High | 340130 , 344361 , 344363 , 344364 , 345240 , 380026 |
| CVE-2025-14437 | WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File | hummingbird-performance | 7.5 (v3.1) | High | 390716 |
| CVE-2025-14528 | D-Link DIR-803 - Authentication Bypass | dir-803 firmware | 5.5 (v4.0) | Medium | 390722 |
| CVE-2025-13339 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read | Hippoo Mobile App for WooCommerce | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 347009 , 390709 |
| CVE-2025-66472 | XWiki DeleteApplication - Cross-Site Scripting | xwiki | 6.5 (v4.0) | Medium | 346755 |
| CVE-2025-66516 | Apache Tika - XML External Entity Injection | tika | 9.8 (v3.1) | Critical | 391213 |
| CVE-2025-55182 | React Server Components - Remote Code Execution | react | 10.0 (v3.1) | Critical | 331702 , 344370 , 345240 , 380026 , 393655 |
| CVE-2025-13486 | Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution | Advanced Custom Fields: Extended | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-13875 | Yohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversal | oci-helper | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-51683 | mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE | mjobtime | 9.8 (v3.1) | Critical | 340155 , 341155 , 341245 |
| CVE-2025-13810 | jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal | webstack-guns | 5.5 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13814 | moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery | mogublog | 5.5 (v4.0) | Medium | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-13809 | orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery | orion-ops | 2.1 (v4.0) | Low | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-13811 | jsnjfz WebStack-Guns PageFactory.java sql injection | webstack-guns | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13815 | moxi159753 Mogu Blog v2 pictures unrestricted upload | mogublog | 2.1 (v4.0) | Low | 351000 |
| CVE-2025-13816 | moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal | mogublog | 2.1 (v4.0) | Low | 340007 , 344360 , 390709 |
| CVE-2025-13786 | taosir WTCMS index.php fetch code injection | wtcms | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390768 , 393655 |
| CVE-2025-13792 | Qualitor getResumo.php eval code injection | the file /html/st/stdeslocamento/request/getResumo.php | 5.5 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13789 | ZenTao model.php makeRequest server-side request forgery | zentao | 2.1 (v4.0) | Low | 337109 , 337110 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-62593 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack | ray | 9.4 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-58360 | GeoServer - XML External Entity Injection | geoserver | 9.8 (v3.1) | Critical | 391213 |
| CVE-2024-14015 | Studiocart <= 2.9.0 - Cross-Site Scripting | WordPress eCommerce Plugin | 7.1 (v3.1) | High | 341266 |
| CVE-2025-13138 | WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection | WP Directory Kit | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2025-11368 | LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure | learnpress | 5.3 (v3.1) | Medium | 344365 |
| CVE-2021-4463 | Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download | BEMS API | 8.7 (v4.0) | High | 344360 , 347009 , 390709 |
| CVE-2023-7327 | Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read | Ozeki SMS Gateway | 8.7 (v4.0) | High | 390716 |
| CVE-2025-11307 | WP Google Maps < 9.0.48 - Cross-Site Scripting | wp-google-maps | 8.8 (v3.1) | High | 346755 |
| CVE-2025-62780 | ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API | changedetection | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2025-64328 | FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection | freepbx | 8.6 (v4.0) | High | 344364 |
| CVE-2025-11833 | Post SMTP <= 3.6.0 - Email Log Disclosure | post smtp mailer | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-10897 | WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read | WooCommerce Designer Pro | 8.6 (v3.1) | High | 344360 |
| CVE-2025-27222 | TRUfusion Enterprise <= 7.10.4.0 - Path Traversal | trufusion enterprise | 8.6 (v3.1) | High | 340007 , 344360 |
| CVE-2025-12055 | MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal | MIP 2 | 7.5 (v3.1) | High | 344365 |
| CVE-2025-53533 | Pi-hole Reflected XSS in 404-Error Page | web interface | 5.1 (v4.0) | Medium | 346755 , 347198 |
| CVE-2025-62613 | VDO.Ninja - DOM-Based Cross-Site Scripting | vdo.ninja | 6.9 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2023-7305 | SmartBI RMIServlet Unrestricted File Upload RCE | SmartBI | 9.2 (v4.0) | Critical | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-59287 | Windows Server Update Service - Insecure Deserialization | Windows Server update service | 9.8 (v3.1) | Critical | 392647 |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | 7.5 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-11371 | Gladinet CentreStack & TrioFox - Local File Inclusion | centrestack | 7.5 (v3.1) | High | 340007 , 344360 , 344365 , 347019 |
| CVE-2025-10162 | WordPress OrderConvo < 14 - Path Traversal | Admin and Customer Messages After Order for WooCommerce: OrderConvo | 7.5 (v3.1) | High | 336461 , 344360 |
| CVE-2025-52472 | XWiki - HQL Injection | xwiki | 9.3 (v4.0) | Critical | 340087 , 340095 , 340156 , 340157 , 340159 , 360147 , 360148 |
| CVE-2025-61224 | DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting | dokuwiki | 6.5 (v3.1) | Medium | 333141 , 344370 |
| CVE-2025-61882 | Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution | concurrent processing | 9.8 (v3.1) | Critical | 391213 |
| CVE-2025-61666 | Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion | traccar | 8.7 (v4.0) | High | 344365 , 347019 |
| CVE-2025-9985 | Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File | Featured Image from URL (FIFU) | 5.3 (v3.1) | Medium | 390716 |
| CVE-2025-56819 | Datart v1.0.0-rc.3 - Remote Code Execution | datart | 9.8 (v3.1) | Critical | 337209 , 337211 , 340095 |
| CVE-2025-59528 | Flowise - Remote Code Execution | flowise | 10.0 (v3.1) | Critical | 345240 , 380026 |
| CVE-2025-48703 | CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution | webpanel | 9.0 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-55911 | ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF) | clipbucket | 6.5 (v3.1) | Medium | 340162 , 344370 , 398001 |
| CVE-2025-10493 | Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie | Chained Quiz | 5.3 (v3.1) | Medium | 390726 , 392647 |
| CVE-2025-59341 | esm.sh <= v136 - Local File Inclusion | esm.sh | 7.7 (v4.0) | High | 347009 |
| CVE-2025-59342 | esm.sh <= v136 - Arbitrary File Write via Path Traversal | esm.sh | 5.5 (v4.0) | Medium | 340162 , 340163 |
| CVE-2025-10592 | itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection | online public access catalog | 2.1 (v4.0) | Low | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-57631 | tduck Arbitrary Code Execution Vulnerability | tduck | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-54123 | Hoverfly <= 1.11.3 - Remote Code Execution | hoverfly | 9.8 (v3.1) | Critical | 344360 |
| CVE-2025-59049 | Mockoon < 9.2.0 - Path Traversal | mockoon | 7.5 (v3.1) | High | 347009 |
| CVE-2025-10210 | ChanCMS <= 3.3.0 - SQL Injection | chancms | 2.1 (v4.0) | Low | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-54249 | Adobe Experience Manager ≤ 6.5.23.0 – SSRF | experience manager | 6.5 (v3.1) | Medium | 390726 , 392647 |
| CVE-2025-10090 | Jinher OA - SQL Injection | jinher oa | 5.5 (v4.0) | Medium | 344366 , 361149 |
| CVE-2025-55748 | XWiki Platform - Path Traversal | xwiki | 9.3 (v4.0) | Critical | 340007 |
| CVE-2025-9744 | Loan Management System 1.0 - SQL Injection | online loan management system | 5.5 (v4.0) | Medium | 340156 , 341145 |
| CVE-2025-57819 | FreePBX - Remote Code Execution | freepbx | 10.0 (v4.0) | Critical | 340157 , 341245 , 344365 , 344370 , 360147 , 360148 |
| CVE-2025-34163 | Dongsheng Logistics Software Unauthenticated Arbitrary File Upload | Dongsheng Logistics Software | 10.0 (v4.0) | Critical | 351000 |
| CVE-2025-55526 | n8n workflow collection Path Traversal Vulnerability | n8n workflow collection | 9.1 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2025-55523 | Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download | agent-zero | 3.5 (v3.1) | Low | 344360 , 347009 , 390709 |
| CVE-2025-54726 | WordPress JS Archive List <= 6.1.5 - SQL Injection | JS Archive List | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2025-54988 | Apache Tika - XXE Injection | tika | 8.4 (v3.1) | High | 391213 |
| CVE-2025-48157 | WordPress Formality Plugin <= 1.5.9 - Local File Inclusion | Formality | 8.1 (v3.1) | High | 344360 , 347009 , 382238 , 390709 |
| CVE-2025-51990 | XWiki – Stored Cross-Site Scripting (XSS) | xwiki | 4.8 (v3.1) | Medium | 342259 |
| CVE-2025-41242 | Spring Framework - Path Traversal | Spring Framework | 5.9 (v3.1) | Medium | 347009 |
| CVE-2025-55169 | WeGIA - Directory Traversal | wegia | 10.0 (v4.0) | Critical | 340007 , 344360 |
| CVE-2025-52970 | Fortinet FortiWeb - Authentication Bypass to Admin Privilege | fortiweb | 8.1 (v3.1) | High | 340157 , 360147 , 360148 |
| CVE-2025-25231 | Omnissa Workspace ONE UEM - Path Traversal | workspace one uem console | 7.5 (v3.1) | High | 340007 |
| CVE-2025-4576 | Liferay Portal & DXP - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34152 | Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via time Parameter | M300 Wi-Fi Repeater | 9.4 (v4.0) | Critical | 344364 , 393655 |
| CVE-2025-32430 | XWiki Platform - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2025-2611 | ICTBroadcast - Command Injection | ICTBroadcast | 9.3 (v4.0) | Critical | 344361 , 393655 |
| CVE-2025-6204 | DELMIA Apriso - Command Injection | delmia apriso | 8.0 (v3.1) | High | 340095 , 341245 , 344361 , 344365 , 344366 , 347019 , 390724 |
| CVE-2025-54782 | NestJS DevTools Integration - Remote Code Execution | devtools-integration | 9.4 (v4.0) | Critical | 345240 |
| CVE-2025-51501 | Microweber CMS2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-51502 | Microweber CMS 2.0 - Reflected XSS in Admin Page Creation | microweber | 6.1 (v3.1) | Medium | 333140 , 341266 |
| CVE-2025-54589 | Copyparty <=1.18.6 - Cross-Site Scripting | copyparty | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-44136 | MapTiler Tileserver-php v2.0 - Unauthenticated XSS | tileserver php | 9.8 (v3.1) | Critical | 341256 , 342259 , 346755 , 350148 |
| CVE-2025-44137 | MapTiler Tileserver-php v2.0 - Unauthenticated File Read | tileserver php | 8.2 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-8266 | ChanCMS <= 3.1. - Remote Code Execution | chancms | 2.1 (v4.0) | Low | 345240 , 380026 |
| CVE-2025-54597 | Heimdall Application Dashboard < 2.7.3 - Reflected XSS | heimdall | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 , 350147 , 350148 |
| CVE-2018-25114 | osCommerce 2.3.4.1 - Remote Code Execution | Online Merchant | 9.3 (v4.0) | Critical | 340023 , 340095 , 344360 , 344370 |
| CVE-2025-6174 | WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected) | Qwizcards | online quizzes and flashcards | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2025-34141 | ETQ Reliance - Reflected XSS via SQLConverterServlet | reliance | 5.1 (v4.0) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 |
| CVE-2025-53770 | Microsoft SharePoint Server - Remote Code Execution (ToolShell) | sharepoint server | 9.8 (v3.1) | Critical | 330906 , 350147 |
| CVE-2025-53771 | Microsoft SharePoint Server - Authentication Bypass (ToolShell) | sharepoint server | 6.5 (v3.1) | Medium | 330906 , 350147 |
| CVE-2015-10138 | Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload | work the flow file upload | 9.8 (v3.1) | Critical | 351000 |
| CVE-2016-15043 | WP Mobile Detector <= 3.5 - Unrestricted File Upload | wp mobile detector | 9.8 (v3.1) | Critical | 340162 , 340163 , 391740 |
| CVE-2025-25257 | Fortinet FortiWeb - SQL Injection | fortiweb | 9.8 (v3.1) | Critical | 340156 |
| CVE-2025-34115 | OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php | OP5 Monitor | 8.7 (v4.0) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-53833 | LaRecipe < 2.8.1 Remote Code Execution via SSTI | larecipe | 10.0 (v3.1) | Critical | 340087 |
| CVE-2024-26291 | Avid NEXIS Agent - Arbitrary File Read | nexis | 8.7 (v4.0) | High | 344360 , 344365 , 347009 , 390709 |
| CVE-2025-6058 | WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload | wpbookit | 9.8 (v3.1) | Critical | 382238 |
| CVE-2025-47812 | Wing FTP Server <= 7.4.3 - Remote Code Execution | wftpserver | 10.0 (v3.1) | Critical | 344362 , 344363 , 380026 , 390614 |
| CVE-2025-34085 | WordPress Simple File List <=4.2.2 - Remote Code Execution | - | 9.8 | Critical | 382238 |
| CVE-2025-44177 | White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI) | protop | 8.2 (v3.1) | High | 347009 , 390727 , 392648 |
| CVE-2025-6970 | WordPress Events Manager <= 7.0.3 - SQL Injection | events manager | 7.5 (v3.1) | High | 380122 |
| CVE-2025-7160 | Zoo Management System 1.0 - SQL Injection | zoo management system | 5.5 (v4.0) | Medium | 340145 , 340156 |
| CVE-2025-5961 | WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload | migration, backup, staging | 7.2 (v3.1) | High | 377360 |
| CVE-2025-34073 | Maltrail <=0.54 Username Parameter - Remote Command Execution | Maltrail | 10.0 (v4.0) | Critical | 340014 , 344363 , 344370 |
| CVE-2025-49029 | WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution | Custom Login And Signup Widget | 9.1 (v3.1) | Critical | 377360 |
| CVE-2025-49493 | Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE) | CloudTest | 5.8 (v3.1) | Medium | 344372 |
| CVE-2025-34045 | WeiPHP 5.0 - Path Traversal | weiphp | 8.7 (v4.0) | High | 340007 , 344360 |
| CVE-2025-20281 | Cisco ISE - Remote Code Execution | identity services engine | 10.0 (v3.1) | Critical | 392301 |
| CVE-2024-51978 | Brother Printers – Authentication Bypass via Default Admin Password | DCP-J928N-W/B | 9.8 (v3.1) | Critical | 390709 |
| CVE-2025-48954 | Discourse OAuth Social Login - Cross-site Scripting | discourse | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 344362 , 346755 , 347198 , 350148 , 390712 |
| CVE-2024-51977 | Brother MFC-L9570CDW - Information Disclosure | HL-L8260CDN | 5.3 (v3.1) | Medium | 390709 |
| CVE-2025-34035 | EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution | esr300 firmware | 10.0 (v4.0) | Critical | 341245 |
| CVE-2025-34037 | Linksys Routers E/WAG/WAP/WES/WET/WRT-Series | E4200 | 10.0 (v4.0) | Critical | 312658 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-34040 | Zhiyuan OA - arbitrary file upload leading | Zhiyuan OA Web Application System | 10.0 (v4.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2021-41691 | openSIS Student Information System 8.0 SQL Injection | opensis | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-34031 | Moodle Jmol Filter 6.1 - Local File Inclusion | jmol | 8.7 (v4.0) | High | 340165 , 344360 , 347009 |
| CVE-2025-34032 | Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting | jmol | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-6403 | Code-Projects School Fees Payment System 1.0 - SQL Injection | school fees payment system | 5.5 (v4.0) | Medium | 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2025-34030 | sar2html <=3.2.2 Plot Parameter - Remote Code Execution | sar2html | 10.0 (v4.0) | Critical | 340014 , 340193 , 344364 , 344366 |
| CVE-2025-49132 | Pterodactyl Panel - Remote Code Execution | panel | 10.0 (v3.1) | Critical | 340007 |
| CVE-2025-25034 | SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection | SugarCRM | 9.3 (v4.0) | Critical | 344370 |
| CVE-2025-34023 | Karel IP Phone IP1211 Web Management Panel - Local File Inclusion | Karel IP Phone IP1211 | 8.5 (v4.0) | High | 330925 , 340007 , 344360 , 347009 , 390709 |
| CVE-2025-1562 | Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control | funnelkit automations | 9.8 (v3.1) | Critical | 377360 |
| CVE-2025-45985 | Blink Router - Command Injection | bl-wr9000 firmware | 9.8 (v3.1) | Critical | 344363 |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting | Docs (DocumentServer) | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-27817 | Apache Kafka Client - Arbitrary File Read | kafka | 7.5 (v3.1) | High | 344360 |
| CVE-2025-48281 | MyStyle Custom Product Designer <= 3.21.1 - SQL Injection | MyStyle Custom Product Designer | 9.3 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2025-4652 | Broadstreet WordPress plugin - Reflected XSS | broadstreet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 377360 |
| CVE-2025-5569 | IdeaCMS <= 1.7 - SQL Injection | ideacms | 5.3 (v4.0) | Medium | 341245 |
| CVE-2025-45854 | JEHC-BPM - Remote Code Execute | jehc-bpm | 10.0 (v3.1) | Critical | 344363 , 390724 |
| CVE-2025-44148 | MailEnable Mail Service < v10 - Cross-Site Scripting | mailenable | 9.8 (v3.1) | Critical | 344363 , 346755 |
| CVE-2025-49002 | DataEase - Remote Code Execution | dataease | 8.2 (v4.0) | High | 340195 |
| CVE-2025-5086 | Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization | delmia apriso | 9.0 (v3.1) | Critical | 331702 , 344380 |
| CVE-2025-5287 | Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection | Likes and Dislikes Plugin | 7.5 (v3.1) | High | 380122 |
| CVE-2025-5298 | Campcodes Online Hospital Management System 1.0 - SQL Injection | online hospital management system | 6.9 (v4.0) | Medium | 390726 , 392647 |
| CVE-2025-48828 | vBulletin replaceAdTemplate - Remote Code Execution | vbulletin | 8.1 (v3.1) | High | 344370 |
| CVE-2025-32814 | NetMRI Unauthenticated SQL Injection via skipjackUsername | netmri | 9.8 (v3.1) | Critical | 340016 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 |
| CVE-2025-32813 | Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request | netmri | 7.2 (v3.1) | High | 393655 |
| CVE-2025-32815 | NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials | netmri | 6.5 (v3.1) | Medium | 344360 , 390709 , 390722 |
| CVE-2025-4524 | WordPress Madara - Local File Inclusion | Madara – Responsive and modern WordPress theme for manga sites | 9.8 (v3.1) | Critical | 340748 , 344360 , 390709 |
| CVE-2025-4008 | MeteoBridge <= 6.1 - Remote Code Execution | meteobridge vm | 8.7 (v4.0) | High | 393655 |
| CVE-2025-46822 | Java-springboot-codebase 1.1 - Arbitrary File Read | Java-springboot-codebase | 7.7 (v4.0) | High | 347009 |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium | 340003 , 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2025-47577 | TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload | ti-woocommerce-wishlist | 10.0 (v3.1) | Critical | 382238 |
| CVE-2024-6159 | Push Notification for Post and BuddyPress <= 1.93 - SQL Injection | push notification for post and buddypress | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-8673 | Z-Downloads < 1.11.7 - Cross-Site Scripting | z-downloads | 9.1 (v3.1) | Critical | 377360 |
| CVE-2024-9765 | EKC Tournament Manager WordPress plugin - Path Traversal | ekc tournament manager | 6.5 (v3.1) | Medium | 344360 , 347009 , 377360 |
| CVE-2024-12724 | WP DeskLite - Reflected XSS | wp desklite | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2024-12732 | AffiliateImporterEb <= 1.0.6 - Reflected XSS | affiliateimportereb | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-12734 | Advance Post Prefix WordPress plugin - Reflected XSS | advance post prefix | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-12873 | Custom Field Manager WordPress - Cross-Site Scripting | custom field manager | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13619 | LifterLMS < 8.0.1 - Cross-Site Scripting | lifterlms | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13727 | MemberSpace WordPress - Cross-Site Scripting | memberspace | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-1303 | Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting | plugin oficial | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2023-6030 | LogDash Activity Log <= 1.1.3 - SQL Injection | logdash activity log | 5.4 (v3.1) | Medium | 340016 , 341245 , 380026 , 380122 |
| CVE-2025-47445 | WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download | eventin | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2025-47783 | Label Studio < 1.18.0 - Reflected XSS | label studio | 7.6 (v4.0) | High | 340147 , 340148 , 342259 , 344370 , 346755 |
| CVE-2025-0133 | PAN-OS - Reflected Cross-Site Scripting | PAN-OS | 2.7 (v4.0) | Low | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2024-46506 | NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution | netalertx | 10.0 (v3.1) | Critical | 392301 , 392648 |
| CVE-2024-48766 | NetAlert X - Arbitary File Read | netalertx | 8.6 (v3.1) | High | 340007 , 340029 , 344360 |
| CVE-2025-4396 | Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection | Relevanssi Premium | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution | endpoint manager mobile | 7.5 (v3.1) | High | 337210 , 340087 , 340095 , 380026 , 393655 |
| CVE-2025-47204 | Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting | bootstrap multiselect | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-41393 | Ricoh Web Image Monitor - Reflected XSS | Multiple laser printers and MFPs which implement Web Image Monitor | 5.1 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-2776 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical | 330791 , 340152 , 344372 |
| CVE-2025-2777 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 9.8 (v3.1) | Critical | 330791 , 340152 , 344372 |
| CVE-2025-2775 | SysAid On-Prem <= 23.3.40 - XML External Entity | sysaid | 7.5 (v3.1) | High | 330791 , 340152 , 344372 |
| CVE-2025-47423 | Personal Weather Station Dashboard 12 - Directory Traversal | Personal Weather Station Dashboard | 5.8 (v3.1) | Medium | 340007 |
| CVE-2025-2011 | Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection | Depicter — Popup & Slider Builder | 7.5 (v3.1) | High | 340016 , 340017 , 360147 , 360148 |
| CVE-2025-4388 | Liferay Portal - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2024-13322 | Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection | ads pro | 7.5 (v3.1) | High | 380122 |
| CVE-2025-46565 | Vite Dev Server - Information Exposure | vite | 6.0 (v4.0) | Medium | 390709 |
| CVE-2025-32970 | XWiki WYSIWYG API - Open Redirect | xwiki | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2025-46349 | YesWiki Reflected XSS via File Upload | yeswiki | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-46549 | YesWiki <= 4.5.1 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2025-46550 | YesWiki < 4.5.4 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-4078 | Wangshen SecGate 3600 Path Traversal Vulnerability | SecGate 3600 | 5.3 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-32432 | CraftCMS - Remote Code Execution | craftcms | 10.0 (v3.1) | Critical | 344365 |
| CVE-2025-31324 | SAP NetWeaver Visual Composer Metadata Uploader - Deserialization | netweaver | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2025-2558 | WordPress The Wound Theme <= 0.0.1 - Local File Inclusion | the wound | 8.6 (v3.1) | High | 336461 , 340007 , 344360 , 347009 , 381206 , 390709 |
| CVE-2025-32969 | XWiki REST API Query - SQL Injection | xwiki | 9.3 (v4.0) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-13569 | WordPress Front End Users - Reflected XSS | front end users | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2025-28367 | mojoPortal <=2.9.0.1 - Directory Traversal | mojoportal | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2025-32778 | Web-Check < 2.0.1 Screenshot API - OS Command Injection | web-check | 9.3 (v4.0) | Critical | 344363 , 393655 |
| CVE-2025-2563 | User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation | user registration & membership | 8.1 (v3.1) | High | 300020 |
| CVE-2025-32614 | EventON Lite <= 2.4 - Authenticated Local File Inclusion | flavor | 8.8 (v3.1) | High | 344360 , 377360 , 390709 |
| CVE-2025-2636 | InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion | InstaWP Connect – 1-click WP Staging & Migration | 8.1 (v3.1) | High | 340007 |
| CVE-2025-3248 | Langflow AI - Unauthenticated Remote Code Execution | langflow | 9.8 (v3.1) | Critical | 340095 , 344360 , 344370 |
| CVE-2025-2075 | Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation | uncanny automator | 8.8 (v3.1) | High | 377360 |
| CVE-2025-32257 | 1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure | 1-click-migration | 5.3 (v3.1) | Medium | 390716 |
| CVE-2025-31486 | Vite server.fs.deny Bypass - Local File Inclusion | vite | 5.3 (v3.1) | Medium | 347009 , 390709 |
| CVE-2025-29085 | Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component | vipshop Saturn v.3.5.1 and before | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2025-31131 | Yeswiki < 4.5.2 - Unauthenticated Path Traversal | yeswiki | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-31125 | Vite Development Server - Path Traversal | vite | 7.5 (v3.1) | High | 347009 , 390709 , 390716 |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Local File Inclusion | Kubio AI Page Builder | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2025-29306 | FoxCMS v.1.2.5 - Remote Code Execution | foxcms | 9.8 (v3.1) | Critical | 344360 , 344370 , 347009 , 393655 |
| CVE-2025-30567 | WordPress WP01 - Path Traversal | WP01 | 7.5 (v3.1) | High | 390709 |
| CVE-2025-29635 | D-Link DIR-823X set_prohibiting - Command Injection | dir-823x firmware | 7.2 (v3.1) | High | 340014 , 344364 , 344366 |
| CVE-2025-30208 | Vite - Arbitrary File Read | vite | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2025-2709 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-2710 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-2711 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-2712 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2025-2609 | MagnusBilling Login Logs - Cross-Site Scripting | magnusbilling | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2025-2610 | MagnusBilling Alarm Module - Cross-Site Scripting | magnusbilling | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2025-2505 | WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion | Age Gate | 9.8 (v3.1) | Critical | 340007 |
| CVE-2024-9362 | Polyaxon - Unauthenticated Directory Traversal | polyaxon/polyaxon | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-2539 | File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read | file away | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 390709 |
| CVE-2024-7631 | Openshift-console: openshift console: path traversal | Red Hat OpenShift Container Platform 3.11 | 4.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-24799 | GLPI < 10.0.17 - Pre-Auth SQL Injection | glpi | 9.8 (v3.1) | Critical | 340156 , 341245 , 380026 , 380122 |
| CVE-2025-2473 | Company Visitor Management System 1.0 - SQL Injection | company visitor management system | 6.9 (v4.0) | Medium | 340145 , 340156 , 341145 |
| CVE-2025-2221 | WordPress WPCOM Member <= 1.7.6 - SQL Injection | wpcom member | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2025-1661 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion | husky - products filter professional for woocommerce | 9.8 (v3.1) | Critical | 340748 |
| CVE-2024-13853 | WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting | seo-automatic-seo-tools | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-28906 | Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting | Skitter Slideshow | 5.9 (v3.1) | Medium | 346755 , 377360 |
| CVE-2025-24813 | Apache Tomcat Path Equivalence - Remote Code Execution | tomcat | 9.8 (v3.1) | Critical | 392301 |
| CVE-2025-2127 | JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS | jux real estate | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-27506 | NocoDB < 0.258.0 - Reflected XSS in Password Reset | nocodb | 6.1 (v3.1) | Medium | 341266 , 347198 |
| CVE-2025-26319 | FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload | flowise | 9.8 (v3.1) | Critical | 346019 |
| CVE-2024-48248 | NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read | backup & replication director | 8.6 (v3.1) | High | 344360 , 390726 , 392647 |
| CVE-2024-8425 | WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload | woocommerce ultimate gift card | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-9193 | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update | whmcs | 9.8 (v3.1) | Critical | 340087 , 340748 , 344370 , 347006 , 390720 |
| CVE-2025-1743 | Pichome 2.1.0 - Arbitrary File Read | Pichome | 6.9 (v4.0) | Medium | 340162 , 340165 , 344360 , 347009 |
| CVE-2024-10152 | Simple Certain Time to Show Content - Cross-Site Scripting | simple certain time to show content | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-12878 | Lazy Blocks <= 3.8.2 - Cross-Site Scripting | lazy blocks | 7.1 (v3.1) | High | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13624 | WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting | wpmovielibrary | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2024-12737 | WP BASE Booking - Reflected XSS | wp base booking of appointments, services and events | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13628 | WP Pricing Table - Reflected XSS | wp pricing table | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13630 | NewsTicker <= 1.0 - Reflected Cross-Site Scripting | newsticker | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13634 | Post Sync Plugin <= 1.1 - Cross-Site Scripting | post sync | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2025-24893 | XWiki Platform - Remote Code Execution | xwiki | 9.8 (v3.1) | Critical | 340023 , 347009 |
| CVE-2024-55457 | MasterSAM Star Gate v11 - Local File Inclusion | - | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-1023 | ChurchCRM - SQL Injection | churchcrm | 9.3 (v4.0) | Critical | 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2024-13609 | WordPress 1 Click Migration Plugin < 2.3 - Information Exposure | 1 click migration | 5.9 (v3.1) | Medium | 350590 , 390716 |
| CVE-2025-1035 | KLog Server - Path Traversal | KLog Server | 5.7 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-13726 | Themes Coder Ecommerce <= 1.3.4 - SQL Injection | tc-ecommerce | 8.6 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2024-13625 | Tube Video Ads Lite - Reflected XSS | tube video ads lite | 7.1 (v3.1) | High | 341266 |
| CVE-2024-13627 | OWL Carousel Slider - Cross-Site Scripting | owl carousel slider | 4.7 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2025-1302 | JSONPath Plus < 10.3.0 - Remote Code Execution | jsonpath-plus | 8.9 (v4.0) | High | 345240 , 346755 , 360151 , 380026 |
| CVE-2025-25296 | Label Studio < 1.16.0 - Cross-Site Scripting | label studio | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344370 , 346755 , 347198 |
| CVE-2024-10763 | WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion | campress | 9.8 (v3.1) | Critical | 340077 |
| CVE-2024-13543 | Zarinpal Paid Download - Reflected XSS | zarinpal paid download | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13570 | WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting | stray random quotes | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13352 | Legull WordPress - Cross-Site Scripting | legull | 7.1 (v3.1) | High | 341266 , 346755 |
| CVE-2024-13492 | Guten Free Options - Cross Site Scripting | guten free options | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-53586 | WebFileSys 2.31.0 - Directory Path Traversal | - | 5.3 (v3.1) | Medium | 340007 , 390726 , 392647 |
| CVE-2025-24963 | Vitest Browser Mode - Local File Read | vitest | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2024-13330 | JustRows WordPress - Cross-Site Scripting | justrows free | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-13114 | WP Projects Portfolio <= 3.0 - Cross-Site Scripting | wp projects portfolio with client testimonials | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2024-13325 | Glossy WordPress - Reflected XSS | glossy | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-13326 | iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting | ibuildapp | 6.1 (v3.1) | Medium | 341266 , 377360 |
| CVE-2024-13327 | Musicbox WordPress - Reflected XSS | musicbox | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13328 | Giga Messenger WordPress - Cross-Site Scripting | giga messenger | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-13331 | WP Dream Carousel < 1.0.1b - Cross-Site Scripting | wp dream carousel | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2023-52163 | Digiever DS-2105 Pro - Command Injection | ds-2105 pro firmware | 8.8 (v3.1) | High | 390709 |
| CVE-2024-13097 | WP Finance Plugin <= 1.3.6 - Cross-Site Scripting | wp finance | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13098 | WordPress Email Newsletter - Reflected XSS | wordpress email newsletter | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13099 | Widget4Call WordPress - Cross-Site Scripting | widget4call | 5.4 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-53584 | OpenPanel 0.3.4 - OS Command Injection | openpanel | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 |
| CVE-2024-53537 | OpenPanel 0.3.4 - Directory Traversal | openpanel | 9.1 (v3.1) | Critical | 340007 |
| CVE-2024-52875 | Kerio Control v9.2.5 - CRLF Injection | kerio control | 8.8 (v3.1) | High | 390716 |
| CVE-2024-13112 | WP MediaTagger <= 4.1.1 - Cross-Site Scripting | wp mediatagger | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13219 | Privacy Policy Genius - Cross-Site Scripting | privacy policy genius | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13220 | WordPress Google Map Professional - Cross-Site Scripting | google map professional | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13221 | Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting | fantastic elasticsearch | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13222 | WordPress User Messages <= 1.2.4 - Reflected XSS | user messages | 6.1 (v3.1) | Medium | 341266 , 346755 , 390585 |
| CVE-2024-13224 | SlideDeck 1 Lite Content Slider - Cross-Site Scripting | slidedeck 1 lite content slider | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13225 | ECT Home Page Products - Reflected XSS | ect home page products | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-13226 | A5 Custom Login Page - Reflected XSS | a5 custom login page | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-12638 | Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting | bulk me now! | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2024-12749 | WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting | competition form | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2025-23211 | Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE | recipes | 9.9 (v3.1) | Critical | 330791 , 340152 |
| CVE-2024-13055 | Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting | dyn business panel | 7.1 (v3.1) | High | 341266 , 377360 |
| CVE-2024-13094 | WP Triggers Lite - Cross-Site Scripting | wp triggers lite | 7.1 (v3.1) | High | 341266 , 346755 , 377360 |
| CVE-2025-22785 | Course Booking System <= 6.0.6 - SQL Injection | Course Booking System | 9.3 (v3.1) | Critical | 340016 , 380122 |
| CVE-2024-12008 | W3 Total Cache < 2.8.2 - Log File Exposure | w3 total cache | 7.5 (v3.1) | High | 390716 |
| CVE-2024-50857 | GestioIP - Reflected Cross-Site Scripting | gestioip | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2024-50603 | Aviatrix Controller - Remote Code Execution | controller | 9.8 (v3.1) | Critical | 340029 , 344360 , 344363 , 344370 , 393655 |
| CVE-2024-12585 | PropertyHive < 2.1.1 - Cross-Site Scripting | propertyhive | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-12849 | Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read | error-log-viewer-wp | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-55218 | IceWarp Server 10.2.1 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2025-22214 | Landray EIS SQL注入漏洞 | - | 4.3 (v3.1) | Medium | 340155 , 341155 , 341245 |
| CVE-2024-56064 | WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE | indeed-wp-superbackup | 10.0 (v3.1) | Critical | 382238 |
| CVE-2024-12987 | DrayTek Vigor - Command Injection | Vigor300B | 6.9 (v4.0) | Medium | 347009 , 393655 |
| CVE-2024-11921 | Give WP Plugin < 3.19.0 - Cross-Site Scripting | givewp | 4.8 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-38819 | Spring Framework Path Traversal in Functional Web Frameworks | spring framework | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2024-11740 | Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution | download manager | 7.3 (v3.1) | High | 344370 |
| CVE-2023-34990 | FortiWLM - Directory Traversal | fortiwlm | 9.8 (v3.1) | Critical | 340007 |
| CVE-2024-12025 | WordPress Collapsing Categories <= 3.0.8 - SQL Injection | Collapsing Categories | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-55956 | Cleo Harmony < 5.8.0.24 - File Upload Vulnerability | harmony | 9.8 (v3.1) | Critical | 391213 |
| CVE-2024-55890 | D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection | dtale | 6.9 (v4.0) | Medium | 344370 |
| CVE-2024-10708 | System Dashboard < 2.8.15 - Admin+ Path Traversal | system dashboard | 4.9 (v3.1) | Medium | 336461 , 344360 , 377360 , 381206 |
| CVE-2024-55550 | Mitel MiCollab - Arbitary File Read | cmg suite | 2.7 (v3.1) | Low | 340007 , 341256 , 344360 , 350147 , 390709 |
| CVE-2024-12209 | WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion | wp-umbrella | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2024-11728 | KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection | kivicare | 7.5 (v3.1) | High | 340016 , 340017 , 340156 , 380122 |
| CVE-2024-53900 | Mongoose < 8.8.3 - Remote Code Execution | mongoose | 9.1 (v3.1) | Critical | 340087 , 340095 , 345240 |
| CVE-2023-7299 | DataGear resolveSql sql injection | datagear | 5.3 (v4.0) | Medium | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2024-11320 | Pandora v7.0NG.777.3 - Remote Code Execution | pandora fms | 6.9 (v4.0) | Medium | 344363 |
| CVE-2024-11587 | idcCMS V1.60 - Cross-Site Scripting | idccms | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2024-52762 | Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-52763 | Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 |
| CVE-2024-11303 | Korenix JetPort 5601v3 - Path Traversal | JetPort 5601 | 8.7 (v4.0) | High | 347009 |
| CVE-2020-26073 | Cisco SD-WAN vManage Software - Local File Inclusion | catalyst sd-wan manager | 7.5 (v3.1) | High | 347009 |
| CVE-2024-9474 | PAN-OS Management Web Interface - Command Injection | pan-os | 6.9 (v4.0) | Medium | 344363 |
| CVE-2024-11305 | Altenergy Power Control Software - SQL Injection | energy communication unit firmware | 5.3 (v4.0) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-9935 | PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download | pdf-generator-addon-for-elementor-page-builder | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-10571 | Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion | chartify | 9.8 (v3.1) | Critical | 340748 , 347006 |
| CVE-2024-9186 | Automation By Autonami < 3.3.0 - SQL Injection | wp-marketing-automations | 8.6 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-5082 | Nexus Repository 2 - Remote Code Execution | Nexus Repository | 7.1 (v4.0) | High | 330791 , 340152 |
| CVE-2024-10146 | Simple File List < 6.1.13 - Reflected Cross-Site Scripting | simple file list | 5.4 (v3.1) | Medium | 340087 , 341266 , 346755 , 377360 |
| CVE-2024-51211 | openSIS Classic v9.1 - SQL Injection | opensis | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2024-43425 | Moodle - Remote Code Execution | moodle | 8.1 (v3.1) | High | 340095 , 360152 |
| CVE-2024-10081 | CodeChecker <= 6.24.1 - Authentication Bypass | codechecker | 10.0 (v3.1) | Critical | 392301 |
| CVE-2024-10914 | D-Link NAS - Command Injection via Name Parameter | dns-320 firmware | 9.2 (v4.0) | Critical | 344363 |
| CVE-2024-10915 | D-Link NAS - Command Injection via Group Parameter | dns-320 firmware | 9.2 (v4.0) | Critical | 344363 |
| CVE-2024-10758 | NEWS-BUZZ News Management System 1.0 - SQL Injection | news-buzz | 6.9 (v4.0) | Medium | 341245 , 344363 , 345493 , 380026 , 380122 |
| CVE-2024-51483 | Changedetection.io <= 0.47.4 - Path Traversal | changedetection | 6.9 (v4.0) | Medium | 340130 |
| CVE-2024-51482 | ZoneMinder v1.37.* <= 1.37.64 - SQL Injection | zoneminder | 9.9 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-48307 | JeecgBoot v3.7.1 - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2024-50334 | Scoold < 1.64.0 - Authentication Bypass | scoold | 8.7 (v4.0) | High | 391213 |
| CVE-2024-50498 | WP Query Console <= 1.0 - Remote Code Execution | wp query console | 9.8 (v3.1) | Critical | 340095 |
| CVE-2024-50623 | Cleo Harmony < 5.8.0.21 - Arbitary File Read | harmony | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-6049 | Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal | vsm LTC Time Sync (vTimeSync) | 7.5 (v3.1) | High | 390716 |
| CVE-2024-8852 | All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure | all-in-one wp migration | 5.3 (v3.1) | Medium | 390716 |
| CVE-2024-8625 | WordPress TS Poll < 2.4.0 - SQL Injection | ts poll | 7.2 (v3.1) | High | 380122 |
| CVE-2024-44000 | LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure | litespeed cache | 9.8 (v3.1) | Critical | 390716 |
| CVE-2024-9264 | Grafana Post-Auth DuckDB - SQL Injection To File Read | grafana | 9.4 (v4.0) | Critical | 340016 , 344360 , 344370 |
| CVE-2016-15042 | WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload | frontend file manager | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-4449 | ZoomSounds Plugin - Unauthenticated Arbitrary File Upload | zoomsounds | 9.8 (v3.1) | Critical | 392301 |
| CVE-2012-10018 | WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload | mapplic | 8.3 (v3.1) | High | 346755 , 377360 |
| CVE-2020-36836 | WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion | wp fastest cache | 8.0 (v3.1) | High | 340748 , 347006 , 377360 |
| CVE-2019-25213 | WordPress Advanced Access Manager - Path Traversal | advanced access manager | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2016-15041 | MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting | mainwp dashboard | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 |
| CVE-2022-4971 | Sassy Social Share <= 3.3.3 - Cross-Site Scripting | sassy social share | 6.1 (v3.1) | Medium | 340099 , 341099 , 341258 , 346755 , 347198 |
| CVE-2024-35584 | openSIS < 9.1 - SQL Injection | opensis | 8.8 (v3.1) | High | 340156 , 380122 |
| CVE-2024-48259 | Cloudlog - SQL Injection | cloudlog | 7.3 (v3.1) | High | 331028 , 340016 , 340157 , 341245 , 360147 , 360148 , 380026 |
| CVE-2024-48120 | X2CRM 8.5 - Stored Cross-Site Scripting (XSS) | x2crm | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390726 , 392647 |
| CVE-2024-9047 | WordPress File Upload <= 4.24.11 - Arbitrary File Read | wordpress file upload | 9.8 (v3.1) | Critical | 344360 |
| CVE-2024-9234 | GutenKit <= 2.1.0 - Arbitrary File Upload | gutenkit | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2024-9463 | PaloAlto Networks Expedition - Remote Code Execution | expedition | 9.9 (v4.0) | Critical | 344363 |
| CVE-2024-9465 | Palo Alto Expedition - SQL Injection | expedition | 9.2 (v4.0) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-8911 | LatePoint <= 5.0.11 - SQL Injection | latepoint | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-45293 | TablePress < 2.4.3 - XXE Injection | tablepress | 7.5 (v3.1) | High | 377360 |
| CVE-2024-47374 | LiteSpeed Cache <= 6.5.0.2 - Stored XSS | litespeed cache | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-9054 | Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection | timeprovider 4100 firmware | 8.5 (v4.0) | High | 392301 |
| CVE-2024-43687 | Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS) | timeprovider 4100 firmware | 7.7 (v4.0) | High | 392301 |
| CVE-2024-7801 | Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection | timeprovider 4100 firmware | 6.3 (v4.0) | Medium | 392301 |
| CVE-2024-8353 | GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection | givewp | 9.8 (v3.1) | Critical | 340014 , 344370 |
| CVE-2024-9166 | TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution | Atemio AM 520 HD Full HD Satellite Receiver | 9.3 (v4.0) | Critical | 340014 , 340193 , 390904 |
| CVE-2024-6517 | Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting | ds-cf7-math-captcha | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-8484 | REST API TO MiniProgram <= 4.7.1 - SQL Injection | rest api to miniprogram | 7.5 (v3.1) | High | 380026 , 380122 |
| CVE-2024-8877 | Riello Netman 204 - SQL Injection | netman 204 firmware | 6.9 (v4.0) | Medium | 340156 , 341245 |
| CVE-2024-9007 | 123Solar 1.8.4.5 - Cross-Site Scripting | 123solar | 5.3 (v4.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-46986 | Camaleon CMS < 2.8.1 Arbitrary File Write to RCE | camaleon cms | 9.9 (v3.1) | Critical | 392647 |
| CVE-2023-47105 | Chaosblade < 1.7.4 - Remote Code Execution | chaosblade | 8.6 (v3.1) | High | 393655 |
| CVE-2024-43971 | Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 344361 , 344364 , 347198 , 377360 |
| CVE-2024-8752 | WebIQ 2.15.9 - Directory Traversal | webiq | 9.3 (v4.0) | Critical | 344365 , 347019 , 390716 |
| CVE-2024-46938 | Sitecore Experience Platform <= 10.4 - Arbitrary File Read | experience commerce | 7.5 (v3.1) | High | 340007 , 344360 , 344365 , 347019 , 390709 |
| CVE-2024-38816 | WebMvc.fn/WebFlux.fn - Path Traversal | Spring | 7.5 (v3.1) | High | 347009 |
| CVE-2024-6587 | LiteLLM - Server-Side Request Forgery | litellm | 7.5 (v3.1) | High | 340162 , 340163 |
| CVE-2024-8522 | LearnPress < 4.2.7.1 - SQL Injection | learnpress | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2024-8529 | LearnPress < 4.2.7.1 - SQL Injection | learnpress | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2024-6924 | TrueBooker <= 1.0.2 - SQL Injection | truebooker | 9.8 (v3.1) | Critical | 341245 , 380122 |
| CVE-2024-6928 | Opti Marketing <= 2.0.9 - SQL Injection | opti marketing | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-45507 | Apache OFBiz - Remote Code Execution | ofbiz | 9.8 (v3.1) | Critical | 340162 , 340163 , 344370 |
| CVE-2024-6926 | Viral Signup <= 2.1 - SQL Injection | viral signup | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-20440 | Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials | smart license utility | 7.5 (v3.1) | High | 390716 |
| CVE-2024-45622 | ASIS - SQL Injection Authentication Bypass | asis | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2024-45388 | Hoverfly < 1.10.3 - Arbitrary File Read | hoverfly | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-7354 | Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-3673 | Web Directory Free < 1.7.3 - Local File Inclusion | web directory free | 9.1 (v3.1) | Critical | 340748 , 344360 , 390709 |
| CVE-2024-8252 | WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion | clean login | 8.8 (v3.1) | High | 344360 |
| CVE-2024-43144 | Cost Calculator Builder <= 3.2.15 - SQL Injection | cost calculator builder | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-43917 | WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection | ti woocommerce wishlist | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2024-43965 | SendGrid for WordPress <= 1.4 - SQL Injection | sendgrid | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5057 | WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection | easy digital downloads | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-6670 | WhatsUp Gold HasErrors SQL Injection - Authentication Bypass | whatsup gold | 9.8 (v3.1) | Critical | 340016 , 341245 , 344362 |
| CVE-2024-6671 | WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass | whatsup gold | 9.8 (v3.1) | Critical | 340016 , 340159 , 344362 , 344366 |
| CVE-2024-45241 | CentralSquare CryWolf - Path Traversal | crywolf | 7.5 (v3.1) | High | 340007 |
| CVE-2024-7313 | Shield Security Plugin < 20.0.6 - Cross-Site Scripting | shield security | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-7954 | SPIP Porte Plume Plugin - Remote Code Execution | SPIP | 9.8 (v3.1) | Critical | 340023 , 340128 , 344370 , 380018 , 390801 |
| CVE-2024-42852 | AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting | acutoweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-7854 | Woo Inquiry <= 0.1 - SQL Injection | woo inquiry | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5932 | GiveWP - PHP Object Injection | givewp | 9.8 (v3.1) | Critical | 398001 |
| CVE-2024-7928 | FastAdmin < V1.3.4.20220530 - Path Traversal | fastadmin | 5.3 (v4.0) | Medium | 340007 |
| CVE-2024-6460 | WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion | tradedoubler-affiliate-tracker | 9.8 (v3.1) | Critical | 336461 , 340748 , 344360 , 347006 , 381206 |
| CVE-2024-32231 | Stash < 0.26.0 - SQL Injection | stash | 6.3 (v3.1) | Medium | 340016 , 340017 , 340157 , 340159 , 344361 , 344362 , 344363 , 344366 , 360147 , 360148 |
| CVE-2024-38653 | Ivanti Avalanche SmartDeviceServer - XML External Entity | avalanche | 7.5 (v3.1) | High | 330791 , 340152 |
| CVE-2024-7593 | Ivanti vTM - Authentication Bypass | virtual traffic manager | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-43360 | ZoneMinder - SQL Injection | zoneminder | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-30188 | Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write | dolphinscheduler | 8.1 (v3.1) | High | 340162 , 340165 , 344360 , 347009 , 390726 , 392647 |
| CVE-2022-38322 | Temenos Transact - Cross-Site Scripting | - | N/A | N/A | 333141 |
| CVE-2024-6893 | Journyx - XML External Entities Injection (XXE) | journyx-jtime | 7.5 (v3.1) | High | 344360 , 344370 , 344372 |
| CVE-2024-6892 | Journyx 11.5.4 - Reflected Cross Site Scripting | journyx | 6.1 (v3.1) | Medium | 333141 |
| CVE-2024-6651 | WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting | wp-file-upload | 6.1 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-7314 | AJ-Report < 1.4.1 - Remote Code Execution | report | 9.8 (v3.1) | Critical | 337209 , 337211 , 380026 |
| CVE-2024-7029 | AVTECH IP Camera - Command Injection | avm1203 firmware | 8.7 (v4.0) | High | 344363 |
| CVE-2024-7332 | TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability | cp450 firmware | 9.3 (v4.0) | Critical | 390716 |
| CVE-2024-7339 | TVT DVR Sensitive Device - Information Disclosure | sh-4050a5-5l(mm) firmware | 6.9 (v4.0) | Medium | 392301 |
| CVE-2024-39646 | WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS | custom 404 pro | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2024-7340 | W&B Weave Server - Remote Arbitrary File Leak | - | 8.8 (v3.1) | High | 347009 |
| CVE-2024-5765 | WpStickyBar <= 2.1.0 - SQL Injection | wpstickybar | 9.8 (v3.1) | Critical | 380122 |
| CVE-2024-5975 | CZ Loan Management <= 1.1 - SQL Injection | cz loan management | 9.1 (v3.1) | Critical | 380122 |
| CVE-2024-7188 | Bylancer Quicklancer 2.4 G - SQL Injection | quicklancer | 6.9 (v4.0) | Medium | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2024-41810 | Twisted - Open Redirect & XSS | twisted | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-41628 | Cluster Control CMON API - Directory Traversal | cluster control | 7.5 (v3.1) | High | 347009 |
| CVE-2024-41357 | phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS) | phpipam | 7.1 (v3.1) | High | 340147 , 340148 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2024-7120 | Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection | msg2300 firmware | 5.3 (v4.0) | Medium | 344363 , 344370 |
| CVE-2024-38289 | TurboMeeting - Boolean-based SQL Injection | turbomeeting | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 390572 |
| CVE-2024-38288 | TurboMeeting - Post-Authentication Command Injection | turbomeeting | 7.2 (v3.1) | High | 344363 , 344370 |
| CVE-2024-40422 | Devika v1 - Path Traversal | devika | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-41667 | OpenAM<=15.0.3 FreeMarker - Template Injection | OpenAM | 8.8 (v3.1) | High | 344360 , 392647 , 393655 |
| CVE-2024-6753 | Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting | social auto poster | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-38773 | FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection | formlift for infusionsoft web forms | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2024-6911 | PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion | processplus | 8.7 (v4.0) | High | 344365 , 347019 |
| CVE-2024-37259 | WP Extended < 3.0.0 - Stored Cross-Site Scripting | wp extended | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2024-37261 | WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting | wp-lister lite for amazon | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2024-40348 | Bazarr < 1.4.3 - Arbitrary File Read | bazarr | 8.2 (v3.1) | High | 347009 |
| CVE-2024-6205 | PayPlus Payment Gateway < 6.6.9 - SQL Injection | payplus payment gateway | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-39907 | 1Panel SQL Injection - Authenticated | 1panel | 9.8 (v3.1) | Critical | 344370 , 380026 |
| CVE-2024-21136 | Oracle Retail Xstore Suite - Pre-authenticated Path Traversal | retail xstore office | 8.6 (v3.1) | High | 340007 , 344365 , 347019 |
| CVE-2024-6746 | EasySpider 0.6.2 - Arbitrary File Read | easyspider | 5.3 (v4.0) | Medium | 346019 |
| CVE-2024-3753 | Hostel < 1.1.5.3 - Cross-Site Scripting | hostel | 5.9 (v3.1) | Medium | 341266 , 346755 , 377360 |
| CVE-2024-39914 | FOG Project < 1.5.10.34 - Remote Command Execution | fogproject | 9.8 (v3.1) | Critical | 344363 |
| CVE-2024-4879 | ServiceNow UI Macros - Template Injection | servicenow | 9.3 (v4.0) | Critical | 342259 , 344370 |
| CVE-2024-5217 | ServiceNow - Incomplete Input Validation | servicenow | 9.2 (v4.0) | Critical | 340157 , 340159 , 342259 , 344370 , 360147 , 360148 , 380026 |
| CVE-2024-6095 | LocalAI - Partial Local File Read | localai | 5.8 (v3.1) | Medium | 344360 |
| CVE-2024-38473 | Apache HTTP Server - ACL Bypass | Apache HTTP Server | 8.1 (v3.1) | High | 390709 |
| CVE-2024-36420 | Flowise 1.4.3 - Arbitrary File Read | flowise | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2024-36991 | Splunk Enterprise - Local File Inclusion | splunk | 7.5 (v3.1) | High | 390716 |
| CVE-2024-6265 | UsersWP <= 1.2.10 - Unauthenticated SQL Injection | userswp | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-5827 | Vanna - SQL injection | vanna-ai/vanna | 9.8 (v3.0) | Critical | 340029 , 344360 , 344370 , 347009 |
| CVE-2024-5334 | Devika - Local File Inclusion | devika | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2024-6250 | LOLLMS WebUI - Absolute Path Traversal | lollms web ui | 7.5 (v3.0) | High | 392301 |
| CVE-2024-33326 | LumisXP - Cross-site Scripting | lumis experience platform | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2024-37843 | Craft CMS <=v3.7.31 - SQL Injection | craft cms | 9.8 (v3.1) | Critical | 344378 |
| CVE-2024-5276 | Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection | filecatalyst workflow | 9.1 (v3.1) | Critical | 341245 |
| CVE-2024-36683 | PrestaShop productsalert - SQL Injection | the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop | 7.3 (v3.1) | High | 340016 , 340156 , 380026 , 380122 |
| CVE-2024-4841 | LoLLMS WebUI - Subfolder Prediction via Path Traversal | lollms-webui | 3.3 (v3.1) | Low | 344365 |
| CVE-2024-3605 | WP Hotel Booking <= 2.1.0 - SQL Injection | wp hotel booking | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-5522 | WordPress HTML5 Video Player < 2.5.27 - SQL Injection | html5 video player | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 340159 , 360147 , 360148 |
| CVE-2024-28397 | pyload-ng js2py - Remote Code Execution | pyload | 5.3 (v3.1) | Medium | 340014 , 344363 , 346755 , 360151 , 380026 |
| CVE-2024-36527 | Puppeteer Renderer - Directory Traversal | - | 6.5 (v3.1) | Medium | 340165 , 344360 , 347009 |
| CVE-2024-36597 | AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. | life insurance management system | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 390572 |
| CVE-2024-36599 | AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS) | life insurance management system | 6.1 (v3.1) | Medium | 345493 |
| CVE-2024-3552 | Web Directory Free < 1.7.0 - SQL Injection | web directory free | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2024-3922 | Dokan Pro <= 3.10.3 - SQL Injection | dokan | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-3032 | WordPress Themify Builder < 7.5.8 - Open Redirect | builder | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-2473 | WPS Hide Login <= 1.9.15.2 - Login Page Disclosure | wps hide login | 5.3 (v3.1) | Medium | 377360 |
| CVE-2024-36412 | SuiteCRM - SQL Injection | suitecrm | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-37014 | Langflow <= 1.0.12 - Remote Code Execution | langflow | 9.8 (v3.1) | Critical | 340095 , 344370 |
| CVE-2024-37393 | SecurEnvoy Two Factor Authentication - LDAP Injection | multi-factor authentication solutions | 7.5 (v3.1) | High | 392301 |
| CVE-2024-4577 | PHP CGI - Argument Injection | php | 9.8 (v3.1) | Critical | 340165 , 392301 |
| CVE-2024-30464 | WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization | social-icons-widget-by-wpzoom | 8.8 (v3.1) | High | 377360 |
| CVE-2024-35693 | WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting | 12 step meeting list | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 |
| CVE-2024-35694 | Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting | wpmobile.app | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2024-30163 | IPS Community Suite - Unauthenticated SQL Injection | ips community suite | 9.8 (v3.1) | Critical | 380026 |
| CVE-2024-4620 | ArForms < 6.6 - Remote Code Execution | arforms | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-3408 | D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution | dtale | 9.8 (v3.1) | Critical | 340087 , 340095 |
| CVE-2024-28995 | SolarWinds Serv-U - Directory Traversal | serv-u | 7.5 (v3.1) | High | 340007 , 344365 , 347019 |
| CVE-2024-2928 | MLflow < 2.11.3 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-36837 | CRMEB v.5.2.2 - SQL Injection | crmeb | 7.5 (v3.1) | High | 340156 , 340157 , 360147 , 360148 |
| CVE-2024-3469 | GP Premium <= 2.4.0 - Cross-Site Scripting | gp-premium | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2024-20404 | Cisco Finesse - Server-Side Request Forgery (SSRF) | finesse | 5.3 (v3.1) | Medium | 392301 |
| CVE-2024-4180 | The Events Calendar < 6.4.0.1 - Cross-site Scripting | the events calendar | 9.1 (v3.1) | Critical | 346755 |
| CVE-2024-5420 | SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting | utnserver Pro | 8.3 (v4.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-23692 | Rejetto HTTP File Server - Template injection | http file server | 9.8 (v3.1) | Critical | 344364 , 344366 , 390703 , 390722 |
| CVE-2024-29824 | Ivanti EPM - Remote Code Execution | endpoint manager | 8.8 (v3.1) | High | 340155 , 341155 , 341245 |
| CVE-2024-24919 | Check Point Quantum Gateway - Information Disclosure | quantum security gateway | 8.6 (v3.1) | High | 392301 |
| CVE-2024-35219 | OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete | openapi-generator | 8.3 (v3.1) | High | 340007 |
| CVE-2024-4455 | YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting | yith woocommerce ajax search | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-4443 | Business Directory Plugin <= 6.4.2 - SQL Injection | business directory | 7.5 (v3.1) | High | 340156 , 380026 |
| CVE-2024-35627 | TileServer API - Cross Site Scripting | tileserver-gl up to v4.4.10 | 6.1 (v3.1) | Medium | 346755 |
| CVE-2024-27954 | WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF | Automatic | 9.3 (v3.1) | Critical | 340165 , 344360 , 347009 |
| CVE-2024-3231 | Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting | popup4phone | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-22476 | Intel Neural Compressor <2.5.0 - SQL Injection | Intel(R) Neural Compressor software | 10.0 (v3.1) | Critical | 341245 |
| CVE-2024-3848 | Mlflow < 2.11.0 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-4956 | Sonatype Nexus Repository Manager 3 - Local File Inclusion | nexus | 7.5 (v3.1) | High | 347009 |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-32736 | CyberPower < v2.8.3 - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32737 | CyberPower - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32738 | CyberPower - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-32739 | CyberPower < v2.8.3 - SQL Injection | powerpanel | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-34257 | TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection | a3700r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-29889 | GLPI 10.0.10-10.0.14 - SQL Injection | glpi | 8.1 (v3.1) | High | 341245 |
| CVE-2024-34470 | HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion | mailinspector | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-33113 | D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure | dir-845l | 5.3 (v3.1) | Medium | 390722 |
| CVE-2023-40504 | LG Simple Editor <= v3.21.0 - Command Injection | simple editor | 9.8 (v3.1) | Critical | 340007 , 344362 |
| CVE-2024-4439 | WordPress Core <6.5.2 - Cross-Site Scripting | WordPress | 6.1 (v3.1) | Medium | 377360 |
| CVE-2024-2667 | InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload | instawp connect | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2024-2876 | Wordpress Email Subscribers by Icegram Express - SQL Injection | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2024-34061 | Changedetection.io <=v0.45.21 - Cross-Site Scripting | changedetection.io | 4.3 (v3.1) | Medium | 333141 , 340130 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-4348 | osCommerce v4.0 - Cross-site Scripting | oscommerce | 4.3 (v3.1) | Medium | 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2024-31823 | ecommerce-codeigniter-bootstrap Arbitrary Code Execution Vulnerability | ecommerce-codeigniter-bootstrap | 9.8 (v3.1) | Critical | 344360 |
| CVE-2024-33559 | Wordpress Theme XStore 9.3.8 - SQLi | XStore | 9.3 (v3.1) | Critical | 340016 , 340017 , 344366 |
| CVE-2024-4257 | BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection | clinical browsing system | 6.5 (v3.1) | Medium | 341245 , 344366 , 361149 |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-32709 | WP-Recall <= 16.26.5 - SQL Injection | WP-Recall | 9.3 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 , 390703 |
| CVE-2024-20353 | adaptive security appliance software Denial of Service Vulnerability | adaptive security appliance software | 8.6 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2024-4040 | CrushFTP VFS - Sandbox Escape LFR | crushftp | 10.0 (v3.1) | Critical | 392301 |
| CVE-2024-27348 | Apache HugeGraph-Server - Remote Command Execution | hugegraph | 9.8 (v3.1) | Critical | 380026 |
| CVE-2024-32238 | H3C ER8300G2-X - Password Disclosure | - | 9.8 (v3.1) | Critical | 390716 |
| CVE-2024-31750 | F-logic DataCube3 - SQL Injection | datacube3 firmware | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2024-1483 | Mlflow < 2.9.2 - Path Traversal | mlflow | 7.5 (v3.1) | High | 340007 , 340162 , 340163 , 390709 |
| CVE-2024-1561 | Gradio 4.3-4.12 - Local File Read | gradio | 7.5 (v3.0) | High | 344365 |
| CVE-2024-32128 | WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection | Realtyna Organic IDX plugin | 9.3 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2024-32136 | BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection | BWL Advanced FAQ Manager | 7.6 (v3.1) | High | 380026 , 380122 |
| CVE-2023-51409 | Jordy Meow AI Engine - Unrestricted File Upload | ai engine | 9.8 (v3.1) | Critical | 382238 |
| CVE-2024-24809 | Traccar - Unrestricted File Upload | traccar | 8.5 (v3.1) | High | 330791 , 340152 , 391213 |
| CVE-2024-1728 | Gradio > 4.19.1 UploadButton - Path Traversal | gradio | 7.5 (v3.1) | High | 344360 |
| CVE-2024-3378 | iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS) | secure web gateway | 6.1 (v3.1) | Medium | 392301 |
| CVE-2024-31848 | CData API Server < 23.4.8844 - Path Traversal | API Server | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-31849 | CData Connect < 23.4.8846 - Path Traversal | Connect | 9.8 (v3.1) | Critical | 344365 |
| CVE-2024-31850 | CData Arc < 23.4.8839 - Path Traversal | Arc | 8.6 (v3.1) | High | 344365 |
| CVE-2024-31851 | CData Sync < 23.4.8843 - Path Traversal | Sync | 8.6 (v3.1) | High | 344365 |
| CVE-2024-2879 | WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection | layerslider | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2024-2389 | Progress Kemp Flowmon - Command Injection | flowmon | 9.8 (v3.1) | Critical | 344363 |
| CVE-2024-30498 | CRM Perks Forms <= 1.1.4 - SQL Injection | crm perks forms | 10.0 (v3.1) | Critical | 380122 |
| CVE-2024-30490 | ProfileGrid <= 5.7.8 - SQL Injection | profilegrid | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2024-30502 | WP Travel Engine <= 5.7.9 - SQL Injection | wp travel engine | 9.8 (v3.1) | Critical | 330791 , 340016 , 340017 , 340152 , 340157 , 360147 , 360148 , 380026 , 380122 |
| CVE-2024-29792 | Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting | unlimited elements for elementor | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2024-29931 | WP Go Maps <= 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 341266 , 344370 , 346755 , 377360 |
| CVE-2024-30194 | Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 333141 , 340149 , 344361 , 344364 , 346755 , 347198 , 377360 |
| CVE-2023-28787 | Quiz and Survey Master <= 8.1.4 - SQL Injection | Quiz And Survey Master | 9.3 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-48777 | WordPress Elementor 3.18.1 - File Upload/Remote Code Execution | website builder | 8.8 (v3.1) | High | 377360 |
| CVE-2023-47873 | WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload | wp child theme generator | 7.2 (v3.1) | High | 377360 |
| CVE-2024-27956 | WordPress Automatic Plugin <= 3.92.0 - SQL Injection | automatic | 9.8 (v3.1) | Critical | 340156 , 341245 , 380026 , 380122 , 390614 |
| CVE-2024-27292 | Docassemble - Local File Inclusion | docassemble | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-7246 | System Dashboard < 2.8.10 - Cross-Site Scripting | system dashboard | 5.4 (v3.1) | Medium | 377360 |
| CVE-2024-24050 | Workout Journal App 1.0 - Stored XSS | workout journal app | 4.7 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 380026 , 390727 , 392301 , 392648 |
| CVE-2024-2621 | Fujian Kelixin Communication - Command Injection | kelixin communication command and dispatch | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2023-40279 | OpenClinic GA 5.247.01 - Path Traversal (Authenticated) | openclinic ga | 7.5 (v3.1) | High | 340007 , 390727 , 392301 , 392648 |
| CVE-2024-28734 | Coda v.2024Q1 - Cross-Site Scripting | Unit4 Financials by Coda prior to 2023Q4 | 6.1 (v3.1) | Medium | 340112 , 340113 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-29138 | WordPress Restrict User Access <= 2.5 - Cross-Site Scripting | restrict user access | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2024-28253 | OpenMetaData - SpEL Injection in PUT /api/v1/policies | openmetadata | 8.8 (v3.1) | High | 337209 , 337210 , 337211 , 340095 |
| CVE-2023-6825 | WordPress File Manager <= 7.2.1 - Directory Traversal | file manager | 9.9 (v3.1) | Critical | 377360 |
| CVE-2024-0799 | Arcserve Unified Data Protection - Authentication Bypass | udp | 9.8 (v3.1) | Critical | 391213 |
| CVE-2024-1751 | Tutor LMS <= 2.1.10 - SQL Injection | tutor lms | 8.8 (v3.1) | High | 380122 |
| CVE-2024-28623 | RiteCMS 3.0.0 - Cross-site Scripting | ritecms | 6.1 (v3.1) | Medium | 346755 , 380026 |
| CVE-2024-2330 | NS-ASG Application Security Gateway 6.3 - Sql Injection | application security gateway | 9.8 (v3.1) | Critical | 340157 , 360147 |
| CVE-2024-27564 | ChatGPT个人专用版 - Server Side Request Forgery | chatgpt web | 6.5 (v3.1) | Medium | 340165 , 344360 , 347009 |
| CVE-2024-1698 | NotificationX <= 2.8.2 - SQL Injection | notificationx | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2024-25608 | Liferay Portal - Open Redirect | digital experience platform,liferay portal | 6.1 (v3.1) | Medium | 398005 |
| CVE-2024-1512 | MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection | masterstudy lms | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2023-47218 | QNAP QTS and QuTS Hero - OS Command Injection | qts | 8.3 (v3.1) | High | 330791 , 340152 |
| CVE-2024-22024 | Ivanti Connect Secure - XXE | connect secure | 8.3 (v3.1) | High | 380019 |
| CVE-2024-0566 | Smart Manager 8.27.0 - Post-Authenticated SQL Injection | smart manager | 7.2 (v3.1) | High | 380122 , 390704 |
| CVE-2024-0250 | Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect | analytics insights | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2024-24495 | Daily Habit Tracker 1.0 - SQL Injection | daily habit tracker | 9.8 (v3.1) | Critical | 341245 , 344366 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2024-24494 | Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) | daily habit tracker | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 344370 , 346755 , 350148 , 360151 |
| CVE-2024-24497 | Employee Management System 1.0 - txtusername and txtpassword SQL Injection (Admin Login) | - | N/A | N/A | 340156 , 341245 , 345493 |
| CVE-2024-24131 | SuperWebMailer 9.31.0.01799 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-40355 | Axigen WebMail - Cross-Site Scripting | axigen mobile webmail | 5.4 (v3.1) | Medium | 346755 |
| CVE-2023-46359 | cPH2 Charging Station v1.87.0 - OS Command Injection | cph2 echarge | 9.8 (v3.1) | Critical | 340014 , 340193 , 344363 , 344364 , 344370 , 393655 |
| CVE-2024-24112 | Exrick XMall - SQL Injection | xmall | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-6989 | Shield Security WP Plugin <= 18.5.9 - Local File Inclusion | shield security | 9.8 (v3.1) | Critical | 340748 |
| CVE-2024-22319 | IBM Operational Decision Manager - JNDI Injection | operational decision manager | 9.8 (v3.1) | Critical | 398008 |
| CVE-2024-21485 | Dash Framework - Cross-site Scripting | dash | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2024-21893 | Ivanti SAML - Server Side Request Forgery (SSRF) | connect secure | 8.2 (v3.1) | High | 392301 |
| CVE-2024-1061 | WordPress HTML5 Video Player - SQL Injection | html5 video player | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2024-24328 | TotoLink Router setMacFilterRules - Command Injection | a3300r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-24329 | TotoLink Router setPortForwardRules - Command Injection | a3300r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2024-24565 | CrateDB Database - Arbitrary File Read | cratedb | 6.5 (v3.1) | Medium | 340016 , 340017 , 340029 , 344360 , 344370 |
| CVE-2024-0986 | Issabel Authenticated - Remote Code Execution | pbx | 9.8 (v3.1) | Critical | 344362 , 344363 |
| CVE-2024-23334 | aiohttp - Directory Traversal | aiohttp | 7.5 (v3.1) | High | 347009 |
| CVE-2024-22729 | Netis MW5360 V1.0.1.3031 - Command Injection | mw5360 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-6697 | WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2024-0705 | Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection | stripe payment plugin for woocommerce | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2022-1609 | The School Management < 9.9.7 - Remote Code Execution | school management | 9.8 (v3.1) | Critical | 340095 , 344361 |
| CVE-2023-22527 | Atlassian Confluence - Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical | 340095 , 344364 , 344366 |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 390722 , 392301 |
| CVE-2023-2252 | Directorist < 7.5.4 - Local File Inclusion | directorist | 2.7 (v3.1) | Low | 344360 , 347009 , 390709 |
| CVE-2023-6623 | Essential Blocks < 4.4.3 - Local File Inclusion | essential blocks | 9.8 (v3.1) | Critical | 344360 , 347009 |
| CVE-2023-6567 | LearnPress <= 4.2.5.7 - SQL Injection | learnpress | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-21650 | XWiki < 4.10.20 - Remote code execution | xwiki | 9.8 (v3.1) | Critical | 340130 |
| CVE-2023-6750 | WordPress WP Clone <= 2.4.2 - Database Backup Exposure | clone | 7.5 (v3.1) | High | 350590 , 390716 |
| CVE-2024-0195 | SpiderFlow Crawler Platform - Remote Code Execution | spider-flow | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340095 |
| CVE-2023-50094 | reNgine 2.2.0 - Command Injection | rengine | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2023-6000 | WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS | popup builder | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-50071 | CVE-2023-50071 - Multiple SQL Injection | customer support system | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2023-50839 | JS Help Desk <= 2.8.1 - SQL Injection | js help desk | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-49230 | Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload | balance two firmware | 8.8 (v3.1) | High | 330791 , 340152 , 392301 |
| CVE-2023-7137 | Client Details System 1.0 - SQL Injection | client details system | 8.8 (v3.1) | High | 331028 , 340016 , 340017 , 340144 , 340156 , 340157 , 344364 , 344366 , 344370 , 360147 , 360148 , 360151 , 380026 , 380122 |
| CVE-2023-7116 | WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection | datax-web | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2023-5991 | Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion | hotel booking lite | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2023-5203 | WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection | wp sessions time monitoring full automatic | 7.5 (v3.1) | High | 340016 , 380026 , 380122 |
| CVE-2023-32590 | Subscribe to Category <= 2.7.4 - SQL Injection | subscribe to category | 7.5 (v3.1) | High | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-6977 | Mlflow <2.8.0 - Local File Inclusion | mlflow | 7.5 (v3.1) | High | 344360 |
| CVE-2023-44982 | WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure | perfect images | 7.5 (v3.1) | High | 390716 |
| CVE-2023-49489 | KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) | kodexplorer | 6.1 (v3.1) | Medium | 342259 , 346755 |
| CVE-2023-6909 | Mlflow <2.9.2 - Path Traversal | mlflow | 7.5 (v3.1) | High | 392301 |
| CVE-2023-50917 | MajorDoMo thumb.php - OS Command Injection | majordomo | 9.8 (v3.1) | Critical | 344363 |
| CVE-2023-6553 | Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution | backup migration | 9.8 (v3.1) | Critical | 301106 |
| CVE-2023-6831 | mlflow - Path Traversal | mlflow | 8.1 (v3.1) | High | 390709 |
| CVE-2023-48084 | Nagios XI < 5.11.3 - SQL Injection | nagios xi | 9.8 (v3.1) | Critical | 340130 , 340145 , 340156 , 380026 , 380122 |
| CVE-2022-45365 | Stock Ticker <= 3.23.2 - Cross-Site-Scripting | stock ticker | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-41621 | Emlog Pro v2.1.14 - Cross-Site Scripting | emlog | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-6379 | OpenCMS 14 & 15 - Cross Site Scripting | opencms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-49494 | DedeCMS v5.7.111 - Cross-Site Scripting | dedecms | 6.1 (v3.1) | Medium | 333141 , 340087 , 340095 , 340099 , 340149 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-6655 | Hongjing e-HR 2020 - SQL Injection | e-hr | 9.8 (v3.1) | Critical | 341245 , 344366 , 361149 |
| CVE-2023-6568 | Mlflow - Cross-Site Scripting | mlflow | 6.1 (v3.1) | Medium | 334168 , 391213 |
| CVE-2023-6063 | WP Fastest Cache 1.2.2 - Unauthenticated SQL Injection | wp fastest cache | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-49293 | Vite dev server - Cross-Site Scripting | vite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-6360 | WordPress My Calendar <3.4.22 - SQL Injection | my calendar | 9.8 (v3.1) | Critical | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-40211 | Post Grid <= 2.2.50 - Information Exposure via REST API | post grid combo | 7.5 (v3.1) | High | 330791 , 340152 |
| CVE-2023-40600 | EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure | image optimizer | 7.5 (v3.1) | High | 390716 |
| CVE-2023-3368 | Chamilo LMS <= v1.11.20 Unauthenticated Command Injection | chamilo | 9.8 (v3.1) | Critical | 344363 , 344370 , 393655 |
| CVE-2023-48022 | Anyscale Ray - Remote Code Execution | ray | 9.8 (v3.1) | Critical | 392301 , 392648 |
| CVE-2022-41678 | Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution | activemq | 8.8 (v3.1) | High | 330925 |
| CVE-2023-6275 | TOTVS Fluig Platform - Cross-Site Scripting | fluig | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-5815 | News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion | news & blog designer pack | 9.8 (v3.1) | Critical | 340748 , 347006 |
| CVE-2023-5652 | WP Hotel Booking <= 2.0.7 - SQL Injection | wp hotel booking | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2023-38879 | openSIS v9.0 - Path Traversal | opensis | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-48241 | XWiki < 4.10.15 - Information Disclosure | xwiki | 7.5 (v3.1) | High | 390722 |
| CVE-2023-44353 | Adobe ColdFusion WDDX Deserialization Gadgets | coldfusion | 9.8 (v3.1) | Critical | 344365 , 344370 , 350147 |
| CVE-2023-44352 | Adobe Coldfusion - Cross-Site Scripting | coldfusion | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 341266 , 346755 , 347198 |
| CVE-2023-6020 | Ray Static File - Local File Inclusion | ray | 7.5 (v3.1) | High | 347009 |
| CVE-2023-6023 | VertaAI ModelDB - Path Traversal | modeldb | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-6038 | H2O ImportFiles - Local File Inclusion | h2o | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-41597 | EyouCms v1.6.2 - Cross-Site Scripting | eyoucms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-46022 | Blood Bank 1.0 - 'bid' SQLi | blood bank | 7.8 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2023-47684 | Essential Grid <= 3.1.0 - Cross-Site Scripting | essential grid | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-46020 | Blood Bank v1.0 - Stored Cross Site Scripting (XSS) | blood bank | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 345493 , 346755 , 350147 , 350148 |
| CVE-2023-46014 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-46017 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-46018 | Blood Bank v1.0 - Multiple SQL Injection | blood bank | 5.5 (v3.1) | Medium | 345493 |
| CVE-2023-39796 | WBCE 1.6.0 - Unauthenticated SQL injection | wbce cms | 9.8 (v3.1) | Critical | 340016 , 340145 , 340156 , 380026 , 380122 |
| CVE-2023-47246 | SysAid Server - Remote Code Execution | sysaid on-premises | 9.8 (v3.1) | Critical | 340007 , 390614 , 390626 , 390724 |
| CVE-2023-47248 | PyArrow Flight RPC - Remote Code Execution | pyarrow | 9.8 (v3.1) | Critical | 391213 |
| CVE-2023-46732 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-45805 | WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection | payment gateway | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-34259 | Kyocera TASKalfa printer - Path Traversal | d-copia253mf plus firmware | 4.9 (v3.1) | Medium | 347009 |
| CVE-2023-1719 | Bitrix Component - Cross-Site Scripting | bitrix24 | 9.8 (v3.1) | Critical | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-24000 | WordPress GamiPress <= 2.5.7 - SQL Injection | gamipress | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2023-5360 | WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload | royal elementor addons | 9.8 (v3.1) | Critical | 382238 |
| CVE-2023-5863 | phpMyFAQ < 3.2.0 - Cross-site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 333141 , 340248 , 342259 , 346755 , 350148 |
| CVE-2023-45671 | Frigate < 0.13.0 Beta 3 - Cross-Site Scripting | frigate | 4.7 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-46818 | ISPConfig - PHP Code Injection | ispconfig | 7.2 (v3.1) | High | 340095 |
| CVE-2023-43208 | NextGen Healthcare Mirth Connect - Remote Code Execution | mirth connect | 9.8 (v3.1) | Critical | 344363 , 344364 , 344380 |
| CVE-2023-46747 | F5 BIG-IP - Unauthenticated RCE via AJP Smuggling | big-ip access policy manager | 9.8 (v3.1) | Critical | 390626 , 392767 |
| CVE-2023-34048 | VMware vCenter Server - Out-of-Bounds Write | vcenter server | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-46347 | PrestaShop Step by Step products Pack - SQL Injection | ndk steppingpack | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 344366 , 360147 , 360148 |
| CVE-2023-46574 | TOTOLINK A3700R - Command Injection | a3700r firmware | 9.8 (v3.1) | Critical | 392301 , 392648 |
| CVE-2023-45136 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 9.6 (v3.1) | Critical | 341266 |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-38192 | SuperWebMailer 9.00.0.01710 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2023-38194 | SuperWebMailer - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-5204 | WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection | wpbot | 7.5 (v3.1) | High | 340016 , 380122 |
| CVE-2023-45826 | Leantime < 2.4 - Authenticated SQL Injection | leantime | 6.5 (v3.1) | Medium | 340017 , 340159 , 341245 , 390726 , 392647 |
| CVE-2023-45375 | PrestaShop PireosPay - SQL Injection | pireospay | 8.8 (v3.1) | High | 341245 , 344366 |
| CVE-2023-45542 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2023-45852 | Viessmann Vitogate 300 - Remote Code Execution | vitogate 300 firmware | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 |
| CVE-2023-34993 | Fortinet FortiWLM Unauthenticated Command Injection Vulnerability | fortiwlm | 9.8 (v3.1) | Critical | 344363 |
| CVE-2023-44393 | Piwigo - Cross-Site Scripting | piwigo | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-44812 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 |
| CVE-2023-44813 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-5452 | SnipeIT 6.2.1 - Stored Cross Site Scripting | snipe-it | 5.4 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-43261 | Milesight Routers - Information Disclosure | ur51 | 7.5 (v3.1) | High | 390716 |
| CVE-2023-44012 | mojoPortal v.2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-43662 | ShokoServer System - Local File Inclusion (LFI) | shokoserver | 8.6 (v3.1) | High | 344365 , 390716 |
| CVE-2023-5244 | Microweber < V.2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 346755 , 380026 , 393655 |
| CVE-2023-43325 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-4490 | WordPress Job Portal < 2.0.6 - SQL Injection | wp job portal | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-4148 | Ditty < 3.1.25 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2023-43326 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-43373 | Hoteldruid v3.0.5 - SQL Injection | hoteldruid | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-43374 | Hoteldruid v3.0.5 - SQL Injection | hoteldruid | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-38875 | PHP Login System 2.0.1 - Cross-Site Scripting | php-login-system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-41599 | JFinalCMS v5.0.0 - Directory Traversal | jfinalcms | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-33831 | FUXA - Unauthenticated Remote Code Execution | fuxa | 9.8 (v3.1) | Critical | 340095 , 344370 , 345240 , 380026 |
| CVE-2023-38040 | Revive Adserver 5.4.1 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium | 340147 , 341256 , 341266 , 346755 |
| CVE-2023-4974 | Academy LMS 6.2 - SQL Injection | academy lms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-4973 | Academy LMS 6.2 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium | 340147 , 346755 , 350148 |
| CVE-2023-41892 | CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution | craft cms | 9.8 (v3.1) | Critical | 344365 |
| CVE-2023-3710 | Honeywell PM43 Printers - Command Injection | pm43 firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2023-3169 | tagDiv Composer < 4.2 - Stored Cross-Site Scripting | tagdiv composer | 6.1 (v3.1) | Medium | 380026 |
| CVE-2023-40924 | SolarView Compact < 6.00 - Directory Traversal | solarview compact firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2023-39676 | PrestaShop fieldpopupnewsletter Module - Cross Site Scripting | fieldpopupnewsletter | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-4634 | Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion | media library assistant | 9.8 (v3.1) | Critical | 300017 |
| CVE-2021-36646 | KodExplorer - Cross-Site Scripting | kod-explorer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39361 | Cacti 1.2.24 - SQL Injection | cacti | 9.8 (v3.1) | Critical | 344366 , 380026 , 380122 |
| CVE-2023-39598 | IceWarp Email Client - Cross Site Scripting | webclient | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 |
| CVE-2023-2813 | Wordpress Multiple Themes - Reflected Cross-Site Scripting | connections reloaded | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-40208 | Stock Ticker <= 3.23.2 - Cross-Site Scripting | stock ticker | 6.1 (v3.1) | Medium | 346755 |
| CVE-2023-4151 | Store Locator WordPress < 1.4.13 - Cross-Site Scripting | store locator | 6.1 (v3.1) | Medium | 377360 |
| CVE-2023-4284 | WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting | post timeline | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2023-4596 | WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload | forminator | 9.8 (v3.1) | Critical | 300006 |
| CVE-2023-41538 | PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting | php forum script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39650 | PrestaShop Theme Volty CMS Blog - SQL Injection | theme volty cms blog | 9.8 (v3.1) | Critical | 340016 , 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2023-40748 | PHPJabbers Food Delivery Script - SQL Injection | food delivery script | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 |
| CVE-2023-40749 | PHPJabbers Food Delivery Script v3.0 - SQL Injection | food delivery script | 9.8 (v3.1) | Critical | 340017 , 340156 , 340157 , 341245 , 360147 , 360148 |
| CVE-2023-41109 | SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection | smartnode sn200 | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-40750 | PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting | yacht listing script | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40751 | PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting | fundraising script | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40752 | PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting | make an offer widget | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-40755 | PHPJabbers Callback Widget v1.0 - Cross-Site Scripting | callback widget | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2023-40753 | PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting | ticket support script | 5.4 (v3.1) | Medium | 341266 |
| CVE-2023-4547 | SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting | ecommerce cms | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-39600 | IceWarp 11.4.6.0 - Cross-Site Scripting | icewarp | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-39700 | IceWarp Mail Server v10.4.5 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2023-39026 | FileMage Gateway - Directory Traversal | Windows | 7.5 (v3.1) | High | 344365 , 347019 , 390716 |
| CVE-2023-39141 | Aria2 WebUI - Path traversal | webui-aria2 | 7.5 (v3.1) | High | 347009 |
| CVE-2023-4450 | JeecgBoot JimuReport - Template injection | jeecg | 9.8 (v3.1) | Critical | 340014 , 344370 , 393655 |
| CVE-2023-3936 | Blog2Social < 7.2.1 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium | 347198 |
| CVE-2023-4451 | Cockpit - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2023-4415 | Ruijie RG-EW1200G Router Background - Login Bypass | rg-ew1200g firmware | 8.8 (v3.1) | High | 392301 |
| CVE-2023-38910 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' ) | csz cms | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-38911 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery') | csz cms | 5.4 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-36845 | Juniper J-Web - Remote Code Execution | junos | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2023-2122 | Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting | image optimizer | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2023-2272 | Tiempo.com <= 0.1.2 - Cross-Site Scripting | tiempo | 6.1 (v3.1) | Medium | 377360 |
| CVE-2023-4382 | Hyip Rio 2.1 - Arbitrary File Upload | hyip rio | 5.4 (v3.1) | Medium | 392301 |
| CVE-2023-3452 | WordPress Canto Plugin <= 3.0.4 - File Inclusion | canto | 9.8 (v3.1) | Critical | 340077 , 340694 , 340695 |
| CVE-2023-32563 | Ivanti Avalanche - Remote Code Execution | avalanche | 9.8 (v3.1) | Critical | 340007 |
| CVE-2023-37988 | Contact Form Generator <= 2.5.5 - Cross-Site Scripting | contact form generator | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-36306 | Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting | loganalyzer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4173 | mooSocial 3.1.8 - Reflected XSS | moostore | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-4174 | mooSocial 3.1.6 - Reflected Cross Site Scripting | moostore | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-4169 | Ruijie RG-EW1200G Router - Password Reset | rg-ew1200g firmware | 8.8 (v3.1) | High | 392301 |
| CVE-2023-39143 | PaperCut < 22.1.3 - Path Traversal | papercut mf | 9.8 (v3.1) | Critical | 344365 , 347019 |
| CVE-2023-38964 | Academy LMS 6.0 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium | 333141 , 342259 , 347198 , 350147 , 350148 |
| CVE-2023-37679 | NextGen Mirth Connect - Remote Code Execution | mirth connect | 9.8 (v3.1) | Critical | 344363 |
| CVE-2023-38950 | ZKTeco BioTime v8.5.5 - Path Traversal | biotime | 7.5 (v3.1) | High | 340007 |
| CVE-2023-4110 | PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting | availability booking calendar | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4111 | PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting | bus reservation system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4112 | PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting | shuttle booking software | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2023-4113 | PHPJabbers Service Booking Script 1.0 - Cross Site Scripting | service booking script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4114 | PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting | night club booking software | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4115 | PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting | cleaning business software | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4116 | PHPJabbers Taxi Booking 2.0 - Cross Site Scripting | taxi booking script | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-4136 | CrafterCMS Engine - Cross-Site Scripting | craftercms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2023-34960 | Chamilo Command Injection | chamilo | 9.8 (v3.1) | Critical | 341245 , 344360 , 344361 , 344363 , 344370 |
| CVE-2023-39108 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39109 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39110 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2023-34635 | Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection | unibox administration | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2023-3345 | LMS by Masteriyo < 1.6.8 - Information Exposure | masteriyo | 6.5 (v3.1) | Medium | 377360 |
| CVE-2023-0602 | Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting | twittee text tweet | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | zimbra | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-3990 | Mingsoft MCMS < 5.3.1 - Cross-Site Scripting | mcms | 6.1 (v3.1) | Medium | 342259 , 350148 |
| CVE-2023-37979 | Ninja Forms < 3.6.26 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-31465 | TimeKeeper by FSMLabs - Remote Code Execution | timekeeper | 9.8 (v3.1) | Critical | 344361 , 344364 , 393655 |
| CVE-2023-38501 | CopyParty v1.8.6 - Cross Site Scripting | copyparty | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 , 390722 |
| CVE-2023-2309 | wpForo Forum <= 2.1.8 - Cross-Site Scripting | wpforo forum | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2023-3843 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3844 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3845 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3846 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3847 | MooDating 1.2 - Cross-Site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3848 | MooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-3849 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2023-38203 | Adobe ColdFusion - Deserialization of Untrusted Data | coldfusion | 9.8 (v3.1) | Critical | 344370 , 344380 , 350147 |
| CVE-2023-37728 | IceWarp Webmail Server v10.2.1 - Cross Site Scripting | icewarp | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-3722 | Avaya Aura Device Services - OS Command Injection | aura device services | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-22047 | Oracle Peoplesoft - Unauthenticated File Read | peoplesoft enterprise | 7.5 (v3.1) | High | 340165 , 344360 , 344365 , 347009 |
| CVE-2023-1893 | Login Configurator <=2.1 - Cross-Site Scripting | login configurator | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-37462 | XWiki Platform - Remote Code Execution | xwiki | 8.8 (v3.1) | High | 340130 |
| CVE-2023-37474 | Copyparty <= 1.8.2 - Directory Traversal | copyparty | 7.5 (v3.1) | High | 347009 |
| CVE-2023-34124 | SonicWall GMS and Analytics Web Services - Shell Injection | analytics | 9.8 (v3.1) | Critical | 340017 , 360148 , 380123 |
| CVE-2023-34133 | SonicWall GMS and Analytics - SQL Injection | analytics | 7.5 (v3.1) | High | 340017 , 360148 , 380123 |
| CVE-2023-29300 | Adobe ColdFusion - Pre-Auth Remote Code Execution | coldfusion | 9.8 (v3.1) | Critical | 344370 , 344380 , 350147 |
| CVE-2023-3643 | CAREL Boss Mini <= 1.4.0 - Local File Inclusion | boss-mini | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2023-37629 | Online Piggery Management System v1.0 - Unauthenticated File Upload | simple online piggery management system | 9.8 (v3.1) | Critical | 330791 |
| CVE-2023-3077 | MStore API < 3.9.8 - SQL Injection | mstore api | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-23897 | Ozette Plugins - Cross-Site Request Forgery | simple mobile url redirect | 8.8 (v3.1) | High | 345490 , 377360 |
| CVE-2023-1119 | WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting | wp-optimize,srbtranslatin | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-1780 | Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting | companion sitemap generator | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 341266 , 342259 , 360151 , 390722 |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | collaboration | 9.0 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-3521 | FOSSBilling < 0.5.3 - Cross-Site Scripting | fossbilling | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-36934 | MOVEit Transfer - SQL Injection | moveit transfer | 9.1 (v3.1) | Critical | 340016 , 344362 |
| CVE-2023-3479 | Hestiacp <= 1.7.7 - Cross-Site Scripting | control panel | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-34843 | Traggo Server - Local File Inclusion | traggo | 7.5 (v3.1) | High | 344365 , 347019 |
| CVE-2023-34599 | Gibbon v25.0.0 - Cross-Site Scripting | gibbon | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-30203 | Dzzoffice 2.02.1 - Cross-Site Scripting | dzzoffice | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-2624 | KiviCare WordPress Plugin - Cross-Site Scripting | kivicare | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-2178 | Aajoda Testimonials < 2.2.2 - Cross-Site Scripting | aajoda testimonials | 4.8 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-3197 | WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection | mstore api | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2023-30258 | MagnusBilling - Remote Code Execution | magnusbilling | 9.8 (v3.1) | Critical | 344363 , 344364 , 344366 |
| CVE-2023-3380 | WAVLINK WN579X3 - Remote Command Execution | wn579x3 firmware | 9.8 (v3.1) | Critical | 340014 , 344363 |
| CVE-2023-36284 | QloApps 1.6.0 - SQL Injection | qloapps | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2023-35155 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2023-35156 | XWiki >= 6.0-rc-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35158 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35159 | XWiki >= 3.4-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35160 | XWiki >= 2.5-milestone-2 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35161 | XWiki >= 6.2-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-35162 | XWiki < 14.10.5 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-36287 | Webkul QloApps 1.6.0 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 350148 |
| CVE-2023-36289 | Webkul QloApps 1.6.0 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 346755 |
| CVE-2023-36346 | POS Codekop v2.0 - Cross Site Scripting | codekop | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2020-20969 | PluckCMS 4.7.10 - Unrestricted File Upload | pluck | 7.2 (v3.1) | High | 340035 , 390727 , 392301 , 392648 |
| CVE-2023-35843 | NocoDB version <= 0.106.1 - Arbitrary File Read | nocodb | 7.5 (v3.1) | High | 347009 |
| CVE-2023-35844 | Lightdash version <= 0.510.3 Arbitrary File Read | lightdash | 7.5 (v3.1) | High | 347009 |
| CVE-2023-2779 | Super Socializer < 7.13.52 - Cross-Site Scripting | social share, social login and social comments | 6.1 (v3.1) | Medium | 340099 , 341099 , 341258 , 346755 , 347198 |
| CVE-2023-34659 | JeecgBoot 3.5.0 - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-30625 | Rudder Server < 1.3.0-rc.1 - SQL Injection | rudder-server | 8.8 (v3.1) | High | 392301 |
| CVE-2023-30150 | PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection | leocustomajax | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34751 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34752 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34753 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34754 | Bloofox v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-34755 | bloofoxCMS v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2023-34756 | Bloofox v0.5.2.1 - SQL Injection | bloofoxcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2023-34537 | Hoteldruid 3.0.5 - Cross-Site Scripting | hoteldruid | 5.4 (v3.1) | Medium | 340130 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-27624 | WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS | redirect after login | 4.8 (v3.1) | Medium | 346755 |
| CVE-2023-34105 | SRS - Command Injection | simple realtime server | 7.5 (v3.1) | High | 344364 |
| CVE-2023-3188 | Owncast - Server Side Request Forgery | owncast | 6.5 (v3.1) | Medium | 392301 |
| CVE-2023-3187 | Teachers Record Management System 1.0 - File Upload Type Validation | teachers record management system | 5.4 (v3.1) | Medium | 345493 |
| CVE-2023-3184 | Sales Tracker Management System v1.0 - Multiple Vulnerabilities | sales tracker management system | 4.8 (v3.1) | Medium | 345493 |
| CVE-2023-32749 | Pydio Cells 4.1.2 - Unauthorised Role Assignments | cells | 8.8 (v3.1) | High | 330791 , 340152 |
| CVE-2019-25141 | Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update | easy wp smtp | 9.8 (v3.1) | Critical | 390726 , 392647 |
| CVE-2023-20887 | VMware VRealize Network Insight - Remote Code Execution | vrealize network insight | 9.8 (v3.1) | Critical | 391213 |
| CVE-2023-33510 | Jeecg P3 Biz Chat - Local File Inclusion | jeecg p3 biz chat | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-36731 | Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update | flexible checkout fields for woocommerce | 6.1 (v3.1) | Medium | 346755 , 377360 , 390585 |
| CVE-2023-0900 | AP Pricing Tables Lite <= 1.1.6 - SQL Injection | pricing table builder | 7.2 (v3.1) | High | 377360 |
| CVE-2023-2224 | Seo By 10Web < 1.2.7 - Cross-Site Scripting | seo | 4.8 (v3.1) | Medium | 377360 |
| CVE-2023-34362 | MOVEit Transfer - Remote Code Execution | moveit cloud | 9.8 (v3.1) | Critical | 340016 , 390716 |
| CVE-2023-27639 | PrestaShop TshirteCommerce - Directory Traversal | custom product designer | 7.5 (v3.1) | High | 340007 |
| CVE-2023-27640 | PrestaShop tshirtecommerce - Directory Traversal | custom product designer | 7.5 (v3.1) | High | 340007 |
| CVE-2023-34092 | Vite Dev Server - Information Exposure | vite | 7.5 (v3.1) | High | 390709 |
| CVE-2023-33629 | H3C Magic R300-2100M - Remote Code Execution | magic r300-2100m firmware | 7.2 (v3.1) | High | 392301 |
| CVE-2023-26842 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-31548 | ChurchCRM v4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2023-2023 | Custom 404 Pro < 3.7.3 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-2256 | WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting | woocommerce-product-addon | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-2518 | WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting | easy forms for mailchimp | 6.1 (v3.1) | Medium | 347198 , 377360 |
| CVE-2022-24627 | AudioCodes Device Manager Express - SQL Injection | device manager express | 9.8 (v3.1) | Critical | 340145 , 340156 , 390572 |
| CVE-2023-2948 | OpenEMR < 7.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium | 344363 , 346755 |
| CVE-2023-2949 | OpenEMR < 7.0.1 - Cross-site Scripting | openemr | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2023-33439 | Faculty Evaluation System v1.0 - SQL Injection | faculty evaluation system | 7.2 (v3.1) | High | 340157 , 340159 , 360147 , 360148 |
| CVE-2023-2734 | MStore API <= 3.9.1 - Authentication Bypass | mstore api | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-33338 | Old Age Home Management System v1.0 - SQL Injection | old age home management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 390572 |
| CVE-2023-33362 | Piwigo 13.6.0 - SQL Injection | piwigo | 9.8 (v3.1) | Critical | 390727 , 392301 , 392648 |
| CVE-2023-27922 | Newsletter < 7.6.9 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-2822 | Ellucian Ethos Identity CAS - Cross-Site Scripting | ethos identity | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-30868 | Tree Page View Plugin < 1.6.7 - Cross-Site Scripting | cms tree page view | 6.1 (v3.1) | Medium | 341266 |
| CVE-2023-2780 | Mlflow <2.3.1 - Local File Inclusion Bypass | mlflow | 9.8 (v3.1) | Critical | 398008 |
| CVE-2023-2766 | Weaver OA 9.5 - Information Disclosure | weaver office automation | 7.5 (v3.1) | High | 390716 |
| CVE-2023-2745 | WordPress Core <=6.2 - Directory Traversal | WordPress | 5.4 (v3.1) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2023-29439 | FooGallery plugin <= 2.2.35 - Cross-Site Scripting | foogallery | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2023-0600 | WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection | wp visitor statistics | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-1835 | Ninja Forms < 3.6.22 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium | 347198 |
| CVE-2023-1890 | Tablesome < 1.0.9 - Cross-Site Scripting | tablesome | 6.1 (v3.1) | Medium | 340148 , 341266 |
| CVE-2023-2009 | Pretty Url <= 1.5.4 - Cross-Site Scripting | pretty url | 4.8 (v3.1) | Medium | 377360 |
| CVE-2023-30192 | PrestaShop 'possearchproducts' <= 1.7 - SQL Injection | possearchproducts | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-2648 | Weaver E-Office 9.5 - Remote Code Execution | e-office | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2023-30256 | Webkul QloApps 1.5.2 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 346755 , 347198 |
| CVE-2023-30194 | Prestashop posstaticfooter <= 1.0.0 - SQL Injection | poststaticfooter | 9.8 (v3.1) | Critical | 341245 , 344366 |
| CVE-2023-30777 | Advanced Custom Fields < 6.1.6 - Cross-Site Scripting | advanced custom fields | 6.1 (v3.1) | Medium | 333141 , 347198 |
| CVE-2023-1408 | Video List Manager <= 1.7 - SQL Injection | video list manager | 7.2 (v3.1) | High | 380122 |
| CVE-2023-0514 | Membership Database <= 1.0 - Cross-Site Scripting | membership database | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2023-0948 | WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-30013 | TOTOLink - Unauthenticated Command Injection | x5000r firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-32235 | Ghost CMS < 5.42.1 - Path Traversal | ghost | 7.5 (v3.1) | High | 390703 |
| CVE-2023-29827 | Embedded JavaScript(EJS) 3.1.6 - Template Injection | ejs | 9.8 (v3.1) | Critical | 340014 , 340193 , 344370 , 345240 , 380026 |
| CVE-2023-25826 | OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection | opentsdb | 9.8 (v3.1) | Critical | 340029 , 344363 , 390722 |
| CVE-2023-1730 | SupportCandy < 3.1.5 - Unauthenticated SQL Injection | supportcandy | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2023-2479 | Appium Desktop Server - Remote Code Execution | appium-desktop | 9.8 (v3.1) | Critical | 342259 |
| CVE-2023-30869 | Easy Digital Downloads - Privilege Escalation | easy digital downloads | 9.8 (v3.1) | Critical | 377360 |
| CVE-2023-1546 | MyCryptoCheckout < 2.124 - Cross-Site Scripting | mycryptocheckout | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-30943 | Moodle - Cross-Site Scripting/Remote Code Execution | moodle | 5.3 (v3.1) | Medium | 333141 , 340007 , 340099 , 340147 , 340148 , 340149 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-2356 | Mlflow <2.3.0 - Local File Inclusion | mlflow | 7.5 (v3.1) | High | 340007 |
| CVE-2023-29489 | cPanel < 11.109.9999.116 - Cross-Site Scripting | cpanel | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 |
| CVE-2023-30210 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2023-30212 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26947 | Odoo <= 15.0 - Cross-Site Scripting | odoo | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 |
| CVE-2023-25346 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-26843 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium | 333141 |
| CVE-2023-1020 | Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection | wp live chat shoutbox | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2023-31059 | Repetier Server - Directory Traversal | repetier-server | 7.5 (v3.1) | High | 344365 , 347019 |
| CVE-2023-1892 | Sidekiq < 7.0.8 - Cross-Site Scripting | sidekiq | 9.6 (v3.1) | Critical | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-27350 | PaperCut - Unauthenticated Remote Code Execution | papercut mf | 9.8 (v3.1) | Critical | 390727 , 392648 |
| CVE-2023-29887 | Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion | spreadsheet-reader | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-45836 | WordPress Download Manager <= 3.2.59 - Reflected XSS | download manager | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2023-2130 | Purchase Order Management v1.0 - SQL Injection | purchase order management system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-34128 | GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) | positions | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-34127 | GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin | manageentities | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2022-38840 | Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) | man-eam-0003 | 7.5 (v3.1) | High | 344360 , 344370 , 344372 , 380018 |
| CVE-2022-34125 | GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin | cmdb | 6.5 (v3.1) | Medium | 340007 , 344360 |
| CVE-2023-29506 | XWiki >= 13.10.8 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-43128 | Dreamer CMS v4.0.0 - SQL Injection | - | N/A | N/A | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-48178 | X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) | x2crm | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 390585 |
| CVE-2022-47501 | Apache OFBiz < 18.12.07 - Local File Inclusion | ofbiz | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2023-29623 | Purchase Order Management v1.0 - Cross Site Scripting (Reflected) | purchase order management | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 342259 , 346755 |
| CVE-2023-2059 | DedeCMS 5.7.87 - Directory Traversal | dedecms | 5.3 (v3.1) | Medium | 340007 , 347019 |
| CVE-2023-26067 | Lexmark Printers - Command Injection | cxtpc firmware | 8.1 (v3.1) | High | 392301 |
| CVE-2023-1880 | Phpmyfaq v3.1.11 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-27167 | Suprema BioStar 2 v2.8.16 - SQL Injection | biostar 2 | 6.5 (v3.1) | Medium | 330791 , 340152 , 341145 , 380026 , 380122 |
| CVE-2023-27008 | ATutor < 2.2.1 - Cross Site Scripting | atutor | 6.1 (v3.1) | Medium | 344363 , 346755 , 350148 |
| CVE-2023-27847 | PrestaShop xipblog - SQL Injection | xipblog | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2023-26802 | DCBI-Netlog-LAB v1.0 - Command Injection | dcbi-netlog-lab firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2023-1177 | Mlflow <2.2.1 - Local File Inclusion | mlflow | 9.8 (v3.1) | Critical | 398008 |
| CVE-2023-27034 | Jms Blog - SQL Injection | jms blog | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-26360 | Adobe ColdFusion - Local File Read | coldfusion | 8.6 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2023-24367 | Temenos T24 R20 - Cross-Site Scripting | t24 | 6.1 | Medium | 341266 |
| CVE-2023-27637 | PrestaShop tshirtecommerce Module - SQL Injection | custom product designer | 9.8 (v3.1) | Critical | 341245 , 344366 , 380026 , 380122 |
| CVE-2023-27638 | tshirtecommerce PrestaShop Module - SQL Injection | prestashop | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2023-28665 | Woo Bulk Price Update <2.2.2 - Cross-Site Scripting | bulk price update for woocommerce | 5.4 (v3.1) | Medium | 347198 |
| CVE-2023-0630 | Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection | slimstat analytics | 8.8 (v3.1) | High | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2023-24278 | Squidex <7.4.0 - Cross-Site Scripting | squidex | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2023-1454 | Jeecg-boot 3.5.0 qurestSql - SQL Injection | jeecg boot | 9.8 (v3.1) | Critical | 340157 , 340159 , 360147 , 360148 |
| CVE-2023-25280 | D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection | dir820la1 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2023-1389 | TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection | archer-ax21 | 8.8 (v3.1) | High | 393655 |
| CVE-2023-28343 | Altenergy Power Control Software C1.2.5 - Remote Command Injection | energy communication unit firmware | 9.8 (v3.1) | Critical | 344364 |
| CVE-2023-0037 | WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection | map builder for google maps | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-31474 | BackupBuddy - Local File Inclusion | backupbuddy | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-1315 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-1317 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2023-1318 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-24657 | phpIPAM - 1.6 - Cross-Site Scripting | phpipam | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-1211 | phpIPAM 1.5.1 - SQL Injection | phpipam | 7.2 (v3.1) | High | 341245 , 344366 , 344370 , 380026 , 380122 |
| CVE-2022-4328 | WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload | woocommerce checkout field manager | 9.8 (v3.1) | Critical | 382238 |
| CVE-2023-24733 | PMB 7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2023-24737 | PMB v7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2023-27641 | L-Soft LISTSERV 16.5 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0968 | WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting | watu quiz | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-26256 | STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion | stagil navigation | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-1080 | WordPress GN Publisher <1.5.6 - Cross-Site Scripting | gn publisher | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-0334 | ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting | shortpixel adaptive images | 6.1 (v3.1) | Medium | 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2023-26035 | ZoneMinder Snapshots - Command Injection | zoneminder | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2023-0961 | Music Gallery Site v1.0 - SQL Injection on page view_music_details.php | music gallery site | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0962 | Music Gallery Site v1.0 - SQL Injection on page Master.php | music gallery site | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2023-23063 | Cellinx NVT Web Server - Local File Disclosure | nvt web server | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2023-0938 | Music Gallery Site v1.0 - SQL Injection on music_list.php | music gallery site | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2022-4897 | WordPress BackupBuddy <8.8.3 - Cross Site Scripting | backupbuddy | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2023-0942 | WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-32853 | Erxes <0.23.0 - Cross-Site Scripting | erxes | 9.6 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0915 | Auto Dealer Management System v1.0 - SQL Injection on manage_user.php | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0916 | Auto Dealer Management System 1.0 - Broken Access Control Exploit | auto dealer management system | 8.8 (v3.1) | High | 345493 |
| CVE-2023-0903 | Employee Task Management System v1.0 - SQL Injection on edit-task.php | employee task management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2023-0904 | Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?) | employee task management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2023-0912 | Auto Dealer Management System v1.0 - SQL Injection | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0913 | Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php | auto dealer management system | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2023-0905 | Employee Task Management System v1.0 - Broken Authentication | employee task management system | 7.5 (v3.1) | High | 344365 , 344370 , 345493 , 350147 |
| CVE-2023-0902 | Employee Task Management System v1.0 - SQL Injection on edit-task.php | simple food ordering system | 5.4 (v3.1) | Medium | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-40032 | Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) | simple task managing system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 345493 , 360147 , 360148 , 380026 , 380122 , 390572 , 393655 |
| CVE-2022-40347 | Intern Record System v1.0 - SQL Injection (Unauthenticated) | intern record system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390572 , 393655 |
| CVE-2022-47986 | IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution | linux kernel | 9.8 (v3.1) | Critical | 344364 , 344370 |
| CVE-2022-48323 | Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution | sunflower | 9.8 (v3.1) | Critical | 392301 |
| CVE-2023-25717 | Ruckus Wireless Admin - Remote Code Execution | ruckus wireless admin | 9.8 (v3.1) | Critical | 344363 , 393655 |
| CVE-2023-0261 | WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection | wp tripadvisor review slider | 8.8 (v3.1) | High | 340016 , 380122 |
| CVE-2023-0159 | Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE | extensive vc addons for wpbakery page builder | 7.5 (v3.1) | High | 340077 , 344360 , 381206 |
| CVE-2023-0099 | Simple URLs < 115 - Cross Site Scripting | simple urls | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-45699 | APsystems ECU-R Firmware - Command Injection | ecu-r firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2023-23161 | Art Gallery Management System Project v1.0 - Cross-Site Scripting | art gallery management system | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2023-24322 | mojoPortal 2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-23333 | SolarView Compact 6.00 - OS Command Injection | solarview compact firmware | 9.8 (v3.1) | Critical | 344361 , 344363 , 390613 , 390614 |
| CVE-2023-0669 | Fortra GoAnywhere MFT - Remote Code Execution | goanywhere managed file transfer | 7.2 (v3.1) | High | 344370 |
| CVE-2022-4321 | PDF Generator for WordPress < 1.1.2 - Cross Site Scripting | pdf generator for wordpress | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-0236 | WordPress Tutor LMS <2.0.10 - Cross Site Scripting | tutor lms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 |
| CVE-2023-0676 | phpIPAM 1.5.1 - Cross-site Scripting | phpipam | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2023-25135 | vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution | vbulletin | 9.8 (v3.1) | Critical | 344365 , 390614 |
| CVE-2022-46552 | D-Link DIR-846 - Remote Command Execution (RCE) vulnerability | dir-846 firmware | 8.8 (v3.1) | High | 330791 , 340152 , 381237 |
| CVE-2022-2546 | WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting | all-in-one wp migration | 4.7 (v3.1) | Medium | 377360 |
| CVE-2022-45297 | EQ Enterprise management system v2.2.0 - SQL Injection | eq | 9.8 (v3.1) | Critical | 334168 , 341245 , 344370 |
| CVE-2022-4306 | WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting | panda pods repeater field | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2023-0562 | Bank Locker Management System v1.0 - SQL Injection | bank locker management system | 9.8 (v3.1) | Critical | 340156 , 341145 |
| CVE-2023-0563 | Bank Locker Management System - Cross-Site Scripting | bank locker management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-48012 | OpenCATS 0.9.7 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2023-0527 | Online Security Guards Hiring System - Cross-Site Scripting | online security guards hiring system | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-45808 | LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi | learnpress | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-47615 | LearnPress Plugin < 4.2.0 - Local File Inclusion | learnpress | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 |
| CVE-2023-0448 | WP Helper Lite < 4.3 - Cross-Site Scripting | wp helper premium | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2023-23488 | WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection | paid memberships pro | 9.8 (v3.1) | Critical | 380122 |
| CVE-2023-23489 | WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection | easy digital downloads | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2023-23492 | Login with Phone Number - Cross-Site Scripting | login with phone number | 8.8 (v3.1) | High | 346755 , 347198 |
| CVE-2022-41441 | ReQlogic v11.3 - Cross Site Scripting | reqlogic | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2023-23491 | Quick Event Manager < 9.7.5 - Cross-Site Scripting | quick event manager | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2023-0126 | SonicWall SMA1000 LFI | sma1000 | 7.5 (v3.1) | High | 347009 |
| CVE-2022-46888 | NexusPHP <1.7.33 - Cross-Site Scripting | nexusphp | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2022-39195 | LISTSERV 17 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-4060 | WordPress User Post Gallery <=2.19 - Remote Code Execution | user post gallery | 9.8 (v3.1) | Critical | 340087 , 344360 , 347009 |
| CVE-2022-4447 | WordPress Fontsy <=1.8.6 - SQL Injection | fontsy | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-4295 | Show all comments < 7.0.1 - Cross-Site Scripting | show all comments | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-4320 | WordPress Events Calendar <1.4.5 - Cross-Site Scripting | wordpress events calendar plugin | 6.1 (v3.1) | Medium | 340748 , 341266 , 346755 , 347006 |
| CVE-2023-0297 | PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE) | pyload | 9.8 (v3.1) | Critical | 340095 |
| CVE-2022-38467 | CRM Perks Forms < 1.1.1 - Cross Site Scripting | crm perks forms | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 , 390720 |
| CVE-2022-4301 | WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-4325 | WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting | post status notifier lite | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-44877 | Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) | webpanel | 9.8 (v3.1) | Critical | 344364 , 344366 , 393655 |
| CVE-2023-22463 | KubePi JwtSigKey - Admin Authentication Bypass | kubepi | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-38627 | Nortek Linear eMerge E3-Series - SQL Injection | emerge e3 firmware | 9.8 (v3.1) | Critical | 334073 , 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-4059 | Cryptocurrency Widgets Pack < 2.0 - SQL Injection | cryptocurrency widgets pack | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-4140 | WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access | welcart e-commerce | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2022-48197 | Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting | yui | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-4260 | WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting | wp-ban | 4.8 (v3.1) | Medium | 377360 |
| CVE-2021-45467 | Control Web Panel (CWP) - File Inclusion | webpanel | 9.8 (v3.1) | Critical | 320464 , 320465 , 390613 , 390614 |
| CVE-2022-4117 | WordPress IWS Geo Form Fields <=1.0 - SQL Injection | iws-geo-form-fields | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-30134 | Php-mod/curl Library <2.3.2 - Cross-Site Scripting | php curl class | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-42953 | ZKTeco ZEM/ZMM 8.88 - Missing Authentication | zmm200 firmware | 7.5 (v3.1) | High | 345493 |
| CVE-2022-47945 | Thinkphp Lang - Local File Inclusion | thinkphp | 9.8 (v3.1) | Critical | 340007 |
| CVE-2022-23854 | AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion | intouch access anywhere | 7.5 (v3.1) | High | 390716 |
| CVE-2022-4050 | WordPress JoomSport <5.2.8 - SQL Injection | joomsport | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-44588 | Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection | cryptocurrency widgets pack | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-46071 | Helmet Store Showroom v1.0 - SQL Injection | helmet store showroom site | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2022-46443 | Bangresto - SQL Injection | bangresto | 8.8 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-46073 | Helmet Store Showroom - Cross Site Scripting | helmet store showroom | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-3590 | WordPress <= 6.2 - Server Side Request Forgery | WordPress | 5.9 (v3.1) | Medium | 398001 |
| CVE-2022-4223 | pgAdmin < 6.17 - Unauthenticated Remote Code Execution | pgadmin 4 | 8.8 (v3.1) | High | 393655 |
| CVE-2022-46381 | Linear eMerge E3-Series - Cross-Site Scripting | linear emerge e3 access control firmware | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-3982 | WordPress Booking Calendar <3.2.2 - Arbitrary File Upload | booking calendar | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-3908 | WordPress Helloprint <1.4.7 - Cross-Site Scripting | helloprint | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3933 | WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting | essential real estate | 5.4 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3934 | WordPress FlatPM <3.0.13 - Cross-Site Scripting | flat pm | 5.4 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-41800 | F5 BIG-IP Appliance Mode - Command Injection | big-ip access policy manager | 8.7 (v3.1) | High | 344362 , 344363 |
| CVE-2022-35507 | Proxmox - CRLF Injection | proxmox mail gateway | 7.1 (v3.1) | High | 390714 |
| CVE-2022-44290 | WebTareas 2.4p5 - SQL Injection | webtareas | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-44291 | WebTareas 2.4p5 - SQL Injection | webtareas | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-41412 | perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery | perfsonar | 8.6 (v3.1) | High | 340007 |
| CVE-2022-3768 | WordPress WPSmartContracts <1.3.12 - SQL Injection | wpsmartcontracts | 8.8 (v3.1) | High | 340016 , 380026 , 380122 |
| CVE-2022-41840 | Welcart eCommerce <=2.7.7 - Local File Inclusion | welcart e-commerce | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-40881 | SolarView 6.00 - Remote Command Execution | solarview compact | 9.8 (v3.1) | Critical | 340029 , 344360 , 344370 , 393655 |
| CVE-2022-3980 | Sophos Mobile managed on-premises - XML External Entity Injection | mobile | 9.8 (v3.1) | Critical | 344372 |
| CVE-2022-42118 | Liferay Portal - Cross-site Scripting | liferay portal | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2022-40843 | Tenda AC1200 V-W15Ev2 - Authentication Bypass | ac1200 v-w15ev2 | 4.9 (v3.1) | Medium | 390716 |
| CVE-2021-40272 | IRTS OP5 Monitor - Cross-Site Scripting | monitor | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-3484 | WordPress WPB Show Core - Cross-Site Scripting | wpb show core | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-3578 | WordPress ProfileGrid <5.1.1 - Cross-Site Scripting | profilegrid | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-44727 | PrestaShop lgcookieslaw - SQL Injection | eu cookie law gdpr | 9.1 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-3481 | NotificationX Dropshipping < 4.4 - SQL Injection | woocommerce dropshipping | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2022-42746 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42747 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42748 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-42749 | CandidATS 3.0.0 - Cross-Site Scripting | candidats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-3800 | IBAX - SQL Injection | go-ibax | 8.8 (v3.1) | High | 344366 |
| CVE-2022-3254 | AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection | awp classifieds | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 |
| CVE-2021-40661 | IND780 - Local File Inclusion | ind780 firmware | 7.5 (v3.1) | High | 340007 , 390716 |
| CVE-2022-2627 | WordPress Newspaper < 12 - Cross-Site Scripting | newspaper | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-3766 | phpMyFAQ < 3.1.8 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-31678 | VMWare Cloud Foundation NSX-V - XML External Entity (XXE) | cloud foundation | 9.1 (v3.1) | Critical | 344372 |
| CVE-2022-38580 | X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) | skipper | 9.8 (v3.1) | Critical | 337110 , 390727 , 392301 , 392648 , 398022 |
| CVE-2022-41358 | Garage Management System 1.0 (categoriesName) - Stored XSS | garage management system | 5.4 (v3.1) | Medium | 330791 , 340152 |
| CVE-2022-43014 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-43015 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-43016 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-43017 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-43018 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2022-22242 | Juniper Web Device Manager - Cross-Site Scripting | junos | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-3552 | BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) | boxbilling | 7.2 (v3.1) | High | 340128 , 380018 |
| CVE-2022-3506 | WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting | related posts | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-41473 | RPCMS 3.0.2 - Cross-Site Scripting | rpcms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350148 |
| CVE-2022-35155 | Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) | bus pass management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 390585 |
| CVE-2022-3062 | Simple File List < 4.4.12 - Cross Site Scripting | simple-file-list | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2022-38553 | Academy Learning Management System <5.9.1 - Cross-Site Scripting | academy learning management system | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-3236 | Sophos Firewall <= 19.0 MR1 - Remote Code Execution | firewall | 9.8 (v3.1) | Critical | 344361 , 344364 |
| CVE-2022-40359 | Kae's File Manager <=1.4.7 - Cross-Site Scripting | kfm | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2022-3242 | Microweber <1.3.2 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-2840 | Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi | zephyr project manager | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 341155 , 360147 , 360148 , 380122 |
| CVE-2022-35914 | GLPI <=10.0.2 - Remote Command Execution | glpi | 9.8 (v3.1) | Critical | 340023 , 344360 |
| CVE-2022-3142 | NEX-Forms Plugin < 7.9.7 - SQL Injection | nex-forms | 8.8 (v3.1) | High | 380122 |
| CVE-2022-2863 | WordPress WPvivid Backup <0.9.76 - Local File Inclusion | migration, backup, staging | 4.9 (v3.1) | Medium | 377360 |
| CVE-2022-40734 | Laravel Filemanager v2.5.1 - Local File Inclusion | laravel filemanager | 6.5 (v3.1) | Medium | 340007 |
| CVE-2022-38637 | Hospital Management System 1.0 - SQL Injection | hospital management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-38295 | Cuppa CMS v1.0 - Cross Site Scripting | cuppacms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-37299 | Shirne CMS 1.2.0 - Local File Inclusion | shirne cms | 6.5 (v3.1) | Medium | 340077 , 340162 , 340165 , 344360 , 347009 |
| CVE-2022-27593 | QNAP QTS Photo Station External Reference - Local File Inclusion | photo station | 9.1 (v3.1) | Critical | 340007 |
| CVE-2022-2633 | All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery | all-in-one video gallery | 8.2 (v3.1) | High | 340163 |
| CVE-2022-36642 | Omnia MPX 1.5.0+r1 - Local File Inclusion | omnia mpx node firmware | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 |
| CVE-2022-37122 | Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal | pcoweb hvac bacnet gateway | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-38812 | AeroCMS 0.1.1 - SQL Injection | aerocms | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2022-22897 | PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection | ap pagebuilder | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 , 380026 , 380122 |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS - Remote Command Execution | hwl-2511-ss firmware | 9.8 (v3.1) | Critical | 344360 , 347009 , 390904 |
| CVE-2022-2599 | WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting | anti-malware security and brute-force firewall | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2022-38794 | Zaver - Local File Inclusion | zaver | 7.5 (v3.1) | High | 347009 |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection | emerge e3 firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2022-31798 | Nortek Linear eMerge E3-Series - Cross-Site Scripting | emerge e3 firmware | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-37153 | Artica Proxy 4.30.000000 - Cross-Site Scripting | artica proxy | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2022-38463 | ServiceNow - Cross-Site Scripting | servicenow | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-24910 | WordPress Transposh Translation <1.0.8 - Cross-Site Scripting | transposh wordpress translation | 6.1 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2022-2383 | WordPress Feed Them Social <3.0.1 - Cross-Site Scripting | feed them social | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32772 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium | 333140 , 340147 , 341266 , 342259 |
| CVE-2022-37042 | Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution | collaboration | 9.8 (v3.1) | Critical | 340007 , 390614 , 390626 |
| CVE-2022-2733 | Openemr < 7.0.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-35493 | eShop 3.0.4 - Cross-Site Scripting | eshop - ecommerce / store website | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-1950 | Youzify < 1.2.0 - Unauthenticated SQLi | youzify | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-31181 | PrestaShop - SQL Injection to Eval Injection | prestashop | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 344362 , 360147 , 360148 , 390704 |
| CVE-2022-31188 | CVAT 2.0 - Server Side Request Forgery | computer vision annotation tool | 9.8 (v3.1) | Critical | 345493 |
| CVE-2022-1906 | WordPress Copyright Proof <=4.16 - Cross-Site-Scripting | copyright proof | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2414 | FreeIPA - XML Entity Injection | dogtagpki | 7.5 (v3.1) | High | 344372 |
| CVE-2022-34140 | Feehi CMS 2.1.1 - Remote Code Execution (Authenticated) | feehi cms | 5.4 (v3.1) | Medium | 330791 , 340152 , 345493 |
| CVE-2022-34121 | CuppaCMS v1.0 - Local File Inclusion | cuppacms | 7.5 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-33965 | WordPress Visitor Statistics <=5.7 - SQL Injection | wp visitor statistics | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-36446 | Webmin <1.997 - Authenticated Remote Code Execution | webmin | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-2219 | Unyson < 2.7.27 - Cross Site Scripting | unyson | 7.2 (v3.1) | High | 341266 , 346755 |
| CVE-2022-0899 | Header Footer Code Manager < 1.1.24 - Cross-Site Scripting | header footer code manager | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-35653 | Moodle LTI module Reflected - Cross-Site Scripting | moodle | 6.1 (v3.1) | Medium | 333141 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-33901 | WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read | multisafepay plugin for woocommerce | 7.5 (v3.1) | High | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2022-29495 | WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery | popup builder | 4.3 (v3.1) | Medium | 345490 , 377360 |
| CVE-2022-28666 | Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update | custom product tabs for woocommerce | 5.3 (v3.1) | Medium | 392301 |
| CVE-2022-2486 | Wavlink WN535K2/WN535K3 - OS Command Injection | wl-wn535k2 | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 , 344370 |
| CVE-2022-2488 | Wavlink WN535K2/WN535K3 - OS Command Injection | wl-wn535k2 firmware | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 |
| CVE-2022-34045 | WAVLINK WN530HG4 - Improper Access Control | wl-wn530hg4 firmware | 9.8 (v3.1) | Critical | 390716 |
| CVE-2022-34590 | Hospital Management System 1.0 - SQL Injection | hospital management system | 7.2 (v3.1) | High | 340145 , 340156 |
| CVE-2022-34048 | Wavlink WN-533A8 - Cross-Site Scripting | wn533a8 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2022-2467 | Garage Management System 1.0 - SQL Injection | garage management system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-35405 | Zoho ManageEngine - Remote Code Execution | manageengine access manager plus | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-33891 | Apache Spark UI - Remote Command Injection | spark | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2021-40150 | Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure | e1 zoom firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2022-1933 | WordPress CDI <5.1.9 - Cross Site Scripting | collect and deliver interface for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2168 | WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting | download manager | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 |
| CVE-2022-2187 | WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting | contact form 7 captcha | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-40149 | Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure | e1 zoom | 5.9 (v3.1) | Medium | 390716 |
| CVE-2022-32409 | Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion | i3geo | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-34093 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-34094 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-1057 | WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection | pricing deals for woocommerce | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2022-1952 | WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload | free booking plugin for hotels, restaurant and car rental | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-1910 | WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting | shortcodes and extra features for phlox theme | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1937 | WordPress Awin Data Feed <=1.6 - Cross-Site Scripting | awin data feed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-35416 | H3C SSL VPN <=2022-07-10 - Cross-Site Scripting | ssl vpn | 6.1 (v3.1) | Medium | 342259 , 346755 |
| CVE-2022-31137 | Roxy-WI < 6.1.1.0 - Remote Code Execution | roxy-wi | 9.8 (v3.1) | Critical | 340023 , 340029 , 344360 , 344361 , 344363 |
| CVE-2022-0250 | Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting | redirection for contact form 7 | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1946 | WordPress Gallery <2.0.0 - Cross-Site Scripting | gallery | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-2290 | Trilium <0.52.4 - Cross-Site Scripting | trilium | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2022-32094 | Hospital Management System 1.0 - SQL Injection | hospital management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-31056 | GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration) | glpi | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-41460 | ECShop 4.1.0 - SQL Injection | ecshop | 7.5 (v3.1) | High | 340157 , 340159 , 360147 , 360148 |
| CVE-2022-1574 | WordPress HTML2WP <=1.0.0 - Arbitrary File Upload | html2wp | 9.8 (v3.1) | Critical | 382238 |
| CVE-2022-1904 | WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting | easy pricing tables | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1916 | WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting | woot | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-1029 | Limit Login Attempts - Stored Cross-Site Scripting | limit login attempts | 4.8 (v3.1) | Medium | 377360 |
| CVE-2022-34305 | Apache Tomcat Examples Web Application - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-34328 | PMB 7.3.10 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29299 | SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting | solarview compact firmware | N/A | N/A | 341266 |
| CVE-2022-29301 | SolarView Compact 6.00 - 'pow' Cross-Site Scripting | - | N/A | N/A | 341266 |
| CVE-2022-2174 | microweber 1.2.18 - Cross-site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-31373 | SolarView Compact 6.00 - Cross-Site Scripting | sv-cpt-mc310 firmware | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-33119 | NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting | nvrsolo firmware | 6.1 (v3.1) | Medium | 340003 , 340158 , 342259 |
| CVE-2021-25104 | WordPress Ocean Extra <1.9.5 - Cross-Site Scripting | ocean extra | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2022-2130 | Microweber < 1.2.17 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-31062 | GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion | glpi inventory | 5.3 (v3.1) | Medium | 340007 , 344360 |
| CVE-2022-31299 | Haraj 3.7 - Cross-Site Scripting | haraj | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2022-0786 | WordPress KiviCare <2.3.9 - SQL Injection | kivicare | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0827 | WordPress Best Books <=2.6.3 - SQL Injection | bestbooks | 9.8 (v3.1) | Critical | 340156 , 380122 |
| CVE-2022-1768 | WordPress RSVPMaker <=9.3.2 - SQL Injection | rsvpmaker | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2022-1724 | WordPress Simple Membership <4.1.1 - Cross-Site Scripting | simple membership | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1756 | Newsletter < 7.4.5 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-41749 | CraftCMS SEOmatic - Server-Side Template Injection | seomatic | 9.8 (v3.1) | Critical | 390719 |
| CVE-2022-29013 | Razer Sila Gaming Router - Remote Code Execution | sila | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-29014 | Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion | sila firmware | 7.5 (v3.1) | High | 344360 |
| CVE-2022-32195 | Open edX <2022-06-06 - Cross-Site Scripting | open edx | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2022-0788 | WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection | wp fundraising donation and crowdfunding platform | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 , 390727 , 392648 |
| CVE-2022-1597 | WordPress WPQA <5.4 - Cross-Site Scripting | wpqa builder | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-37589 | Virtua Software Cobranca 12S - SQLi | cobranca | 7.5 (v3.1) | High | 340156 , 341145 , 341245 |
| CVE-2022-31470 | Axigen WebMail - Cross-Site Scripting | webmail | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-29296 | Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS) | genialcloud proj | 6.1 (v3.1) | Medium | 344370 |
| CVE-2022-26134 | Confluence - Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical | 337209 , 337211 , 340087 |
| CVE-2022-31340 | simple inventory system SQL Injection Vulnerability | simple inventory system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-31976 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31977 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31978 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2022-31339 | simple inventory system SQL Injection Vulnerability | simple inventory system | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2022-31974 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-31975 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-31984 | Online Fire Reporting System v1.0 - SQL injection | online fire reporting system | 7.2 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2022-32007 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32015 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32018 | Complete Online Job Search System 1.0 - SQL Injection | complete online job search system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32022 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340156 |
| CVE-2022-32024 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-32025 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32026 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-32028 | Car Rental Management System 1.0 - SQL Injection | car rental management system | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-30513 | School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting | school dormitory management system | 6.1 (v3.1) | Medium | 392301 |
| CVE-2022-30514 | School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting | school dormitory management system | 6.1 (v3.1) | Medium | 346755 , 392301 |
| CVE-2022-26833 | Open Automation Software OAS Platform V16.00.0121 - Missing Authentication | oas platform | 9.4 (v3.1) | Critical | 390726 , 392647 |
| CVE-2022-1883 | Terraboard <2.2.0 - SQL Injection | terraboard | 8.8 (v3.1) | High | 341245 |
| CVE-2022-0781 | WordPress Nirweb Support <2.8.2 - SQL Injection | nirweb support | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0346 | WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution | xml sitemap generator | 6.1 (v3.1) | Medium | 333141 , 340165 , 341256 , 342259 , 344370 , 346755 , 347198 , 350148 |
| CVE-2022-1221 | WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting | gwyn's imagemap selector | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29004 | Diary Management System 1.0 - Cross-Site Scripting | e-diary management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2022-29005 | Online Birth Certificate System 1.2 - Stored Cross-Site Scripting | online birth certificate system | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-0867 | WordPress ARPrice <3.6.1 - SQL Injection | pricing table | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1398 | External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery | external media without import | 6.5 (v3.1) | Medium | 377360 |
| CVE-2022-30776 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 |
| CVE-2022-30777 | Parallels H-Sphere 3.6.1713 - Cross-Site Scripting | h-sphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0873 | WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting | gmedia gallery | 4.8 (v3.1) | Medium | 377360 |
| CVE-2022-29383 | NETGEAR ProSafe SSL VPN firmware - SQL Injection | ssl312 firmware | 9.8 (v3.1) | Critical | 340156 , 341145 , 341245 |
| CVE-2022-30489 | Wavlink WN-535G3 - Cross-Site Scripting | wn535g3 firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-29303 | SolarView Compact 6.0 - OS Command Injection | sv-cpt-mc310 firmware | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 393655 |
| CVE-2022-30525 | Zyxel Firewall - OS Command Injection | usg flex 100w firmware | 9.8 (v3.1) | Critical | 344363 |
| CVE-2022-29298 | SolarView Compact 6.00 - Local File Inclusion | sv-cpt-mc310 firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2022-29006 | Directory Management System 1.0 - SQL Injection | directory management system | 9.8 (v3.1) | Critical | 340145 , 340156 |
| CVE-2022-29007 | Dairy Farm Shop Management System 1.0 - SQL Injection | dairy farm shop management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-29316 | Complete Online Job Search System 1.0 - Cross-Site Scripting | complete online job search system | 9.8 (v3.1) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2022-1453 | RSVPMaker <= 9.2.5 - SQL Injection | rsvpmaker | 7.5 (v3.1) | High | 340016 , 341245 , 380026 , 380122 |
| CVE-2022-0592 | MapSVG < 6.2.20 - Unauthenticated SQLi | mapsvg | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2022-0814 | Ubigeo de Peru < 3.6.4 - SQL Injection | ubigeo de peru para woocommerce | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0817 | WordPress BadgeOS <=3.7.0 - SQL Injection | badgeos | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2022-0826 | WordPress WP Video Gallery <=1.7.1 - SQL Injection | wp-video-gallery-free | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0948 | WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection | order listener for woocommerce | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-1013 | WordPress Personal Dictionary <1.3.4 - Blind SQL Injection | personal dictionary | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-27412 | Explore CMS 1.0 - SQL Injection | explore cms | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 390572 |
| CVE-2022-24899 | Contao <4.13.3 - Cross-Site Scripting | contao | 6.1 (v3.1) | Medium | 341266 |
| CVE-2022-1388 | F5 BIG-IP iControl - REST Auth Bypass RCE | big-ip access policy manager | 9.8 (v3.1) | Critical | 344361 , 392767 |
| CVE-2022-28079 | College Management System 1.0 - 'course_code' SQL Injection (Authenticated) | college management system | 8.8 (v3.1) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 345493 , 360147 , 360148 , 390572 |
| CVE-2022-28080 | Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated) | event management system | 8.8 (v3.1) | High | 330791 , 340016 , 340017 , 340144 , 340145 , 340152 , 340156 , 340157 , 341145 , 341245 , 345493 , 360147 , 360148 , 390572 |
| CVE-2022-28508 | MantisBT < 2.25.2 - Cross-Site Scripting | mantisbt | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0773 | Documentor <= 1.5.3 - Unauthenticated SQL Injection | documentor | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0783 | Multiple Shipping Address Woocommerce < 2.0 - SQL Injection | multiple shipping addresses for woocommerce | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1281 | Photo Gallery WordPress v1.6.3 - SQL Injection | photo gallery | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 |
| CVE-2021-40822 | Geoserver - Server-Side Request Forgery | geoserver | 7.5 (v3.1) | High | 340007 |
| CVE-2022-24900 | Piano LED Visualizer 1.3 - Local File Inclusion | piano led visualizer | 8.6 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-27984 | Cuppa CMS v1.0 - SQL injection | cuppacms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-27985 | Cuppa CMS v1.0 - SQL injection | cuppacms | 9.8 (v3.1) | Critical | 340017 , 341245 |
| CVE-2022-26564 | HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0693 | WordPress Master Elements <=8.0 - SQL Injection | master elements | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0769 | Users Ultra <= 3.1.0 - SQL Injection | users ultra | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-1390 | WordPress Admin Word Count Column 2.2 - Local File Inclusion | admin word count column | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-1391 | WordPress Cab fare calculator < 1.0.4 - Local File Inclusion | cab fare calculator | 9.8 (v3.1) | Critical | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2022-29078 | Node.js Embedded JavaScript 3.1.6 - Template Injection | ejs | 9.8 (v3.1) | Critical | 340014 , 340193 , 344370 , 345240 , 380026 |
| CVE-2021-25094 | Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution | tatsu | 8.1 (v3.1) | High | 382238 |
| CVE-2021-35250 | SolarWinds Serv-U 15.3 - Directory Traversal | serv-u | 7.5 (v3.1) | High | 340007 |
| CVE-2022-0656 | uDraw <3.3.3 - Local File Inclusion | [web to print shop](vendors/webtoprint/web-to-print-shop.md) | 7.5 (v3.1) | High | 344360 , 390709 |
| CVE-2022-28290 | WordPress Country Selector <1.6.6 - Cross-Site Scripting | wordpress country selector | 6.1 (v3.1) | Medium | 340130 , 346755 |
| CVE-2022-1439 | Microweber <1.2.15 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 346755 , 347198 , 350148 |
| CVE-2022-27926 | Zimbra Collaboration (ZCS) - Cross Site Scripting | collaboration | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-29548 | WSO2 - Cross-Site Scripting | api manager | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-27927 | Microfinance Management System 1.0 - 'customer_number' SQLi | microfinance management system | 9.8 (v3.1) | Critical | 331028 , 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390572 , 393655 |
| CVE-2022-1329 | Elementor Website Builder - Remote Code Execution | website builder | 8.8 (v3.1) | High | 377360 |
| CVE-2022-1119 | WordPress Simple File List <3.2.8 - Local File Inclusion | simple-file-list | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2022-0785 | WordPress Daily Prayer Time <2022.03.01 - SQL Injection | daily prayer time | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-25120 | Easy Social Feed < 6.2.7 - Cross-Site Scripting | easy social feed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-0879 | Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting | caldera forms | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 344361 , 344364 , 346755 , 347198 , 350148 |
| CVE-2022-0765 | WordPress Loco Translate < 2.6.1 - Cross-Site Scripting | loco translate | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-27043 | Yearning - Directory Traversal | yearning | 7.5 (v3.1) | High | 347009 , 347019 , 390709 , 390716 |
| CVE-2021-43287 | Pre-Auth Takeover of Build Pipelines in GoCD | gocd | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-24816 | GeoServer <1.2.2 - Remote Code Execution | jai-ext | 10.0 (v3.1) | Critical | 337209 , 337210 , 337211 , 340121 , 344360 , 344370 , 380026 |
| CVE-2021-31805 | Apache Struts2 S2-062 - Remote Code Execution | struts | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2022-28032 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2022-28033 | Atom.CMS 2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 380026 , 380122 |
| CVE-2021-37291 | KevinLAB BEMS 1.0 - SQL Injection | 4st l-bems | 9.8 (v3.1) | Critical | 340156 , 341245 |
| CVE-2022-0949 | WordPress Stop Bad Bots <6.930 - SQL Injection | block and stop bad bots | 9.8 (v3.1) | Critical | 380122 |
| CVE-2022-22954 | VMware Workspace ONE Access - Server-Side Template Injection | identity manager | 9.8 (v3.1) | Critical | 344360 , 344361 , 344363 , 344370 , 393655 |
| CVE-2021-24987 | WordPress Super Socializer <7.13.30 - Cross-Site Scripting | super socializer | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-0271 | LearnPress <4.1.6 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-1007 | WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting | advanced booking calendar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-28363 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-43421 | Studio-42 elFinder <2.1.60 - Arbitrary File Upload | elfinder | 9.8 (v3.1) | Critical | 393781 |
| CVE-2021-46419 | Telesquare TLR-2855KS6 - Arbitrary File Deletion | tlr-2855ks6 firmware | 9.1 (v3.1) | Critical | 392301 , 393134 |
| CVE-2021-46417 | Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI) | colibri firmware | 7.5 (v3.1) | High | 340007 , 344360 , 347009 |
| CVE-2021-46418 | Telesquare TLR-2855KS6 - Arbitrary File Creation | tlr-2855ks6 | 7.5 (v3.1) | High | 392301 |
| CVE-2022-26585 | Mingsoft MCMS v5.2.7 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340156 , 340157 , 360147 , 360148 |
| CVE-2022-28219 | Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution | manageengine adaudit plus | 9.8 (v3.1) | Critical | 344370 |
| CVE-2022-25356 | Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection | securitygateway | 5.3 (v3.1) | Medium | 390716 |
| CVE-2022-0864 | UpdraftPlus < 1.22.9 - Cross-Site Scripting | updraftplus | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-1168 | WordPress WP JobSearch <1.5.1 - Cross-Site Scripting | jobsearch wp job board | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-1170 | JobMonster < 4.5.2.9 - Cross-Site Scripting | jobmonster | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-26233 | Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion | control room management suite | 7.5 (v3.1) | High | 347019 |
| CVE-2021-26599 | ImpressCMS < 1.4.3 - SQL Injection | impresscms | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-0479 | Popup Builder Plugin - SQL Injection and Cross-Site Scripting | popup builder | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 377360 |
| CVE-2022-0679 | WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion | narnoo distributor | 9.8 (v3.1) | Critical | 344360 , 390709 |
| CVE-2022-0784 | WordPress Title Experiments Free <9.0.1 - SQL Injection | title experiments free | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0787 | Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection | limit login attempts | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0846 | SpeakOut Email Petitions < 2.14.15.1 - SQL Injection | speakout! email petitions | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-26271 | 74cmsSE v3.4.1 - Arbitrary File Read | 74cms | 7.5 (v3.1) | High | 340007 |
| CVE-2021-43725 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2022-0599 | WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting | mapping multiple urls redirect same page | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-4191 | GitLab GraphQL API User Enumeration | gitlab | 5.3 (v3.1) | Medium | 344361 , 344363 |
| CVE-2022-1040 | Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass | sfos | 9.8 (v3.1) | Critical | 345493 |
| CVE-2021-20323 | Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting | keycloak | 6.1 (v3.1) | Medium | 333141 , 341258 |
| CVE-2022-0747 | Infographic Maker iList < 4.3.8 - SQL Injection | infographic maker | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-0760 | WordPress Simple Link Directory <7.7.2 - SQL injection | simple link directory | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2022-26960 | elFinder <=2.1.60 - Local File Inclusion | elfinder | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 , 393781 |
| CVE-2022-23347 | BigAnt Server v5.6.06 - Local File Inclusion | bigant server | 7.5 (v3.1) | High | 340007 |
| CVE-2021-46107 | Ligeo Archives Ligeo Basics - Server Side Request Forgery | ligeo basics | 7.5 (v3.1) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2022-25488 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 |
| CVE-2022-25485 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 7.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-25486 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 7.8 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2022-0954 | Microweber <1.2.11 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-25489 | Atom CMS v2.0 - Cross-Site Scripting | atomcms | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2022-25497 | Cuppa CMS v1.0 - Local File Inclusion | cuppacms | 5.3 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2021-25003 | WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution | wpcargo track & trace | 9.8 (v3.1) | Critical | 331324 |
| CVE-2022-0169 | Photo Gallery by 10Web < 1.6.0 - SQL Injection | photo gallery | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 |
| CVE-2022-0658 | CommonsBooking < 2.6.8 - SQL Injection | commonsbooking | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-24940 | WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting | persian-woocommerce | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0147 | WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting | wp-gdpr-compliance | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-24384 | SmarterTools SmarterTrack - Cross-Site Scripting | smartertrack | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 |
| CVE-2021-24966 | WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) | error log viewer | 4.9 (v3.1) | Medium | 336461 , 344360 , 381206 |
| CVE-2021-32478 | Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect | moodle | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2022-0928 | Microweber < 1.2.12 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-33851 | WordPress Customize Login Image <3.5.3 - Cross-Site Scripting | customize login image | 5.4 (v3.1) | Medium | 377360 |
| CVE-2022-24716 | Icinga Web 2 - Arbitrary File Disclosure | icinga web 2 | 7.5 (v3.1) | High | 347009 |
| CVE-2022-0349 | WordPress NotificationX <2.3.9 - SQL Injection | notificationx | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2022-0434 | WordPress Page Views Count <2.4.15 - SQL Injection | page view count | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-0439 | Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection | email subscribers & newsletters | 8.8 (v3.1) | High | 340016 , 377360 , 380122 |
| CVE-2022-0429 | WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting | wp cerber security, anti-spam & malware scan | 6.1 (v3.1) | Medium | 347198 |
| CVE-2022-0533 | Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2022-0535 | WordPress E2Pdf <1.16.45 - Cross-Site Scripting | e2pdf | 4.8 (v3.1) | Medium | 377360 |
| CVE-2021-46381 | DLINK DAP-1620 A1 v1.01 - Directory Traversal | dap-1620 firmware | 7.5 (v3.1) | High | 344360 , 390709 , 390726 , 392301 , 392647 |
| CVE-2022-23397 | Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting | ez-net portal | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 341256 , 346755 , 347198 |
| CVE-2022-22947 | Spring Cloud Gateway Code Injection | spring cloud gateway | 10.0 (v3.1) | Critical | 344370 , 393655 |
| CVE-2022-23898 | MCMS 5.2.5 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340156 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-25125 | MCMS 5.2.4 - SQL Injection | mcms | 9.8 (v3.1) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2021-4039 | Zyxel NWA-1100-NH - Command Injection | nwa1100-nh firmware | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2021-46387 | Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) | zywall 2 plus internet security appliance firmware | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 |
| CVE-2022-0412 | WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection | ti woocommerce wishlist | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2020-36510 | WordPress 15Zine <3.3.0 - Cross-Site Scripting | 15zine | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-25112 | WordPress WHMCS Bridge <6.4b - Cross-Site Scripting | whmcs bridge | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0189 | WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting | wp rss aggregator | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2022-0377 | WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming | learnpress | 4.3 (v3.1) | Medium | 340007 , 345493 |
| CVE-2021-44567 | RosarioSIS 7.6 - SQL Injection | rosariosis | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-25082 | TOTOLink - Unauthenticated Command Injection | a950rg firmware | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2020-27467 | Processwire CMS <2.7.1 - Local File Inclusion | processwire | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2022-0653 | Wordpress Profile Builder Plugin Cross-Site Scripting | profile builder | 6.1 (v3.1) | Medium | 340112 |
| CVE-2021-25082 | WordPress Popup Builder < 4.0.7 - Remote Code Execution | popup builder | 8.8 (v3.1) | High | 340162 , 340165 , 377360 , 390904 , 398007 |
| CVE-2022-0228 | Popup Builder < 4.0.7 - SQL Injection | popup builder | 7.2 (v3.1) | High | 340017 , 380026 , 380122 |
| CVE-2021-25055 | WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting | feedwordpress | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2022-0234 | WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting | woocs | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25075 | WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting | duplicate page or post | 3.5 (v3.1) | Low | 346755 , 377360 |
| CVE-2022-0678 | Microweber <1.2.11 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0666 | Microweber < 1.2.11 - CRLF Injection | microweber | 7.5 (v3.1) | High | 330708 , 390722 |
| CVE-2022-25323 | ZEROF Web Server 2.0 - Cross-Site Scripting | web server | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-45382 | D-Link - Remote Command Execution | dir-820l firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2022-24086 | Adobe Commerce (Magento) - Remote Code Execution | commerce | 9.8 (v3.1) | Critical | 344360 , 344370 |
| CVE-2022-25241 | FileCloud 21.2 - Cross-Site Request Forgery (CSRF) | filecloud | 8.8 (v3.1) | High | 345490 |
| CVE-2021-35380 | TermTalk Server 3.24.0.2 - Local File Inclusion | termtalk server | 7.5 (v3.1) | High | 340007 |
| CVE-2021-43734 | kkFileview v4.0.0 - Local File Inclusion | kkfileview | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2022-0201 | WordPress Permalink Manager <2.2.15 - Cross-Site Scripting | permalink manager lite | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2022-0206 | WordPress NewStatPress <1.3.6 - Cross-Site Scripting | newstatpress | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0208 | WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting | mappress | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2022-0212 | WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting | spidercalendar | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2022-24112 | Apache APISIX - Remote Code Execution | apisix | 9.8 (v3.1) | Critical | 344364 , 344366 , 344370 |
| CVE-2022-0020 | Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) | cortex xsoar | 5.4 (v3.1) | Medium | 330791 , 333141 , 340152 , 341256 , 342259 , 346755 |
| CVE-2022-22536 | SAP Memory Pipes (MPI) Desynchronization | content server | 10.0 (v3.1) | Critical | 392301 |
| CVE-2021-25114 | WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection | paid memberships pro | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2021-24947 | WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read | responsive vector maps | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2021-24878 | SupportCandy < 2.2.7 - Reflected Cross-Site Scripting | supportcandy | 6.1 (v3.1) | Medium | 346755 |
| CVE-2022-0149 | WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting | store exporter for woocommerce | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2022-0148 | WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting | mystickyelements | 5.4 (v3.1) | Medium | 346755 , 347198 |
| CVE-2022-0437 | karma-runner DOM-based Cross-Site Scripting | karma | 6.1 (v3.1) | Medium | 340112 , 346755 , 350148 |
| CVE-2022-24260 | VoipMonitor - Pre-Auth SQL Injection | voipmonitor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2021-46398 | FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) | filebrowser | 8.8 (v3.1) | High | 345490 , 345493 |
| CVE-2022-0381 | WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting | embed swagger | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-43062 | Fortinet FortiMail 7.0.1 - Cross-Site Scripting | fortimail | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-24762 | WordPress Perfect Survey <1.5.2 - SQL Injection | perfect survey | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-43510 | Sourcecodester Simple Client Management System 1.0 - SQL Injection | simple client management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2022-24223 | Atom CMS v2.0 - SQL Injection | atomcms | 9.8 (v3.1) | Critical | 340016 , 340156 , 380122 |
| CVE-2021-24926 | WordPress Domain Check <1.0.17 - Cross-Site Scripting | domain check | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24934 | Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting | visual css style editor | 6.1 (v3.1) | Medium | 341266 |
| CVE-2021-25063 | WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting | contact form 7 skins | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25085 | WOOF WordPress plugin - Cross-Site Scripting | woocommerce products filter | 6.1 (v3.1) | Medium | 340099 , 341099 , 347198 |
| CVE-2021-34805 | FAUST iServer 9.0.018.018.4 - Local File Inclusion | faust iserver | 7.5 (v3.1) | High | 344365 , 347019 , 390716 |
| CVE-2022-24264 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2022-24265 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 341245 , 344370 , 380026 , 380122 |
| CVE-2022-24266 | Cuppa CMS v1.0 - SQL injection | cuppacms | 7.5 (v3.1) | High | 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2022-24124 | Casdoor 1.13.0 - Unauthenticated SQL Injection | casdoor | 7.5 (v3.1) | High | 341245 |
| CVE-2022-0378 | Microweber Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2022-0332 | Moodle 3.11.4 - SQL Injection | moodle | 9.8 (v3.1) | Critical | 340017 , 340157 , 341245 , 344361 , 360147 , 360148 , 380026 , 390727 , 392301 , 392648 |
| CVE-2021-25008 | The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting | code snippets | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-25074 | WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect | webp converter for media | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2021-25078 | Affiliates Manager < 2.9.0 - Cross Site Scripting | affiliates manager | 6.1 (v3.1) | Medium | 347198 |
| CVE-2021-25079 | Contact Form Entries < 1.2.4 - Cross-Site Scripting | contact form entries | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-45380 | AppCMS - Cross-Site Scripting | appcms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2022-23808 | phpMyAdmin < 5.1.2 - Cross-Site Scripting | phpmyadmin | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-46104 | webp_server_go 0.4.0 - Path Traversal | webp server go | 7.5 (v3.1) | High | 390709 |
| CVE-2021-26247 | Cacti - Cross-Site Scripting | cacti | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46005 | Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting | car rental management system | 5.4 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24838 | WordPress AnyComment <0.3.5 - Open Redirect | anycomment | 6.1 (v3.1) | Medium | 390145 |
| CVE-2021-25065 | Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting | smash balloon social post feed | 5.4 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-25067 | Landing Page Builder < 1.4.9.6 - Cross-Site Scripting | landing page | 5.4 (v3.1) | Medium | 333141 , 347198 |
| CVE-2021-42551 | NetBiblio WebOPAC - Cross-Site Scripting | netbiblio | 6.1 (v3.1) | Medium | 341245 , 344370 , 346755 |
| CVE-2021-45422 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-0087 | Keystone 6 Login Page - Open Redirect and Cross-Site Scripting | keystone | 6.1 (v3.1) | Medium | 333140 , 346755 , 350148 |
| CVE-2021-28377 | Joomla! ChronoForums 2.0.11 - Local File Inclusion | chronoforums | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-25052 | WordPress Button Generator <2.3.3 - Remote File Inclusion | button generator | 8.8 (v3.1) | High | 340464 , 340465 |
| CVE-2021-24862 | WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection | registrationmagic | 7.2 (v3.1) | High | 340016 , 380122 |
| CVE-2022-21661 | WordPress Core 5.8.2 - 'WP_Query' SQL Injection | WordPress | 7.5 (v3.1) | High | 345493 |
| CVE-2021-46068 | Vehicle Service Management System - Stored Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46069 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2021-46071 | ehicle Service Management System 1.0 - Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46072 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-46073 | Vehicle Service Management System 1.0 - Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-31589 | BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting | appliance base software | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2021-45428 | Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload | tlr-2005ksh | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-24786 | Download Monitor < 4.4.5 - SQL Injection | download monitor | 7.2 (v3.1) | High | 380026 , 380122 |
| CVE-2021-25016 | Chaty < 2.8.2 - Cross-Site Scripting | chaty | 6.1 (v3.1) | Medium | 341266 , 346755 , 347198 |
| CVE-2021-24991 | WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting | woocommerce pdf invoices& packing slips | 4.8 (v3.1) | Medium | 347198 |
| CVE-2021-20158 | Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change | tew-827dru firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-20167 | Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun | rax43 firmware | 8.0 (v3.1) | High | 392301 |
| CVE-2021-20150 | Trendnet AC2600 TEW-827DRU - Credentials Disclosure | tew-827dru firmware | 5.3 (v3.1) | Medium | 392301 |
| CVE-2021-45425 | SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) | safari montage | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24979 | Paid Memberships Pro < 2.6.6 - Cross-Site Scripting | paid memberships pro | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-21881 | Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection | premierwave 2050 firmware | 9.9 (v3.1) | Critical | 340014 , 344363 , 344370 |
| CVE-2021-24849 | WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection | frontend manager for woocommerce along with bookings subscription listings compatible | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2021-24750 | WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection | wp visitor statistics (real time traffic) | 8.8 (v3.1) | High | 340016 , 340017 , 360147 , 360148 |
| CVE-2021-24956 | Blog2Social < 6.8.7 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-43831 | Gradio < 2.5.0 - Arbitrary File Read | gradio | 7.7 (v3.1) | High | 347009 |
| CVE-2021-45043 | HD-Network Realtime Monitoring System 2.0 - Local File Inclusion | hd-network real-time monitoring system | 7.5 (v3.1) | High | 344360 |
| CVE-2021-36450 | Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting | workforce optimization | 6.1 (v3.1) | Medium | 350147 |
| CVE-2021-45046 | Apache Log4j2 - Remote Code Injection | log4j | 9.0 (v3.1) | Critical | 345115 , 345117 , 345118 , 393655 |
| CVE-2021-39312 | WordPress True Ranker <2.2.4 - Local File Inclusion | true ranker | 7.5 (v3.1) | High | 336461 , 344360 , 381206 |
| CVE-2021-3831 | Gnuboard 5 - Cross-Site Scripting | gnuboard5 | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-42063 | SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting | knowledge warehouse | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24946 | WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection | modern events calendar lite | 9.8 (v3.1) | Critical | 340016 , 340017 , 360147 , 360148 , 380122 |
| CVE-2021-24970 | WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion | all-in-one video gallery | 7.2 (v3.1) | High | 377360 |
| CVE-2021-44228 | Apache Log4j2 Remote Code Injection | log4j | 10.0 (v3.1) | Critical | 345115 , 345117 , 345118 , 393655 |
| CVE-2021-20137 | Gryphon Tower - Cross-Site Scripting | gryphon tower | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-20038 | SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution | sma 200 firmware | 9.8 (v3.1) | Critical | 340193 |
| CVE-2021-43798 | Grafana v8.x - Arbitrary File Read | grafana | 7.5 (v3.1) | High | 347009 |
| CVE-2021-42567 | Apereo CAS Cross-Site Scripting | central authentication service | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350148 |
| CVE-2021-43810 | Admidio - Cross-Site Scripting | admidio | 6.1 (v3.1) | Medium | 340112 , 350148 , 390722 |
| CVE-2021-24931 | WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection | secure copy content protection and content locking | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-24943 | Registrations for the Events Calendar < 2.7.6 - SQL Injection | registrations for the events calendar | 9.8 (v3.1) | Critical | 340016 , 380122 |
| CVE-2021-24915 | Contest Gallery < 13.1.0.6 - SQL injection | contest gallery | 9.8 (v3.1) | Critical | 340017 , 340144 , 340157 , 344361 |
| CVE-2021-24876 | Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting | registrations for the events calendar | 6.1 (v3.1) | Medium | 346755 , 347198 , 377360 |
| CVE-2021-43778 | GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability. | barcode | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24644 | Images to WebP < 1.9 - Authenticated Local File Inclusion | images to webp | 7.5 (v3.1) | High | 340007 , 377360 |
| CVE-2021-24875 | WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting | ecommerce product catalog | 6.1 (v3.1) | Medium | 333141 , 346755 , 347198 |
| CVE-2021-22053 | Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution | spring cloud netflix | 8.8 (v3.1) | High | 337209 , 337211 , 340087 , 340193 |
| CVE-2021-41569 | SAS/Internet 9.4 1520 - Local File Inclusion | sas/intrnet | 7.5 (v3.1) | High | 344360 , 347009 |
| CVE-2021-41277 | Metabase - Local File Inclusion | metabase | 7.5 (v3.1) | High | 340165 , 344360 , 347009 |
| CVE-2021-43495 | AlquistManager Local File Inclusion | alquist | 7.5 (v3.1) | High | 347009 |
| CVE-2021-41951 | Resourcespace - Cross-Site Scripting | resourcespace | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2021-43574 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-3577 | Motorola Baby Monitors - Remote Command Execution | halo+ camera firmware | 8.8 (v3.1) | High | 340014 , 340193 , 344364 , 344370 , 393655 |
| CVE-2021-43496 | Clustering Local File Inclusion | clustering | 7.5 (v3.1) | High | 347009 |
| CVE-2021-41349 | Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2021-35488 | Thruk 2.40-2 - Cross-Site Scripting | thruk | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-24731 | Pie Register < 3.7.1.6 - SQL Injection | pie register | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-24827 | WordPress Asgaros Forum <1.15.13 - SQL Injection | asgaros forum | 9.8 (v3.1) | Critical | 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2021-24627 | G Auto-Hyperlink <= 1.0.1 - SQL Injection | g auto-hyperlink | 7.2 (v3.1) | High | 340017 , 340144 , 340157 |
| CVE-2021-24791 | Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection | header footer code manager | 7.2 (v3.1) | High | 380122 |
| CVE-2021-40577 | Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting | online enrollment management system | 5.4 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2021-42237 | Sitecore Experience Platform Pre-Auth RCE | experience platform | 9.8 (v3.1) | Critical | 344362 , 344366 |
| CVE-2021-42667 | Online Event Booking and Reservation System 2.3.0 - SQL Injection | online event booking and reservation system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2021-39411 | Hospital Management System 1.0 - Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 |
| CVE-2021-42663 | Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting | online event booking and reservation system | 4.3 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-43140 | Simple Subscription Website 1.0 - SQLi Authentication Bypass | simple subscription website | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 345493 , 390572 |
| CVE-2020-20982 | shadoweb wdja v1.5.1 - Cross-Site Scripting | wdja cms | 9.6 (v3.1) | Critical | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-41174 | Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting | grafana | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-31862 | SysAid 20.4.74 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-31682 | WebCTRL OEM <= 6.5 - Cross-Site Scripting | webctrl | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-42565 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-42566 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-20123 | Draytek VigorConnect 1.6.0-B - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-20124 | Draytek VigorConnect 6.0-B3 - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-42325 | Froxlor 0.10.29.1 - SQL Injection (Authenticated) | froxlor | 9.8 (v3.1) | Critical | 344370 , 350147 , 390724 |
| CVE-2021-40617 | openSIS Community Edition 8.0 - SQL Injection | opensis | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 390727 , 392301 , 392648 |
| CVE-2021-29006 | rConfig 3.9.6 - Local File Inclusion | rconfig | 6.5 (v3.1) | Medium | 344360 , 347009 , 390709 |
| CVE-2021-24563 | WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated) | frontend uploader | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-40542 | Opensis-Classic 8.0 - Cross-Site Scripting | opensis | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-24681 | Duplicate Page WordPress - Stored Cross-Site Scripting | duplicate page | 4.8 (v3.1) | Medium | 377360 |
| CVE-2021-42013 | Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution | http server | 9.8 (v3.1) | Critical | 347009 |
| CVE-2021-40978 | MKdocs 1.2.2 - Directory Traversal | mkdocs | 7.5 (v3.1) | High | 347009 |
| CVE-2021-39350 | FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting | fv flowplayer video player | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-41773 | Apache 2.4.49 - Path Traversal and Remote Code Execution | http server | 9.8 (v3.1) | Critical | 347009 |
| CVE-2021-39433 | BIQS IT Biqs-drive v1.83 Local File Inclusion | biqsdrive | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-41878 | i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS) | i-panel administration system | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-40960 | Galera WebTemplate 1.0 Directory Traversal | galera webtemplate | 9.8 (v3.1) | Critical | 347009 , 390709 |
| CVE-2021-41649 | PuneethReddyHC Online Shopping System homeaction.php SQL Injection | online-shopping-system-advanced | 9.8 (v3.1) | Critical | 392301 |
| CVE-2021-41648 | PuneethReddyHC action.php SQL Injection | online-shopping-system-advanced | 7.5 (v3.1) | High | 392301 |
| CVE-2021-40968 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40969 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40970 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40971 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40972 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-40973 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-41467 | JustWriting - Cross-Site Scripting | justwriting | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-41291 | ECOA Building Automation System - Directory Traversal Content Disclosure | ecs router controller-ecs firmware | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-41293 | ECOA Building Automation System - Arbitrary File Retrieval | ecs router controller-ecs firmware | 7.5 (v3.1) | High | 392301 |
| CVE-2021-40651 | OS4Ed OpenSIS Community 8.0 - Local File Inclusion | opensis | 6.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24666 | WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection | podlove podcast publisher | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2021-36749 | Apache Druid - Local File Inclusion | druid | 6.5 (v3.1) | Medium | 340029 , 344360 |
| CVE-2021-22005 | VMware vCenter Server - Arbitrary File Upload | cloud foundation | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-36873 | WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting | iq block country | 5.4 (v3.1) | Medium | 377360 |
| CVE-2021-22017 | vCenter Server - Improper Access Control | vcenter server | 5.3 (v3.1) | Medium | 344370 |
| CVE-2021-36260 | Hikvision IP camera/NVR - Remote Command Execution | ds-2cd2026g2-iu/sl firmware | 9.8 (v3.1) | Critical | 393655 |
| CVE-2021-40868 | Cloudron 6.2 Cross-Site Scripting | cloudron | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24657 | Limit Login Attempts WordPress - Stored Cross-site Scripting | limit login attempts | 6.1 (v3.1) | Medium | 377360 |
| CVE-2021-40438 | Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery | http server | 9.0 (v3.1) | Critical | 345271 , 390723 |
| CVE-2021-33690 | SAP NetWeaver Development Infrastructure - Server Side Request Forgery | netweaver development infrastructure | 9.9 (v3.1) | Critical | 340162 , 340163 |
| CVE-2021-40870 | Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution | controller | 9.8 (v3.1) | Critical | 340007 |
| CVE-2021-33544 | Geutebruck - Remote Command Injection | g-cam ebc-2110 | 7.2 (v3.1) | High | 340014 , 340193 , 344364 , 344370 , 393655 |
| CVE-2021-24510 | WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting | mf gig calendar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2020-19282 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-19283 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-19295 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium | 341266 |
| CVE-2020-19515 | qdPM 9.1 - Cross-site Scripting | qdpm | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2021-38704 | ClinicCases 7.3.3 Cross-Site Scripting | cliniccases | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24435 | WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting | titan framework | 6.1 (v3.1) | Medium | 333141 , 340149 , 341245 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-39322 | WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting | easy social icons | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-39320 | WordPress Under Construction <1.19 - Cross-Site Scripting | underconstruction | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-39316 | WordPress DZS Zoomsounds <=6.50 - Local File Inclusion | zoomsounds | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-27909 | Mautic <3.3.4 - Cross-Site Scripting | mautic | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-37416 | Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting | manageengine adselfservice plus | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2021-39165 | Cachet <=2.3.18 - SQL Injection | cachet | 6.5 (v3.1) | Medium | 340145 , 340156 , 341145 , 380026 , 380122 |
| CVE-2021-37538 | PrestaShop SmartBlog <4.0.6 - SQL Injection | smartblog | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2021-39144 | XStream 1.4.18 - Remote Code Execution | xstream | 8.5 (v3.1) | High | 344363 |
| CVE-2021-24554 | WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection | paytm-pay | 7.2 (v3.1) | High | 380122 |
| CVE-2021-36748 | PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection | blog | 7.5 (v3.1) | High | 341245 |
| CVE-2021-20792 | WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting | quiz and survey master | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-38702 | Cyberoam NetGenie Cross-Site Scripting | netgenie c0101b1-20141120-ng11vo firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24527 | Profile Builder < 3.4.9 - Improper Authentication | profile builder | 9.8 (v3.1) | Critical | 340130 |
| CVE-2021-35395 | RealTek Jungle SDK - Arbitrary Command Injection | realtek jungle sdk | 9.8 (v3.1) | Critical | 340014 , 340029 , 344361 , 344363 |
| CVE-2021-34643 | WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting | skaut-bazar | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-26086 | Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read | jira data center | 5.3 (v3.1) | Medium | 345113 , 390727 , 392301 , 392648 |
| CVE-2021-36380 | Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection | sureline | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-20988 | DomainMOD 4.13.0 - Cross-Site Scripting | domainmod | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-34640 | WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting | securimage-wp-fixed | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-37425 | Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE) | mobiletogether server | 9.1 (v3.1) | Critical | 330791 , 340152 |
| CVE-2021-24499 | WordPress Workreap - Remote Code Execution | workreap | 9.8 (v3.1) | Critical | 330791 , 340152 , 382238 |
| CVE-2021-24495 | Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting | marmoset viewer | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 340162 , 340163 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-24522 | ProfilePress < 3.1.11 - Cross-Site Scripting | profilepress | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-37573 | Tiny Java Web Server - Cross-Site Scripting | tiny java web server | 6.1 (v3.1) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2021-35265 | MaxSite CMS > V106 - Cross-Site Scripting | maxsite cms | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-37833 | Hotel Druid 3.0.2 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26085 | Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read | confluence data center | 5.3 (v3.1) | Medium | 390727 , 392301 , 392648 |
| CVE-2021-24472 | Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery | kentharadio | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2021-24488 | WordPress Post Grid <2.1.8 - Cross-Site Scripting | post grid | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 , 347198 |
| CVE-2021-24498 | WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting | calendar event multi view | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2021-37593 | PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection | peel shopping | 9.1 (v3.1) | Critical | 340016 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2021-34630 | GTranslate < 2.8.65 - Cross-Site Scripting | gtranslate | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-32789 | WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection | woocommerce blocks | 7.5 (v3.1) | High | 360150 |
| CVE-2021-30049 | SysAid Technologies 20.3.64 b14 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-22145 | Elasticsearch 7.10.0-7.13.3 - Information Disclosure | elasticsearch | 6.5 (v3.1) | Medium | 330791 , 340152 |
| CVE-2021-24436 | WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24452 | WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-21799 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-21800 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-21801 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-21802 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-21803 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-34429 | Eclipse Jetty 11.0.5 - Sensitive File Disclosure | jetty | 5.3 (v3.1) | Medium | 390703 |
| CVE-2020-26153 | Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting | event espresso | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-24442 | Wordpress Polls Widget < 1.5.3 - SQL Injection | poll, survey, questionnaire and voting system | 9.8 (v3.1) | Critical | 380122 |
| CVE-2021-33807 | Cartadis Gespage 8.2.1 - Directory Traversal | gespage | 7.5 (v3.1) | High | 340007 , 344360 |
| CVE-2021-24409 | Prismatic < 2.8 - Cross-Site Scripting | prismatic | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2021-30118 | Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution | vsa | 9.8 (v3.1) | Critical | 344365 , 392301 |
| CVE-2021-34621 | WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness | profilepress | 9.8 (v3.1) | Critical | 377360 |
| CVE-2021-34624 | WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload | profilepress | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-24405 | WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS | easy cookies policy | 6.5 (v3.1) | Medium | 346755 , 390585 , 390726 , 392647 |
| CVE-2021-24387 | WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting | real estate 7 | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2021-24389 | WordPress FoodBakery <2.2 - Cross-Site Scripting | foodbakery | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24407 | WordPress Jannah Theme <5.4.5 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-35956 | AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS) | sensorprobe2 firmware | 5.4 (v3.1) | Medium | 333141 , 341256 , 342259 , 350147 |
| CVE-2021-34187 | Chamilo model.ajax.php - SQL Injection | chamilo | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-18662 | Gnuboard5 5.3.2.8 - SQL Injection | gnuboard | 9.8 (v3.1) | Critical | 344366 , 380122 |
| CVE-2020-22165 | PHPGurukul Hospital Management System 4.0 - SQL Injection | hospital management system | 7.5 (v3.1) | High | 340016 , 340017 , 340145 , 340157 , 340159 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2021-24364 | WordPress Jannah Theme <5.4.4 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2020-22208 | 74cms - ajax_street.php 'x' SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-22209 | 74cms - ajax_common.php SQL Injection | 74cms | 9.8 (v3.1) | Critical | 341250 , 390703 |
| CVE-2020-22210 | 74cms - ajax_officebuilding.php SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340145 |
| CVE-2020-22211 | 74cms - ajax_street.php 'key' SQL Injection | 74cms | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2020-29214 | Alumni Management System 1.0 - SQL Injection | alumni management system | 9.8 (v3.1) | Critical | 340156 |
| CVE-2021-24347 | WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload | sp project & document manager | 8.8 (v3.1) | High | 377360 |
| CVE-2021-24351 | WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting | the plus addons for elementor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-23394 | elFinder < 2.1.58 - Remote Code Execution | elfinder | 9.8 (v3.1) | Critical | 393781 |
| CVE-2021-22175 | GitLab CI Lint API - Server-Side Request Forgery | gitlab | 9.8 (v3.1) | Critical | 344362 , 344370 |
| CVE-2021-33357 | RaspAP <=2.6.5 - Remote Command Injection | raspap | 9.8 (v3.1) | Critical | 344363 , 344364 , 344366 , 344370 |
| CVE-2021-34369 | Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR) | civic platform | 6.5 (v3.1) | Medium | 390727 , 392301 , 392648 |
| CVE-2021-33829 | Drupal 7 CKEditor XSS | ckeditor | 6.1 (v3.1) | Medium | 333141 |
| CVE-2021-34370 | Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2021-22214 | Gitlab CE/EE 10.5 - Server-Side Request Forgery | gitlab | 8.6 (v3.1) | High | 344362 |
| CVE-2021-24340 | WordPress Statistics <13.0.8 - Blind SQL Injection | wp statistics | 7.5 (v3.1) | High | 380122 |
| CVE-2020-18268 | Z-Blog <=1.5.2 - Open Redirect | z-blogphp | 6.1 (v3.1) | Medium | 390500 , 390501 |
| CVE-2021-24342 | WordPress JNews Theme <8.0.6 - Cross-Site Scripting | jnews | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-33904 | Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) | civic platform | 6.1 (v3.1) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390722 |
| CVE-2021-31250 | CHIYU TCP/IP Converter - Cross-Site Scripting | bf-430 firmware | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-6950 | Eclipse Mojarra - Local File Read | mojarra | 6.5 (v3.1) | Medium | 340007 |
| CVE-2021-27828 | In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection | in4suite erp | 9.1 (v3.1) | Critical | 392301 |
| CVE-2021-24316 | WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting | mediumish | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24320 | WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting | bello | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24335 | WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting | car repair services & auto mechanic | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24298 | WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting | simple giveaways | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-24300 | WordPress WooCommerce <1.13.22 - Cross-Site Scripting | product slider for woocommerce | 6.1 (v3.1) | Medium | 333141 , 340149 , 346755 , 347198 |
| CVE-2020-35580 | SearchBlox <9.2.2 - Local File Inclusion | searchblox | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-29625 | Adminer <=4.8.0 - Cross-Site Scripting | adminer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-31316 | CentOS Web Panel - SQL Injection | webpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 341245 |
| CVE-2021-31324 | CentOS Web Panel - OS Command Injection | webpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 341245 |
| CVE-2021-32305 | Websvn <2.6.1 - Remote Code Execution | websvn | 9.8 (v3.1) | Critical | 340014 , 340193 , 344364 , 344366 , 344370 |
| CVE-2021-24284 | WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload | kaswara | 9.8 (v3.1) | Critical | 382238 |
| CVE-2021-24285 | WordPress Car Seller - Auto Classifieds Script - SQL Injection | cars-seller-auto-classifieds-script | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 360147 , 360148 |
| CVE-2021-32819 | Nodejs Squirrelly - Remote Code Execution | squirrelly | 8.8 (v3.1) | High | 340014 , 340087 , 340095 , 340193 , 344370 , 345240 , 380026 |
| CVE-2021-32820 | Express-handlebars - Local File Inclusion | express handlebars | 8.6 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-24286 | WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting | redirect 404 to parent | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-24287 | WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting | select all categories and taxonomies, change checkbox to radio buttons | 6.1 (v3.1) | Medium | 346755 , 377360 |
| CVE-2021-24291 | WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting | photo gallery | 6.1 (v3.1) | Medium | 347198 |
| CVE-2021-28799 | QNAP HBS 3 - Broken Access Control | hybrid backup sync | 9.8 (v3.1) | Critical | 344360 , 390904 |
| CVE-2021-30213 | Knowage Suite 7.3 - Cross-Site Scripting | knowage | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-31195 | Microsoft Exchange Server - Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-31537 | SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting | sis-rewe go | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2020-23575 | Kyocera Printer d-COPIA253MF - Directory Traversal | d-copia253mf plus firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2021-31755 | Tenda Router AC11 - Remote Command Injection | ac11 firmware | 9.8 (v3.1) | Critical | 340014 |
| CVE-2021-1498 | Cisco HyperFlex HX Data Platform - Remote Command Execution | hyperflex hx data platform | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 |
| CVE-2021-28151 | Hongdian H8922 3.0.5 - Remote Command Injection | h8922 firmware | 8.8 (v3.1) | High | 330925 , 392301 |
| CVE-2021-28149 | Hongdian H8922 3.0.5 Devices - Local File Inclusion | h8922 firmware | 6.5 (v3.1) | Medium | 330925 , 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24214 | WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting | openid connect generic client | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-24245 | WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) | stop spammers | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 398005 |
| CVE-2021-28150 | Hongdian H8922 3.0.5 - Information Disclosure | h8922 firmware | 5.5 (v3.1) | Medium | 330925 |
| CVE-2020-36333 | ThemeGrill Demo Importer < 1.6.2 - Database Reset | themegrill demo importer | 9.1 (v3.1) | Critical | 375357 |
| CVE-2021-24274 | WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting | ultimate maps | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24275 | Popup by Supsystic <1.10.5 - Cross-Site scripting | popup | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24276 | WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting | contact form | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-31856 | Layer5 Meshery 0.5.2 - SQL Injection | meshery | 9.8 (v3.1) | Critical | 341245 , 344366 |
| CVE-2021-29460 | Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS) | kirby | 5.4 (v3.1) | Medium | 330791 , 340152 |
| CVE-2021-20086 | Odoo Apps - Cross-Site Scripting via Prototype Pollution | jquery-bbq | 8.8 (v3.1) | High | 333141 , 340099 , 340147 , 341099 , 341256 , 346755 , 347198 |
| CVE-2021-25899 | Void Aural Rec Monitor 9.0.0.1 - SQL Injection | aurall rec monitor | 7.5 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2021-24235 | WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting | goto | 6.1 (v3.1) | Medium | 333141 , 340099 , 340149 , 341099 , 341256 , 342259 , 344370 , 346755 , 347198 , 350148 , 390722 |
| CVE-2021-24237 | WordPress Realteo <=1.2.3 - Cross-Site Scripting | findeo | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-25864 | HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting | consul | 6.1 (v3.1) | Medium | 392301 |
| CVE-2021-26812 | Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting | meet | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24215 | Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation | controlled admin access | 9.8 (v3.1) | Critical | 377360 |
| CVE-2020-24285 | INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion | tip200 | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2021-24227 | Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion | patreon wordpress | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-24213 | GiveWP <= 2.9.7 - Cross-Site Scripting | givewp | 6.1 (v3.1) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2021-1472 | Cisco Small Business RV Series - OS Command Injection | rv160 firmware | 9.8 (v3.1) | Critical | 340014 , 340149 , 344364 , 344366 , 344370 , 350147 |
| CVE-2021-30151 | Sidekiq <=6.2.0 - Cross-Site Scripting | sidekiq | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-24212 | WooCommerce Help Scout - Arbitrary File Upload | help scout | 9.8 (v3.1) | Critical | 330791 , 340152 , 382238 |
| CVE-2021-24170 | User Profile Picture < 2.5.0 - Sensitive Information Disclosure | user profile picture | 7.5 (v3.1) | High | 377360 |
| CVE-2021-24155 | WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload | backup guard | 7.2 (v3.1) | High | 377360 |
| CVE-2021-24165 | WordPress Ninja Forms <3.4.34 - Open Redirect | ninja forms | 6.1 (v3.1) | Medium | 377360 |
| CVE-2021-24169 | WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting | advanced order export | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2021-24210 | WordPress PhastPress <1.111 - Open Redirect | phastpress | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2021-28918 | Netmask NPM Package - Server-Side Request Forgery | netmask | 9.1 (v3.1) | Critical | 340162 , 344360 , 347009 , 398003 |
| CVE-2020-24391 | Mongo-Express - Remote Code Execution | mongo-express | 9.8 (v3.1) | Critical | 345240 , 380026 |
| CVE-2021-25161 | Aruba Instant Access Point (IAP) - Cross-Site Scripting | aruba-instant-access-point | 6.1 (v3.1) | Medium | 344370 , 346755 , 390722 |
| CVE-2020-19625 | Gridx 1.3 - Remote Code Execution | gridx | 9.8 (v3.1) | Critical | 341250 |
| CVE-2020-23517 | Aryanic HighMail (High CMS) - Cross-Site Scripting | high cms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27316 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-27319 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 380122 |
| CVE-2021-27320 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 7.5 (v3.1) | High | 340016 , 340156 , 341245 , 380026 , 380122 |
| CVE-2021-21345 | XStream < 1.4.16 - Remote Code Execution | xstream | 9.9 (v3.1) | Critical | 344363 , 344366 |
| CVE-2021-21351 | XStream <1.4.16 - Remote Code Execution | xstream | 9.1 (v3.1) | Critical | 344380 |
| CVE-2021-21402 | Jellyfin <10.7.0 - Local File Inclusion | jellyfin | 6.5 (v3.1) | Medium | 344365 , 347019 |
| CVE-2021-27309 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27310 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-27519 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-27520 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2021-24139 | 10Web Photo Gallery < 1.5.55 - SQL Injection | photo gallery | 9.8 (v3.1) | Critical | 341245 , 380026 , 380122 |
| CVE-2021-24145 | WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload | modern events calendar lite | 7.2 (v3.1) | High | 382238 |
| CVE-2021-27695 | openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting | openmaint | 6.1 (v3.1) | Medium | 330791 , 333141 , 340147 , 340148 , 340149 , 340152 , 341256 , 342259 , 346755 |
| CVE-2021-27314 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 9.8 (v3.1) | Critical | 340016 , 340156 , 380026 , 380122 |
| CVE-2020-29047 | WP Hotel Booking < 1.10.4 - PHP Object Injection | wp hotel booking | 9.8 (v3.1) | Critical | 330889 |
| CVE-2021-21978 | VMware View Planner <4.6 SP1- Remote Code Execution | view planner | 9.8 (v3.1) | Critical | 330791 , 340007 , 340152 |
| CVE-2021-27931 | LumisXP <10.0.0 - Blind XML External Entity Attack | lumis experience platform | 9.1 (v3.1) | Critical | 344372 , 392301 |
| CVE-2021-26475 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2021-26702 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2021-25281 | SaltStack Salt <3002.5 - Auth Bypass | salt | 9.8 (v3.1) | Critical | 340007 |
| CVE-2021-27132 | Sercomm VD625 Smart Modems - CRLF Injection | agcombo vd625 firmware | 9.8 (v3.1) | Critical | 330708 , 390714 |
| CVE-2021-27330 | Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting | datepicker calendar | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2020-28429 | geojson2kml - Command Injection | geojson2kml | 9.8 (v3.1) | Critical | 344361 , 344363 |
| CVE-2020-21224 | Inspur ClusterEngine 4.0 - Remote Code Execution | clusterengine | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 344370 |
| CVE-2021-27124 | Doctor Appointment System 1.0 - SQL Injection | doctor appointment system | 6.5 (v3.1) | Medium | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2021-21315 | Node.JS System Information Library <5.3.1 - Remote Command Injection | systeminformation | 7.8 (v3.1) | High | 340029 , 344360 , 344364 , 344370 , 347009 , 393655 |
| CVE-2021-3239 | E-Learning System 1.0 - SQL Injection | e-learning system | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2021-21307 | Lucee Admin - Remote Code Execution | lucee server | 9.8 (v3.1) | Critical | 340149 , 342259 , 344364 , 344366 , 350147 |
| CVE-2020-13117 | Wavlink Multiple AP - Remote Command Injection | wn575a4 | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 |
| CVE-2021-21479 | SCIMono <0.0.19 - Remote Code Execution | scimono | 9.1 (v3.1) | Critical | 337209 , 337211 , 340087 , 346755 |
| CVE-2021-22502 | Micro Focus Operations Bridge Reporter - Remote Code Execution | operation bridge reporter | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2021-22122 | FortiWeb - Cross Site Scripting | fortiweb | 6.1 (v3.1) | Medium | 346755 |
| CVE-2021-26723 | Jenzabar 9.2x-9.2.2 - Cross-Site Scripting | jenzabar | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 350147 , 350148 |
| CVE-2021-26710 | Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting | report2web | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-29164 | PacsOne Server <7.1.1 - Cross-Site Scripting | pacsone server | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 346755 , 360030 |
| CVE-2020-25506 | D-Link DNS-320 - Unauthenticated Remote Code Execution | dns-320 firmware | 9.8 (v3.1) | Critical | 344363 , 392301 |
| CVE-2021-3378 | FortiLogger 4.4.2.2 - Arbitrary File Upload | fortilogger | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2020-15568 | TerraMaster TOS <.1.29 - Remote Code Execution | tos | 9.8 (v3.1) | Critical | 340023 , 344360 , 347009 |
| CVE-2021-25646 | Apache Druid - Remote Code Execution | druid | 8.8 (v3.1) | High | 337209 , 337210 , 337211 , 340095 , 344360 , 344361 , 344370 , 380026 |
| CVE-2021-3278 | Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass | local services search engine management system | 9.8 (v3.1) | Critical | 340156 , 345493 |
| CVE-2021-25864 | Hue Magic 3.0.0 - Local File Inclusion | huemagic | 7.5 (v3.1) | High | 347009 |
| CVE-2021-3223 | Node RED Dashboard <2.26.2 - Local File Inclusion | node-red-dashboard | 7.5 (v3.1) | High | 347009 |
| CVE-2020-27735 | Wing FTP 6.4.4 - Cross-Site Scripting | wing ftp server | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2021-3110 | PrestaShop 1.7.7.0 - SQL Injection | prestashop | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2020-19360 | FHEM 6.0 - Local File Inclusion | fhem | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2020-35749 | WordPress Simple Job Board <2.9.4 - Local File Inclusion | simple board job | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2021-20617 | Acmailer - Improper Access Control to OS Command Injection | acmailer,acmailer db | 9.8 (v3.1) | Critical | 340014 , 344363 |
| CVE-2021-3129 | Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution | ignition | 9.8 (v3.1) | Critical | 340007 , 340077 , 340162 , 344365 , 398007 |
| CVE-2020-24701 | OX Appsuite - Cross-Site Scripting | open-xchange appsuite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2020-35131 | Cockpit CMS 0.6.1 - Remote Code Execution | cockpit | 9.8 (v3.1) | Critical | 340095 |
| CVE-2020-24902 | Quixplorer <=2.4.1 - Cross-Site Scripting | quixplorer | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-24903 | Cute Editor for ASP.NET 6.4 - Cross-Site Scripting | cute editor | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2021-23241 | MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion | mercury x18g firmware | 5.3 (v3.1) | Medium | 347009 |
| CVE-2021-3018 | IPeakCMS 3.5 - SQL Injection | ipeakcms | 9.8 (v3.1) | Critical | 380122 |
| CVE-2021-21234 | Spring Boot Actuator Logview Directory Traversal | spring-boot-actuator-logview | 7.7 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-17519 | Apache Flink - Local File Inclusion | flink | 7.5 (v3.1) | High | 390709 |
| CVE-2021-3002 | Seo Panel 4.8.0 - Cross-Site Scripting | seo panel | 6.1 (v3.1) | Medium | 333141 , 340147 , 346755 |
| CVE-2020-29233 | WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting | wondercms | 5.4 (v3.1) | Medium | 345493 |
| CVE-2020-29477 | Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting | community | 4.8 (v3.1) | Medium | 340147 , 340148 , 342259 , 346755 , 390585 |
| CVE-2020-35241 | Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting | flatpress | 4.8 (v3.1) | Medium | 344370 , 346755 , 390724 |
| CVE-2020-10148 | SolarWinds Orion API - Auth Bypass | orion platform | 9.8 (v3.1) | Critical | 390709 |
| CVE-2020-35774 | twitter-server Cross-Site Scripting | twitter-server | 5.4 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-29470 | OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting | opencart | 4.8 (v3.1) | Medium | 340247 , 340248 , 340476 , 340477 , 341245 , 342259 , 346755 , 390585 |
| CVE-2020-29475 | nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting | store | 4.8 (v3.1) | Medium | 346755 |
| CVE-2020-35729 | Klog Server <=2.41 - Unauthenticated Command Injection | klog server | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-35736 | GateOne 1.1 - Local File Inclusion | gateone | 7.5 (v3.1) | High | 347009 |
| CVE-2020-35713 | Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution | re6500 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-28188 | TerraMaster TOS - Unauthenticated Remote Command Execution | tos | 9.8 (v3.1) | Critical | 340014 , 340193 , 344363 , 344370 |
| CVE-2020-35598 | Advanced Comment System 1.0 - Local File Inclusion | advanced comment system | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2020-24579 | D-Link DSL 2888a - Authentication Bypass/Remote Command Execution | dsl2888a firmware | 8.8 (v3.1) | High | 344360 , 347009 , 390904 , 392301 |
| CVE-2020-35151 | Online Marriage Registration System 1.0 - 'searchdata' SQL Injection | online marriage registration system | 8.8 (v3.1) | High | 345493 |
| CVE-2020-20300 | WeiPHP 5.0 - SQL Injection | weiphp | 9.8 (v3.1) | Critical | 340157 , 340159 , 360147 , 360148 |
| CVE-2020-25494 | SCO Openserver 5.0.7 - 'outputform' Command Injection | openserver | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2020-25495 | SCO Openserver 5.0.7 - 'section' Reflected XSS | openserver | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 , 390585 |
| CVE-2020-20285 | ZZcms - Cross-Site Scripting | zzcms | 5.4 (v3.1) | Medium | 333141 , 340003 , 340099 , 341099 , 342259 |
| CVE-2020-35545 | Spotweb 1.4.9 - 'search' SQL Injection | spotweb | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 |
| CVE-2020-35476 | OpenTSDB <=2.4.0 - Remote Code Execution | opentsdb | 9.8 (v3.1) | Critical | 340014 , 340087 , 340095 , 340193 , 344370 |
| CVE-2020-35416 | PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) | phpjabbers appointment scheduler | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2020-29227 | Car Rental Management System 1.0 - Local File Inclusion | car rental management system | 9.8 (v3.1) | Critical | 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2020-17530 | Apache Struts 2.0.0-2.5.25 - Remote Code Execution | struts | 9.8 (v3.1) | Critical | 344360 , 347009 |
| CVE-2020-13945 | Apache APISIX - Insufficiently Protected Credentials | apisix | 6.5 (v3.1) | Medium | 344363 , 380026 |
| CVE-2020-26248 | PrestaShop Product Comments <4.2.0 - SQL Injection | productcomments | 8.2 (v3.1) | High | 341245 , 380026 , 380122 |
| CVE-2020-29279 | 74CMS - Remote File Inclusion | 74cms | 9.8 (v3.1) | Critical | 340128 , 344363 , 380018 |
| CVE-2020-29240 | LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting | leptoncms | 4.8 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 398005 |
| CVE-2020-29390 | Zeroshell 3.9.3 - Command Injection | zeroshell | 9.8 (v3.1) | Critical | 340023 , 341245 , 344360 , 344361 , 344363 , 344370 , 347009 |
| CVE-2020-29395 | Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting | eventon | 6.1 (v3.1) | Medium | 333141 , 342259 , 347198 , 350148 |
| CVE-2020-12262 | Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting | tip300 | 5.4 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-13886 | Intelbras TIP 200/200 LITE/300 - Local File Inclusion | tip200 firmware | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-13942 | Apache Unomi <1.5.2 - Remote Code Execution | unomi | 9.8 (v3.1) | Critical | 340095 |
| CVE-2020-26217 | XStream <1.4.14 - Remote Code Execution | xstream | 8.8 (v3.1) | High | 344363 , 344366 |
| CVE-2020-27191 | LionWiki <3.2.12 - Local File Inclusion | lionwiki | 7.5 (v3.1) | High | 344360 , 347009 |
| CVE-2020-27481 | Good Layers LMS Plugin <= 2.1.4 - SQL Injection | good learning management system | 9.8 (v3.1) | Critical | 322102 , 340016 , 380122 |
| CVE-2020-28351 | Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting | shoretel | 6.1 (v3.1) | Medium | 341266 |
| CVE-2020-14750 | Oracle WebLogic Server - Remote Command Execution | fusion middleware | 9.8 (v3.1) | Critical | 337209 , 337210 , 337211 , 340014 , 340029 , 340095 , 344361 , 344362 , 344370 , 380026 |
| CVE-2020-24881 | OsTicket < 1.14.3 - Server Side Request Forgery | osticket | 9.8 (v3.1) | Critical | 340147 , 340148 |
| CVE-2020-27982 | IceWarp WebMail 11.4.5.0 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-27533 | DedeCMS v.5.8 - keyword Cross-Site Scripting | dedecms | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-27615 | WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via log Parameter | loginizer | 9.8 (v3.1) | Critical | 340156 , 341245 , 380026 , 380122 |
| CVE-2020-14864 | Oracle Fusion - Directory Traversal/Local File Inclusion | business intelligence | 7.5 (v3.1) | High | 344360 , 347009 , 390709 , 390716 |
| CVE-2020-14883 | Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution | weblogic server | 7.2 (v3.1) | High | 380026 |
| CVE-2020-3580 | Cisco ASA/FTD Software - Cross-Site Scripting | firepower threat defense | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-7318 | McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting | epolicy orchestrator | 4.3 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2020-26935 | phpMyAdmin < 5.0.3 - SQL Injection | phpmyadmin | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2020-26919 | NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution | jgs516pe firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-25760 | Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) | visitor management system | 8.8 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2020-25223 | Sophos UTM Preauth - Remote Code Execution | unified threat management | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2020-11991 | Apache Cocoon 2.1.12 - XML Injection | cocoon | 7.5 (v3.1) | High | 344372 |
| CVE-2020-25213 | WordPress File Manager Plugin - Remote Code Execution | file manager | 9.8 (v3.1) | Critical | 393781 |
| CVE-2020-2036 | Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting | pan-os | 8.8 (v3.1) | High | 347198 |
| CVE-2020-24963 | Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated) | best support system | 5.4 (v3.1) | Medium | 333141 , 344370 , 360151 |
| CVE-2020-24193 | Daily Tracker System 1.0 - Authentication Bypass | daily tracker system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 345493 , 390572 |
| CVE-2020-24949 | PHP-Fusion 9.03.50 - Remote Code Execution | php-fusion | 8.8 (v3.1) | High | 393655 |
| CVE-2020-23814 | XXL-JOB v2.2.0 — Stored Cross Site Scripting | xxl-job | 6.1 (v3.1) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2020-5776 | MAGMI - Cross-Site Request Forgery | magmi | 8.8 (v3.1) | High | 344364 , 344366 , 344370 , 345490 |
| CVE-2020-24223 | Mara CMS 7.5 - Cross-Site Scripting | mara cms | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-24609 | Savsoft Quiz 5 - Stored Cross-Site Scripting | savsoft quiz | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2020-24589 | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection | api manager | 9.1 (v3.1) | Critical | 341256 , 344370 , 344372 , 380018 |
| CVE-2020-5775 | Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery | canvas learning management service | 5.8 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-17456 | SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution | slc-130 | 9.8 (v3.1) | Critical | 340014 , 344363 , 344370 |
| CVE-2020-8209 | Citrix XenMobile Server - Local File Inclusion | xenmobile server | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-6112 | WordPress Sell Media 2.4.1 - Cross-Site Scripting | sell media | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-17463 | Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated) | fuel cms | 9.8 (v3.1) | Critical | 340016 , 341245 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2020-17496 | vBulletin 5.5.4 - 5.6.2- Remote Command Execution | vbulletin | 9.8 (v3.1) | Critical | 340007 , 344360 , 344370 , 390709 |
| CVE-2020-17506 | Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection | web proxy | 9.8 (v3.1) | Critical | 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2020-17505 | Artica Web Proxy 4.30 - OS Command Injection | web proxy | 8.8 (v3.1) | High | 340017 , 340157 , 341245 , 344364 , 344366 , 360147 , 360148 |
| CVE-2020-17362 | Nova Lite < 1.3.9 - Cross-Site Scripting | nova lite | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-11984 | Apache HTTP Server - Remote Code Execution | http server | 9.8 (v3.1) | Critical | 344363 , 390614 , 390626 , 390724 |
| CVE-2020-9036 | Jeedom <=4.0.38 - Cross-Site Scripting | jeedom | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-13820 | Extreme Management Center 8.4.1.24 - Cross-Site Scripting | extreme management center | 6.1 (v3.1) | Medium | 333141 , 340149 , 342259 , 346755 |
| CVE-2020-11110 | Grafana <= 6.7.1 - Cross-Site Scripting | grafana | 5.4 (v3.1) | Medium | 346755 , 350148 |
| CVE-2020-15920 | Mida eFramework <=2.9.0 - Remote Command Execution | eframework | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 347009 |
| CVE-2020-15895 | D-Link DIR-816L 2.x - Cross-Site Scripting | dir-816l firmware | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-11978 | Apache Airflow <=1.10.10 - Remote Code Execution | airflow | 8.8 (v3.1) | High | 344364 |
| CVE-2020-15718 | RosarioSIS 6.7.2 - Cross-Site Scripting | rosariosis | 6.1 (v3.1) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-11546 | SuperWebmailer 7.21.0.01526 - Remote Code Execution | superwebmailer | 9.8 (v3.1) | Critical | 340095 , 393655 |
| CVE-2020-10987 | Tenda AC15 AC1900 version 15.03.05.19 - Command Injection | ac15 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 , 344370 |
| CVE-2020-5766 | SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection | srs simple hits counter | 7.5 (v3.1) | High | 340016 , 340017 , 340144 , 360147 , 360148 , 380122 , 380123 |
| CVE-2020-8191 | Citrix ADC/Gateway - Cross-Site Scripting | application delivery controller firmware | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2020-15505 | MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution | core | 9.8 (v3.1) | Critical | 391213 |
| CVE-2020-15599 | Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting | victor cms | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 345493 , 346755 , 350148 |
| CVE-2020-8163 | Ruby on Rails <5.0.1 - Remote Code Execution | rails | 8.8 (v3.1) | High | 340023 , 344360 , 344370 , 347009 , 390724 |
| CVE-2020-5902 | F5 BIG-IP TMUI - Remote Code Execution | big-ip access policy manager | 9.8 (v3.1) | Critical | 344360 , 347009 , 390709 , 390714 , 392301 |
| CVE-2020-15500 | TileServer GL <=3.0.0 - Cross-Site Scripting | tileservergl | 6.1 (v3.1) | Medium | 333141 , 341245 , 341256 , 342259 , 346755 , 350147 |
| CVE-2020-15415 | DrayTek Vigor - Command Injection | vigor | 9.8 (v3.1) | Critical | 390700 |
| CVE-2020-9483 | SkyWalking SQLI | skywalking | 7.5 (v3.1) | High | 341250 |
| CVE-2020-14413 | NeDi 1.9C - Cross-Site Scripting | nedi | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-13483 | Bitrix24 <=20.0.0 - Cross-Site Scripting | bitrix24 | 6.1 (v3.1) | Medium | 344363 , 344370 , 346755 , 390722 |
| CVE-2020-15038 | Wordpress Plugin Maintenance Mode by SeedProd 5.1.1 - Persistent Cross-Site Scripting | coming soon page, under construction & maintenance mode | 5.4 (v3.1) | Medium | 345493 |
| CVE-2020-9480 | Apache Spark - Authentication Bypass | spark | 9.8 (v3.1) | Critical | 340162 , 340163 |
| CVE-2020-13158 | Artica Proxy Community Edition <4.30.000000 - Local File Inclusion | artica proxy | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-13640 | wpDiscuz <= 5.3.5 - SQL Injection | wpdiscuz | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 341155 , 360147 , 360148 , 380026 |
| CVE-2020-14408 | Agentejo Cockpit 0.10.2 - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium | 346755 |
| CVE-2020-13851 | Artica Pandora FMS 7.44 - Remote Code Execution | pandora fms | 8.8 (v3.1) | High | 344360 , 347009 |
| CVE-2020-11798 | Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal | micollab audio, web & video conferencing | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 |
| CVE-2020-12800 | WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution | drag and drop multiple file upload - contact form 7 | 9.8 (v3.1) | Critical | 300018 |
| CVE-2020-11975 | Apache Unomi - Remote Code Execution | unomi | 9.8 (v3.1) | Critical | 337210 |
| CVE-2020-10546 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10547 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10548 | rConfig 3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-10549 | rConfig <=3.9.4 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 , 380123 |
| CVE-2020-13379 | Grafana 3.0.1-7.0.1 - Server-Side Request Forgery | grafana | 8.2 (v3.1) | High | 340165 |
| CVE-2020-5410 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | 7.5 (v3.1) | High | 390709 |
| CVE-2020-1106 | Microsoft Office SharePoint XSS Vulnerability | sharepoint enterprise server | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13258 | Contentful <=2020-05-21 - Cross-Site Scripting | python example | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13167 | Netsweeper <=6.4.3 - Python Code Injection | netsweeper | 9.8 (v3.1) | Critical | 340087 , 340095 , 390810 |
| CVE-2020-12256 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-12259 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-13121 | Submitty <= 20.04.01 - Open Redirect | submitty | 6.1 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-12832 | WordPress Simple File List - Path Traversal | Simple File List WordPress Plugin | 9.8 (v3.1) | Critical | 382238 |
| CVE-2020-9314 | Oracle iPlanet Web Server 7.0.x - Image Injection | iplanet web server | 4.8 (v3.1) | Medium | 340162 , 340163 |
| CVE-2020-11530 | WordPress Chop Slider 3 - Blind SQL Injection | chop slider | 9.8 (v3.1) | Critical | 340016 , 380026 , 380122 |
| CVE-2020-12720 | vBulletin SQL Injection | vbulletin | 9.8 (v3.1) | Critical | 340016 , 340017 , 340155 , 340157 , 340159 , 341155 , 341245 , 360147 , 360148 |
| CVE-2020-10973 | WAVLINK - Access Control | wn530hg4 firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2020-8982 | Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read | sharefile storagezones controller | 7.5 (v3.1) | High | 340007 |
| CVE-2020-12707 | LeptonCMS 4.5.0 - Persistent Cross-Site Scripting | lepton cms | 6.1 (v3.1) | Medium | 345493 |
| CVE-2020-12706 | php-fusion 9.03.50 - Persistent Cross-Site Scripting | php-fusion | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 346755 |
| CVE-2020-12641 | Roundcube Webmail - Command Injection | webmail | 9.8 (v3.1) | Critical | 340014 |
| CVE-2020-6010 | WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated) | learnpress | 8.8 (v3.1) | High | 341245 , 345493 , 380026 , 380122 |
| CVE-2020-12447 | Onkyo TX-NR585 Web Interface - Directory Traversal | tx-nr585 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2020-12054 | WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting | catch breadcrumb | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2020-11930 | WordPress GTranslate <2.8.52 - Cross-Site Scripting | translate wordpress with gtranslate | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 |
| CVE-2020-11738 | WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion | duplicator | 7.5 (v3.1) | High | 323769 , 336461 , 340748 , 344360 , 347006 , 347009 , 381206 , 390709 |
| CVE-2020-6171 | CLink Office 2.0 - Cross-Site Scripting | clink office | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-8639 | TestLink 1.9.20 - Unrestricted File Upload (Authenticated) | testlink | 8.8 (v3.1) | High | 345493 |
| CVE-2019-17231 | WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS | onetone | 6.1 (v3.1) | Medium | 346755 |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical | 344370 , 344380 , 390614 , 390626 , 390724 |
| CVE-2020-11455 | LimeSurvey 4.1.11 - Local File Inclusion | limesurvey | 9.8 (v3.1) | Critical | 344360 , 347009 |
| CVE-2020-1943 | Apache OFBiz <=16.11.07 - Cross-Site Scripting | ofbiz | 6.1 (v3.1) | Medium | 347198 |
| CVE-2020-11456 | LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting | limesurvey | 5.4 (v3.1) | Medium | 333141 , 340147 , 340148 , 342259 , 346755 |
| CVE-2020-11457 | pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting | pfsense | 5.4 (v3.1) | Medium | 333141 , 342259 , 345493 |
| CVE-2020-9467 | Piwigo 2.10.1 - Cross Site Scripting | piwigo | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2020-10385 | WordPress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting | contact form | 5.4 (v3.1) | Medium | 345493 , 346755 |
| CVE-2020-5722 | Grandstream UCM6200 - SQL Injection | ucm6200 firmware | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 , 344364 , 344366 , 390572 , 393655 |
| CVE-2019-16072 | Enigma NMS < 65.0.0 - Authenticated OS Command Injection | enigma network management solution | 9.8 (v3.1) | Critical | 344364 |
| CVE-2020-9344 | Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting | subversion application lifecycle management | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-10257 | ThemeREX Addons - Remote Code Execution | themerex | 9.8 (v3.1) | Critical | 377360 |
| CVE-2019-20504 | Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution | kace systems management | 9.8 (v3.1) | Critical | 340014 , 340029 , 344363 |
| CVE-2020-10221 | rConfig <= 3.9.4 - Authenticated OS Command Injection | rconfig | 8.8 (v3.1) | High | 344364 , 344366 |
| CVE-2020-10220 | rConfig 3.9 - SQL Injection | rconfig | 9.8 (v3.1) | Critical | 340016 , 340017 , 340144 , 340157 , 341245 , 360147 , 360148 |
| CVE-2020-10189 | ManageEngine Desktop Central Java Deserialization | manageengine desktop central | 9.8 (v3.1) | Critical | 340007 , 344365 , 344380 , 347019 |
| CVE-2020-10173 | Comtrend VR-3033 - Command Injection | vr-3033 firmware | 8.8 (v3.1) | High | 344361 , 344363 |
| CVE-2019-20499 | D-Link DWL-2600AP - Multiple OS Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2019-20500 | D-Link DWL-2600AP - Multiple OS Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2019-20501 | D-Link DWL-2600AP - Multiple OS Command Injection | dwl-2600ap firmware | 7.8 (v3.1) | High | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 390726 , 392647 |
| CVE-2020-5405 | Spring Cloud Config - Local File Inclusion | spring cloud config | 6.5 (v3.1) | Medium | 390709 |
| CVE-2020-9054 | Zyxel NAS Firmware 5.21- Remote Code Execution | nas326 firmware | 9.8 (v3.1) | Critical | 312659 , 340023 , 344360 , 344361 , 344363 , 344370 , 347009 |
| CVE-2020-9547 | FasterXML jackson-databind - Deserialization Remote Code Execution | jackson-databind | 9.8 (v3.1) | Critical | 398008 |
| CVE-2020-9548 | FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution | jackson-databind | 9.8 (v3.1) | Critical | 398008 |
| CVE-2019-19134 | WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting | hero maps premium | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2020-8813 | Cacti v1.2.8 - Remote Code Execution | cacti | 8.8 (v3.1) | High | 340014 |
| CVE-2014-9614 | Netsweeper 4.0.5 - Default Weak Account | netsweeper | 9.8 (v3.1) | Critical | 392301 |
| CVE-2014-9606 | Netsweeper 4.0.8 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2014-9607 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-9608 | Netsweeper 4.0.3 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 |
| CVE-2014-9615 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2014-9609 | Netsweeper 4.0.8 - Directory Traversal | netsweeper | 5.3 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-6970 | Bosch Security Systems Dinion NBN-498 - Web Interface XML Injection | nbn-498 dinion2x day/night ip cameras firmware | 9.8 (v3.1) | Critical | 390726 , 392301 , 392647 , 392648 |
| CVE-2013-2679 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2020-9043 | WordPress wpCentral <1.5.1 - Information Disclosure | wpcentral | 8.8 (v3.1) | High | 377360 |
| CVE-2020-7209 | LinuxKI Toolset <= 6.01 - Remote Command Execution | linuxki | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 347009 |
| CVE-2014-8739 | WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload | creative contact form | 9.8 (v3.1) | Critical | 300016 |
| CVE-2020-8656 | EyesOfNetwork - Hardcoded API Key & SQL Injection | eyesofnetwork | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 360147 , 360148 , 380026 , 380122 |
| CVE-2020-8771 | WordPress Time Capsule < 1.21.16 - Authentication Bypass | wp time capsule | 9.8 (v3.1) | Critical | 392301 |
| CVE-2013-2684 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 6.1 (v3.1) | Medium | 392301 |
| CVE-2013-2683 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 5.3 (v3.1) | Medium | 392301 |
| CVE-2013-2681 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-8641 | Lotus Core CMS 1.0.1 - Local File Inclusion | lotus core cms | 8.8 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-2680 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 7.5 (v3.1) | High | 392301 |
| CVE-2013-2682 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 4.3 (v3.1) | Medium | 392301 |
| CVE-2012-5686 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 9.8 (v3.1) | Critical | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2013-2678 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | 8.1 (v3.1) | High | 392301 |
| CVE-2020-8615 | Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery | tutor lms | 6.5 (v3.1) | Medium | 345490 , 377360 |
| CVE-2020-8115 | Revive Adserver <=5.0.3 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium | 346755 , 350148 |
| CVE-2013-2621 | Telaen => v1.3.1 - Open Redirect | telaen | 6.1 (v3.1) | Medium | 320007 |
| CVE-2020-8549 | WordPress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting | strong testimonials | 6.1 (v3.1) | Medium | 345493 , 346755 |
| CVE-2020-8515 | Multiple DrayTek Products - Pre-authentication Remote Root Code Execution | vigor2960 firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2020-8512 | IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting | icewarp server | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2013-4864 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 9.8 (v3.1) | Critical | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4863 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 8.8 (v3.1) | High | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4862 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 8.1 (v3.1) | High | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4861 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 6.5 (v3.1) | Medium | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2013-4865 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | 6.5 (v3.1) | Medium | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2019-19824 | TOTOLINK Realtek SD Routers - Remote Command Injection | a3002ru firmware | 8.8 (v3.1) | High | 340014 |
| CVE-2019-19822 | TOTOLINK/Realtek Routers - Information Disclosure | a3002ru firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2019-19823 | TOTOLINK/Realtek Routers - Information Disclosure | a3002ru firmware | 7.5 (v3.1) | High | 390716 |
| CVE-2020-7991 | Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) | framework | 8.8 (v3.1) | High | 340147 , 340148 , 342259 , 345490 , 345493 , 346755 , 350147 , 350148 , 398001 |
| CVE-2020-7980 | Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution | aptus web | 9.8 (v3.1) | Critical | 344360 |
| CVE-2019-19411 | Huawei Firewall - Local File Inclusion | usg9500 | 3.7 (v3.1) | Low | 347009 , 390709 |
| CVE-2020-7107 | WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting | ultimate faq | 6.1 (v3.1) | Medium | 333140 , 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2020-7108 | WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting | learndash | 5.4 (v3.1) | Medium | 340003 , 341266 , 346755 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-16469 | Adobe Experience Manager - Expression Language Injection | experience manager | 7.5 (v3.1) | High | 393655 |
| CVE-2011-4336 | Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting | tikiwiki cms/groupware | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2020-2096 | Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting | gitlab hook | 6.1 (v3.1) | Medium | 341266 |
| CVE-2019-20210 | WordPress CTHthemes - Cross-Site Scripting | citybook | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4561 | Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting | ultimate-weather | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-20224 | Pandora FMS 7.0NG - Remote Command Injection | pandora fms | 8.8 (v3.1) | High | 344363 |
| CVE-2020-5504 | phpMyAdmin 5.0.0 - SQL Injection | phpmyadmin | 8.8 (v3.1) | High | 340145 , 340156 , 341145 , 390727 , 392301 , 392648 |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-18859 | Digi AnywhereUSB 14 - Reflective Cross-Site Scripting | anywhereusb/14 firmware | 6.1 (v3.1) | Medium | 340147 , 341266 , 346755 , 390727 , 392301 , 392648 |
| CVE-2014-8673 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 9.8 (v3.1) | Critical | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2020-5307 | PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection | dairy farm shop management system | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 |
| CVE-2020-5192 | Hospital Management System 4.0 - 'searchdata' SQL Injection | hospital management system | 8.8 (v3.1) | High | 331028 , 340016 , 340017 , 340144 , 340157 , 345493 , 360147 , 360148 , 390727 , 392301 , 392648 |
| CVE-2020-5191 | Hospital Management System 4.0 - Persistent Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium | 342259 , 345493 |
| CVE-2014-8674 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.4 (v3.1) | Medium | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2019-9553 | Bolt CMS 3.6.4 - Cross-Site Scripting | bolt | 6.1 (v3.1) | Medium | 340148 , 341256 , 346755 |
| CVE-2019-9556 | Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting | an5506-04-f firmware | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2019-20141 | WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting | neon | 6.1 (v3.1) | Medium | 333141 , 340099 , 340147 , 341099 , 342259 , 347198 , 350147 , 350148 |
| CVE-2019-19781 | Citrix ADC and Gateway - Directory Traversal | application delivery controller firmware | 9.8 (v3.1) | Critical | 390716 |
| CVE-2014-4535 | Import Legacy Media <= 0.1 - Cross-Site Scripting | import legacy media | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4536 | Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting | infusionsoft gravity forms | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4539 | Movies <= 0.6 - Cross-Site Scripting | movies | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4544 | Podcast Channels < 0.28 - Cross-Site Scripting | podcast channels | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-4550 | Shortcode Ninja <= 1.4 - Cross-Site Scripting | ninja | 6.1 (v3.1) | Medium | 340147 , 341266 |
| CVE-2014-4558 | WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting | swipehq-payment-gateway-woocommerce | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2014-4592 | WP Planet <= 0.1 - Cross-Site Scripting | wp-planet | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2019-10758 | mongo-express Remote Code Execution | mongo-express | 9.9 (v3.1) | Critical | 345240 , 360151 , 380026 |
| CVE-2019-19908 | phpMyChat-Plus 1.98 - Cross-Site Scripting | phpmychat-plus | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-19742 | D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting | dir-615 firmware | 4.8 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 344370 , 350147 |
| CVE-2019-7481 | SonicWall SRA 4600 VPN - SQL Injection | sma 100 firmware | 7.5 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2019-19731 | Roxy Fileman 1.4.5 - Directory Traversal | roxy fileman | 7.5 (v3.1) | High | 340007 |
| CVE-2019-19743 | D-Link DIR-615 - Privilege Escalation | dir-615 t1 firmware | 6.5 (v3.1) | Medium | 345493 |
| CVE-2019-19368 | Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting | rumpus | 6.1 (v3.1) | Medium | 342259 , 350147 |
| CVE-2019-19740 | Octeth Oempro 4.8 - 'CampaignID' SQL Injection | oempro | 9.8 (v3.1) | Critical | 392301 |
| CVE-2019-17270 | Yachtcontrol Webapplication 1.0 - Remote Command Injection | yachtcontrol | 9.8 (v3.1) | Critical | 344360 , 347009 , 390904 |
| CVE-2019-14251 | T24 Web Server - Local File Inclusion | t24 | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2018-7282 | TITool PrintMonitor - Blind SQL Injection | printmonitor | 9.8 (v3.1) | Critical | 344370 |
| CVE-2019-7194 | QNAP Photo Station < 6.0.3 - Remote Code Execution | photo station | 9.8 (v3.1) | Critical | 340128 , 380018 , 380026 , 390801 |
| CVE-2019-17554 | Apache Olingo OData 4.0 - XML External Entity Injection | olingo | 5.5 (v3.1) | Medium | 344372 , 345493 |
| CVE-2019-18922 | Allied Telesis AT-GS950/8 - Local File Inclusion | at-gs950/8 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2011-3600 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.1) | High | 344372 |
| CVE-2014-8356 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.1) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2019-16758 | Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal | services monitor firmware | 7.5 (v3.1) | High | 346019 |
| CVE-2019-18957 | MicroStrategy Library <11.1.3 - Cross-Site Scripting | microstrategy library | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2012-5193 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380026 |
| CVE-2019-18665 | DOMOS 5.5 - Local File Inclusion | domos | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2019-18396 | Technicolor TD5130.2 - Remote Command Execution | td5130v2 firmware | 7.2 (v3.1) | High | 344361 , 344363 |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | 7.5 (v3.1) | High | 340029 , 341256 , 342259 , 344360 , 344372 , 380018 |
| CVE-2010-4239 | Tiki Wiki CMS Groupware 5.2 - Local File Inclusion | tikiwiki cms/groupware | 9.8 (v3.1) | Critical | 340007 , 390109 |
| CVE-2019-11043 | PHP-FPM Path Info Buffer Underflow - Remote Code Execution | php | 9.8 (v3.1) | Critical | 390714 |
| CVE-2019-16662 | rConfig 3.9.2 - Remote Code Execution | rconfig | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 347009 |
| CVE-2019-8086 | Adobe Experience Manager - XML External Entity Injection | experience manager | 7.5 (v3.1) | High | 330925 |
| CVE-2019-18393 | Ignite Realtime Openfire <4.42 - Local File Inclusion | openfire | 5.3 (v3.1) | Medium | 344365 , 347019 |
| CVE-2019-18371 | Xiaomi Mi WiFi R3G Routers - Local file Inclusion | millet router 3g firmware | 7.5 (v3.1) | High | 347009 , 390709 |
| CVE-2019-10475 | Jenkins build-metrics 1.3 - Cross-Site Scripting | build-metrics | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2015-9499 | WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE | showbiz pro | 9.8 (v3.1) | Critical | 300019 , 300029 |
| CVE-2019-11253 | Kubernetes API Server - YAML Parsing DoS (Billion Laughs) | kubernetes | 7.5 (v3.1) | High | 391213 |
| CVE-2019-13392 | MindPalette NateMail 3.0.15 - Cross-Site Scripting | natemail | 6.1 (v3.1) | Medium | 342259 , 350147 , 350148 |
| CVE-2019-16278 | nostromo 1.9.6 - Remote Code Execution | nostromo nhttpd | 9.8 (v3.1) | Critical | 390714 , 392301 |
| CVE-2019-17538 | Jiangnan Online Judge 0.8.0 - Local File Inclusion | jiangnan online judge | 7.5 (v3.1) | High | 340007 , 344360 , 347009 |
| CVE-2019-17506 | D-Link DIR-868L/817LW - Information Disclosure | dir-868l b1 firmware | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2019-17504 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 6.1 (v3.1) | Medium | 312863 , 340147 , 340148 , 341266 , 342259 , 344370 , 346755 , 390716 |
| CVE-2019-17503 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 5.3 (v3.1) | Medium | 312863 , 340147 , 340148 , 341266 , 342259 , 344370 , 346755 , 390716 |
| CVE-2015-9480 | WordPress RobotCPA 5 - Directory Traversal | robotcpa | 7.5 (v3.1) | High | 320006 |
| CVE-2019-17418 | MetInfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2019-16931 | WordPress Visualizer <3.3.1 - Cross-Site Scripting | visualizer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2019-16932 | Visualizer <3.3.1 - Blind Server-Side Request Forgery | visualizer | 10.0 (v3.1) | Critical | 344362 |
| CVE-2019-16996 | Metinfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2019-16997 | Metinfo 7.0.0 beta - SQL Injection | metinfo | 7.2 (v3.1) | High | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2019-16920 | D-Link Routers - Remote Code Execution | dir-655 firmware | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 , 344365 , 344366 |
| CVE-2015-9414 | WordPress Symposium <=15.8.1 - Cross-Site Scripting | wp-symposium | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-10092 | Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting | http server | 6.1 (v3.1) | Medium | 344365 |
| CVE-2019-16759 | vBulletin 5.0.0-5.5.4 - Remote Command Execution | vbulletin | 9.8 (v3.1) | Critical | 341245 |
| CVE-2019-16383 | MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection | moveit transfer | 9.4 (v3.1) | Critical | 344366 , 361149 , 380026 , 380122 |
| CVE-2019-16693 | phpIPAM 1.4 - SQL-Injection | phpipam | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 |
| CVE-2015-9406 | mTheme Unus < 2.3 - Directory Traversal | mtheme-unus | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2019-16525 | WordPress Checklist <1.1.9 - Cross-Site Scripting | checklist | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10976 | Safe Editor Plugin < 1.2 - CSS/JS-injection | safe editor | 6.1 (v3.1) | Medium | 346755 |
| CVE-2016-10993 | ScoreMe Theme - Cross-Site Scripting | scoreme | 5.4 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10960 | WordPress wSecure Lite < 2.4 - Remote Code Execution | wsecure | 8.8 (v3.1) | High | 392301 |
| CVE-2016-10956 | WordPress Mail Masta 1.0 - Local File Inclusion | mail-masta | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2016-10973 | Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting | brafton | 6.1 (v3.1) | Medium | 346755 , 347198 |
| CVE-2019-16332 | WordPress API Bearer Auth <20190907 - Cross-Site Scripting | api bearer auth | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-10940 | WordPress zm-gallery plugin 1.0 SQL Injection | zm-gallery | 7.2 (v3.1) | High | 340017 , 340156 , 340157 |
| CVE-2019-3759 | RSA IG&L Aveksa 7.1.1 - Remote Code Execution | rsa identity governance and lifecycle | 8.1 (v3.1) | High | 330791 , 340152 |
| CVE-2017-18598 | WordPress Qards - Cross-Site Scripting | qards | 6.1 (v3.1) | Medium | 393749 |
| CVE-2019-16123 | PilusCart <=1.4.1 - Local File Inclusion | piluscart | 7.5 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2019-6793 | GitLab Enterprise Edition - Server-Side Request Forgery | gitlab | 7.0 (v3.1) | High | 390616 |
| CVE-2019-15813 | Sentrifugo 3.2 - File Upload Restriction Bypass | sentrifugo | 8.8 (v3.1) | High | 345493 |
| CVE-2019-14470 | WordPress UserPro 4.9.32 - Cross-Site Scripting | instagram-php-api | 6.1 (v3.0) | Medium | 333141 , 347198 |
| CVE-2019-15889 | WordPress Download Manager <2.9.94 - Cross-Site Scripting | wordpress download manager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2019-15829 | Gallery Photoblocks < 1.1.43 - Cross-Site Scripting | gallery photoblocks | 4.8 (v3.0) | Medium | 346755 , 347198 |
| CVE-2019-13608 | Citrix StoreFront Server - XML External Entity | storefront server | 7.5 (v3.1) | High | 344372 , 391213 |
| CVE-2019-15811 | DomainMOD <=4.13.0 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 333141 , 340149 , 341256 , 342259 , 346755 |
| CVE-2019-15713 | WordPress My Calendar <= 3.1.9 - Cross-Site Scripting | my calendar | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-18590 | Timesheet Plugin < 0.1.5 - Cross-Site Scripting | timesheet | 6.1 (v3.0) | Medium | 341266 , 346755 , 377360 |
| CVE-2019-13237 | Alkacon OpenCMS 10.5.x - Local File inclusion | opencms apollo template | 4.3 (v3.1) | Medium | 392301 |
| CVE-2019-15642 | Webmin < 1.920 - Authenticated Remote Code Execution | webmin | 8.8 (v3.0) | High | 344362 , 344366 |
| CVE-2019-15501 | L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting | listserv | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-8446 | Jira Improper Authorization | jira server | 5.3 (v3.1) | Medium | 392301 |
| CVE-2017-18580 | WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution | shortcodes ultimate | 9.8 (v3.0) | Critical | 377360 |
| CVE-2018-20985 | WordPress Payeezy Pay <=2.97 - Local File Inclusion | wp payeezy pay | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-10924 | Wordpress Zedna eBook download <1.2 - Local File Inclusion | zedna ebook download | 7.5 (v3.0) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2019-11013 | Nimble Streamer <=3.5.4-9 - Local File Inclusion | nimble streamer | 6.5 (v3.0) | Medium | 347009 |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical | 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical | 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High | 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2017-18516 | LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | 341266 , 346755 | |
| CVE-2017-18536 | WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting | stop user enumeration | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-18537 | Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting | visitors online | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18556 | Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting | google analytics | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18557 | Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting | google maps | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18558 | Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting | testimonials | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18562 | Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting | error log viewer | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18564 | Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting | sender | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18565 | Updater by BestWebSoft < 1.35 - Cross-Site Scripting | updater | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18517 | Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | 341266 , 346755 | |
| CVE-2017-18518 | SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting | smtp | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18527 | Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting | pagination | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18528 | PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting | pdf & print | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18529 | PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting | promobar | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18530 | Rating by BestWebSoft < 0.2 - Cross-Site Scripting | rating | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18532 | Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting | realty | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18566 | User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting | user role | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14430 | YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection | youphptube | 5.3 (v3.0) | Medium | 392301 |
| CVE-2015-9323 | 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection | 404 to 301 | 9.8 (v3.1) | Critical | 340017 , 380122 |
| CVE-2019-15107 | Webmin <= 1.920 - Unauthenticated Remote Command Execution | webmin | 9.8 (v3.1) | Critical | 340023 , 344360 , 344361 , 344363 |
| CVE-2017-18542 | Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting | zendesk help center | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14789 | Custom 404 Pro < 3.2.8 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2015-9312 | NewStatPress <=1.0.4 - Cross-Site Scripting | newstatpress | 6.1 (v3.0) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2019-14427 | Ultimate Loan Manager 2.0 - Cross-Site Scripting | ultimate loan manager | 6.1 (v3.0) | Medium | 345493 , 390585 |
| CVE-2019-14974 | SugarCRM Enterprise 9.0.0 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium | 340112 , 346755 , 350148 |
| CVE-2019-14530 | OpenEMR <5.0.2 - Local File Inclusion | openemr | 8.8 (v3.1) | High | 344360 , 347009 , 390709 |
| CVE-2017-18487 | AdPush < 1.44 - Cross-Site Scripting | google adsense | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18490 | Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting | contact form multi | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18491 | Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting | contact form | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18492 | Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting | contact form to db | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18493 | Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting | custom admin page | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18494 | Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting | custom search | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18496 | Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting | htaccess | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-13462 | Lansweeper Unauthenticated SQL Injection | lansweeper | 9.1 (v3.0) | Critical | 331028 , 340016 , 340155 , 340157 , 341155 , 341245 , 344361 , 360147 , 360148 |
| CVE-2017-18500 | Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting | social buttons pack | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18501 | Social Login by BestWebSoft < 0.2 - Cross-Site Scripting | social login | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18502 | Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting | subscriber | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-18505 | BestWebSoft's Twitter < 2.55 - Cross-Site Scripting | twitter button | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2019-14950 | WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting | live chat | 6.1 (v3.0) | Medium | 344370 , 346755 , 380026 |
| CVE-2019-11581 | Atlassian Jira Server-Side Template Injection | jira | 9.8 (v3.1) | Critical | 311299 |
| CVE-2019-14312 | Aptana Jaxer 1.0.3.4547 - Local File inclusion | jaxer | 6.5 (v3.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2019-14750 | osTicket < 1.12.1 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 346755 |
| CVE-2019-14696 | Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting | open-school | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-18570 | Planon <Live Build 41 - Cross-Site Scripting | planon | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2019-14322 | Pallets Werkzeug <0.15.5 - Local File Inclusion | Windows | 7.5 (v3.1) | High | 390716 |
| CVE-2019-10266 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 7.5 (v3.0) | High | 344372 |
| CVE-2019-10263 | Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection | cloud backup suite | 6.1 (v3.0) | Medium | 344372 |
| CVE-2019-2767 | Oracle Business Intelligence Publisher - XML External Entity Injection | bi publisher | 7.2 (v3.0) | High | 344370 , 380018 |
| CVE-2019-14205 | WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion | adaptive images | 7.5 (v3.1) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2019-14206 | Nevma Adaptive Images - Arbitrary File Deletion | adaptive images | 7.5 (v3.1) | High | 340007 , 377360 |
| CVE-2019-12725 | Zeroshell 3.9.0 - Remote Command Execution | zeroshell | 9.8 (v3.0) | Critical | 340023 , 340029 , 344360 , 344361 , 344363 , 344370 , 347009 , 390722 |
| CVE-2019-1010287 | Timesheet Next Gen <=1.5.3 - Cross-Site Scripting | timesheet next gen | 6.1 (v3.0) | Medium | 340147 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-1943 | CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities | sg200-50 firmware | 6.1 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2019-12985 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 , 340029 , 344364 , 344366 , 344370 |
| CVE-2019-12986 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 , 340029 , 344364 , 344366 , 344370 |
| CVE-2019-12987 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 340014 |
| CVE-2019-12988 | Citrix SD-WAN Center - Remote Command Injection | netscaler sd-wan | 9.8 (v3.0) | Critical | 393655 |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SD-WAN - SQL Injection | netscaler sd-wan | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2019-13372 | D-Link Central WiFi Manager CWM(100) - Remote Code Execution | central wifimanager | 9.8 (v3.1) | Critical | 344370 |
| CVE-2018-11686 | FlexPaper/FlowPaper 2.3.6 - Remote Code Execution | flowpaper | 9.8 (v3.0) | Critical | 340029 , 344361 , 344364 |
| CVE-2018-15811 | DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization | dotnetnuke | 7.5 (v3.1) | High | 344365 , 344370 |
| CVE-2018-18325 | DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization | dotnetnuke | 7.5 (v3.1) | High | 344365 , 344370 |
| CVE-2019-10717 | BlogEngine.NET 3.3.6/3.3.7 - 'path' Directory Traversal | blogengine.net | 7.1 (v3.0) | High | 340007 |
| CVE-2018-11227 | Monstra CMS <=3.0.4 - Cross-Site Scripting | monstra cms | 6.1 (v3.0) | Medium | 333141 , 340248 , 342259 , 346755 |
| CVE-2019-7256 | eMerge E3 1.00-06 - Remote Code Execution | linear emerge essential firmware | 9.8 (v3.1) | Critical | 340029 , 344360 , 344361 , 344363 , 344370 , 347009 |
| CVE-2019-7254 | eMerge E3 1.00-06 - Local File Inclusion | linear emerge essential firmware | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2019-7255 | Linear eMerge E3 - Cross-Site Scripting | linear emerge essential firmware | 6.1 (v3.1) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-14916 | Loytec LGATE-902 <6.4.2 - Local File Inclusion | lgate-902 | 9.1 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-14918 | LOYTEC LGATE-902 6.3.2 - Local File Inclusion | lgate-902 firmware | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-12581 | Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting | uag2100 | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2019-12935 | Shopware < 5.5.8 - Cross-Site Scripting | shopware | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2019-2729 | Oracle WebLogic Server Administration Console - Remote Code Execution | communications diameter signaling router | 9.8 (v3.1) | Critical | 344361 , 344370 , 393655 |
| CVE-2018-20470 | Tyto Sahi pro 7.x/8.x - Local File Inclusion | sahi pro | 7.5 (v3.1) | High | 340007 |
| CVE-2019-7315 | Genie Access WIP3BVAF IP Camera - Local File Inclusion | wip3bvaf | 7.5 (v3.0) | High | 347009 |
| CVE-2019-11269 | Spring Security OAuth - Open Redirector | spring security oauth | 5.4 (v3.1) | Medium | 390703 , 390727 , 392301 , 392648 |
| CVE-2019-9880 | WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure | wpgraphql | 9.1 (v3.0) | Critical | 344361 , 344363 |
| CVE-2019-7671 | Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting | flexair | 9.0 (v3.1) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390726 , 392647 |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | 8.8 (v3.0) | High | 342259 , 344360 , 344363 , 344364 , 344366 , 350147 , 390724 , 390726 , 392647 |
| CVE-2019-12276 | GrandNode 4.40 - Local File Inclusion | grandnode | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2019-12616 | phpMyAdmin 4.8 - Cross-Site Request Forgery | phpmyadmin | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-13379 | Fortinet FortiOS - Credentials Disclosure | fortios | 9.8 (v3.1) | Critical | 340007 |
| CVE-2018-13380 | Fortinet FortiOS - Cross-Site Scripting | fortios | 6.1 (v3.1) | Medium | 333141 , 340147 , 341266 , 342259 , 347198 |
| CVE-2019-11580 | Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution | crowd | 9.8 (v3.1) | Critical | 391213 |
| CVE-2018-5406 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 8.8 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2019-12593 | IceWarp Mail Server <=10.4.4 - Local File Inclusion | mail server | 7.5 (v3.0) | High | 340007 , 344360 , 344365 , 347019 |
| CVE-2018-5404 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-5405 | KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities | kace systems management appliance firmware | 5.4 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2019-11370 | Carel pCOWeb <B1.2.4 - Cross-Site Scripting | pcoweb card firmware | 5.4 (v3.0) | Medium | 342259 |
| CVE-2019-12461 | WebPort 1.19.1 - Cross-Site Scripting | web port | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-9670 | Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection | zimbra collaboration suite | 9.8 (v3.1) | Critical | 344372 |
| CVE-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting | zimbra collaboration suite | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-0221 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350148 |
| CVE-2019-12314 | Deltek Maconomy 2.2.5 - Local File Inclusion | maconomy | 9.8 (v3.0) | Critical | 347009 |
| CVE-2019-10685 | Prinect Archive System 2015 Release 2.6 - Cross-Site Scripting | prinect archiver | 6.1 (v3.0) | Medium | 340147 , 341256 , 341266 , 346755 , 390585 |
| CVE-2018-7841 | Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection | u.motion builder | 9.8 (v3.1) | Critical | 344364 , 344366 |
| CVE-2019-3402 | Jira < 8.1.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 390585 |
| CVE-2019-8937 | HotelDruid 2.3.0 - Cross-Site Scripting | hoteldruid | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-7285 | XStream <1.4.6/1.4.10 - Remote Code Execution | xstream | 9.8 (v3.1) | Critical | 344363 |
| CVE-2018-18800 | PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection | welcome to our resort | 9.8 (v3.0) | Critical | 331028 , 340016 , 340157 , 341245 , 360147 , 380123 |
| CVE-2019-11844 | RICOH SP 4520DN Printer - HTML Injection | sp 4520dn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2019-11845 | RICOH SP 4510DN Printer - HTML Injection | sp 4510dn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2019-11846 | dotCMS 5.1.1 - HTML Injection | dotcms | 6.1 (v3.0) | Medium | 345493 |
| CVE-2019-8390 | qdPM 9.1 - 'search[keywords]' Cross-Site Scripting | qdpm | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 350147 |
| CVE-2019-9618 | WordPress GraceMedia Media Player 1.0 - Local File Inclusion | gracemedia media player | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-12300 | Seagate NAS OS 4.3.15.1 - Open Redirect | nas os | 6.1 (v3.0) | Medium | 340163 |
| CVE-2018-16139 | BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting | bibliopac | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2019-11510 | Pulse Connect Secure SSL VPN Arbitrary File Read | connect secure | 10.0 (v3.1) | Critical | 347009 |
| CVE-2019-11398 | UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting | ulicms | 6.1 (v3.0) | Medium | 340247 , 340248 , 342259 , 344370 , 346755 |
| CVE-2019-11507 | Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected) | connect secure | 6.1 (v3.1) | Medium | 333141 , 341256 , 342259 , 346755 , 347198 , 350148 , 390722 |
| CVE-2018-20503 | SirsiDynix e-Library 3.5.x - Cross-Site Scripting | 8100l/8 firmware | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2019-5434 | Revive Adserver 4.2 - Remote Code Execution | revive adserver | 9.8 (v3.0) | Critical | 344362 , 344365 , 344370 |
| CVE-2019-3799 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | 6.5 (v3.1) | Medium | 347009 , 390709 |
| CVE-2018-20824 | Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2018-16716 | NCBI ToolBox - Directory Traversal | ncbi toolbox | 9.1 (v3.0) | Critical | 344360 , 347009 , 390709 |
| CVE-2018-10383 | Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting | securelinx spider firmware | 6.1 (v3.0) | Medium | 333141 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-9621 | Zimbra Collaboration Suite - SSRF | collaboration server | 7.5 (v3.1) | High | 344372 |
| CVE-2019-2616 | Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection | business intelligence publisher | 7.2 (v3.1) | High | 330791 , 340152 |
| CVE-2019-2588 | Oracle Business Intelligence - Path Traversal | business intelligence publisher | 4.9 (v3.0) | Medium | 340007 , 344365 , 347019 |
| CVE-2019-9955 | Zyxel - Cross-Site Scripting | atp200 firmware | 6.1 (v3.0) | Medium | 346755 |
| CVE-2019-7219 | Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting | webaccess | 6.1 (v3.0) | Medium | 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2019-4013 | IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload | bigfix platform | 9.9 (v3.0) | Critical | 392301 |
| CVE-2019-7139 | Magento - SQL Injection | magento | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 |
| CVE-2019-10647 | ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE) | zzzphp | 9.8 (v3.0) | Critical | 340162 , 340163 |
| CVE-2019-9922 | Joomla! Harmis Messenger 1.2.2 - Local File Inclusion | je messenger | 7.5 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2019-10232 | Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection | gestionnaire libre de parc informatique | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340155 , 340157 , 341155 , 341245 , 360147 , 360148 |
| CVE-2019-5418 | Rails File Content Disclosure | rails | 7.5 (v3.1) | High | 390719 |
| CVE-2019-10068 | Kentico CMS Insecure Deserialization Remote Code Execution | kentico | 9.8 (v3.1) | Critical | 341256 |
| CVE-2019-3396 | Atlassian Confluence Server - Path Traversal | confluence | 9.8 (v3.1) | Critical | 392301 |
| CVE-2019-9912 | WP Google Maps < 7.10.43 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2018-18798 | School Attendance Monitoring System 1.0 - SQL Injection | school attendance monitoring system | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2018-19276 | OpenMRS Platform < 2.24.0 - Insecure Object Deserialization | openmrs | 9.8 (v3.1) | Critical | 330791 , 340152 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2018-20526 | Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal | roxy fileman | 9.8 (v3.0) | Critical | 330791 , 340152 |
| CVE-2019-7238 | Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution | nexus | 9.8 (v3.1) | Critical | 344360 , 344363 , 344370 |
| CVE-2019-9083 | SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection | sqlitemanager | 9.8 (v3.0) | Critical | 341145 , 341245 |
| CVE-2018-19365 | Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal | streaming engine | 9.1 (v3.1) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-20525 | Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal | roxy fileman | 9.1 (v3.1) | Critical | 330791 , 340152 |
| CVE-2018-10093 | AudioCodes 420HD - Remote Code Execution | 420hd ip phone firmware | 8.8 (v3.0) | High | 344360 , 347009 |
| CVE-2018-18762 | SaltOS Erp Crm 3.1 r8126 - Database File Download | saltos | 6.5 (v3.0) | Medium | 390716 |
| CVE-2019-7439 | JioFi 4G M2S 1.0.2 - Denial of Service | jiofi 4g m2s firmware | 6.5 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 350147 , 350148 |
| CVE-2019-7438 | JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting | jiofi 4g m2s firmware | 6.1 (v3.0) | Medium | 340149 , 341256 , 342259 , 344361 , 344364 , 344370 , 350147 |
| CVE-2019-9762 | PHPSHE 1.7 - SQL Injection | phpshe | 9.8 (v3.0) | Critical | 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 360147 , 360148 |
| CVE-2018-18809 | TIBCO JasperReports Library - Directory Traversal | jasperreports library | 6.5 (v3.1) | Medium | 340007 |
| CVE-2019-3778 | Spring Security OAuth - Open Redirector | spring security oauth | 6.5 (v3.1) | Medium | 390703 , 390727 , 392301 , 392648 |
| CVE-2019-9591 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9592 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9593 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium | 340003 , 340147 , 341266 , 342259 , 390585 , 390727 , 392301 , 392648 |
| CVE-2019-9194 | elFinder <= 2.1.47 - Command Injection | elfinder | 9.8 (v3.0) | Critical | 390700 , 393781 |
| CVE-2019-9082 | ThinkPHP < 3.2.4 - Remote Code Execution | thinkphp | 8.8 (v3.1) | High | 344361 , 393753 |
| CVE-2019-9041 | ZZZCMS 1.6.1 - Remote Code Execution | zzzphp | 7.2 (v3.0) | High | 360153 , 380026 |
| CVE-2019-8982 | Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery | wavemarker studio | 9.6 (v3.0) | Critical | 344360 , 347009 |
| CVE-2019-6340 | Drupal - Remote Code Execution | drupal | 8.1 (v3.1) | High | 392301 |
| CVE-2019-8903 | Totaljs <3.2.3 - Local File Inclusion | total.js | 7.5 (v3.0) | High | 346019 |
| CVE-2019-8394 | Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload | manageengine servicedesk plus | 6.5 (v3.1) | Medium | 345493 |
| CVE-2018-17431 | Comodo Unified Threat Management Web Console - Remote Code Execution | unified threat management firewall | 9.8 (v3.1) | Critical | 344361 , 344362 , 344364 , 390722 |
| CVE-2019-3911 | LabKey Server Community Edition <18.3.0 - Cross-Site Scripting | labkey server | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2019-6802 | Pypiserver <1.2.5 - Carriage Return Line Feed Injection | pypiserver | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2019-5893 | OpenSource ERP 6.3.1. - SQL Injection | open source erp | 9.8 (v3.0) | Critical | 341250 , 344366 |
| CVE-2018-16167 | LogonTracer <=1.2.0 - Remote Command Injection | logontracer | 9.8 (v3.0) | Critical | 340014 , 344364 , 344366 |
| CVE-2018-20463 | WordPress JSmol2WP <=1.07 - Local File Inclusion | jsmol2wp | 7.5 (v3.0) | High | 340007 , 340077 , 340165 , 344360 , 381206 |
| CVE-2018-20462 | WordPress JSmol2WP <=1.07 - Cross-Site Scripting | jsmol2wp | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2018-20418 | Craft CMS 3.0.25 - Cross-Site Scripting | craft cms | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 344365 , 346755 |
| CVE-2018-20367 | WSTMart 2.0.8 - Cross-Site Scripting | wstmart | 6.1 (v3.0) | Medium | 345493 |
| CVE-2018-17246 | Kibana - Local File Inclusion | kibana | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-1000856 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-19933 | Bolt CMS < 3.6.2 - Cross-Site Scripting | bolt cms | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2018-18923 | Ticketly 1.0 - 'kind_id' SQL Injection | ticketly | 9.8 (v3.0) | Critical | 340156 , 380122 |
| CVE-2018-1821 | IBM Operational Decision Manager 8.x - XML External Entity Injection | operational decision manager | 9.1 (v3.0) | Critical | 330791 , 340152 , 345493 |
| CVE-2018-8033 | Apache OFBiz - XML External Entity Injection | ofbiz | 7.5 (v3.0) | High | 341256 , 344370 , 344372 |
| CVE-2018-7690 | Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure | fortify software security center | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-7691 | Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2) | fortify software security center | 6.5 (v3.0) | Medium | 330791 , 340152 |
| CVE-2018-19439 | Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting | secure global desktop | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2018-1000861 | Jenkins - Remote Command Injection | jenkins | 9.8 (v3.1) | Critical | 344370 , 390722 |
| CVE-2018-20009 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-20010 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-20011 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19892 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19914 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-19915 | DomainMOD <=4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-19753 | Tarantella Enterprise <3.11 - Local File Inclusion | tarantella enterprise | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-19877 | Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting | loganalyzer | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 , 360030 |
| CVE-2018-1002000 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 7.2 (v3.0) | High | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002001 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002002 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002003 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002004 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002005 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002006 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002007 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002008 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-1002009 | WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting | arigato autoresponder and newsletter | 4.8 (v3.0) | Medium | 340156 , 344370 , 380122 , 390726 , 392647 |
| CVE-2018-19749 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-19751 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-19752 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2018-19458 | PHP Proxy 3.0.3 - Local File Inclusion | php-proxy | 7.5 (v3.0) | High | 340162 , 340165 , 344360 , 347009 |
| CVE-2018-19326 | Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion | vmg1312-b10d firmware | 7.5 (v3.0) | High | 347009 |
| CVE-2018-18755 | K-iwi Framework 1775 - SQL Injection | k-iwi | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 340157 , 341155 , 341245 , 344361 , 360147 , 360148 , 380026 |
| CVE-2018-18761 | SaltOS Erp Crm 3.1 r8126 - SQL Injection | saltos | 9.8 (v3.1) | Critical | 331028 , 340016 , 340155 , 340156 , 340157 , 341155 , 341245 , 360147 , 380026 |
| CVE-2018-18763 | SaltOS Erp Crm 3.1 r8126 - SQL Injection (2) | saltos | 9.8 (v3.0) | Critical | 331028 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 |
| CVE-2018-18795 | School Event Management System 1.0 - SQL Injection | school event management system | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 360147 , 360148 |
| CVE-2018-18801 | E-Negosyo System 1.0 - SQL Injection | bsen ordering software | 9.8 (v3.0) | Critical | 331028 , 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2018-18760 | RhinOS CMS 3.x - Arbitrary File Download | rhinos | 6.5 (v3.0) | Medium | 334168 , 344360 |
| CVE-2018-19287 | WordPress Ninja Forms <3.3.18 - Cross-Site Scripting | ninja forms | 6.1 (v3.0) | Medium | 333141 , 340099 , 340148 , 341099 , 346755 , 347198 |
| CVE-2018-7357 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High | 330791 , 334168 , 340152 |
| CVE-2018-7358 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High | 330791 , 334168 , 340152 |
| CVE-2018-19136 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2018-19137 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 346755 |
| CVE-2018-18925 | Gogs (Go Git Service) 0.11.66 - Remote Code Execution | gogs | 9.8 (v3.0) | Critical | 344360 |
| CVE-2018-18775 | Microstrategy Web 7 - Cross-Site Scripting | microstrategy web | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-18777 | Microstrategy Web 7 - Local File Inclusion | microstrategy web | 4.3 (v3.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-18349 | Fastjson Insecure Deserialization - Remote Code Execution | fastjson | 9.8 (v3.0) | Critical | 344380 , 344385 , 398008 |
| CVE-2018-18608 | DedeCMS 5.7 SP2 - Cross-Site Scripting | dedecms | 6.1 (v3.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2015-4632 | Koha 3.20.1 - Directory Traversal | koha | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2018-10823 | D-Link Routers - Remote Command Injection | dwr-116 firmware | 8.8 (v3.1) | High | 347009 |
| CVE-2018-10822 | D-Link Routers - Local File Inclusion | dwr-116 firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2018-3238 | Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting | webcenter sites | 6.9 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-3167 | Oracle E-Business Suite - Blind SSRF | application management pack | 5.3 (v3.0) | Medium | 392301 |
| CVE-2018-18308 | BigTree CMS 4.2.23 - Cross-Site Scripting | bigtree cms | 6.1 (v3.0) | Medium | 345493 |
| CVE-2018-18323 | Centos Web Panel 0.9.8.480 - Local File Inclusion | webpanel | 7.5 (v3.0) | High | 344360 , 347009 |
| CVE-2018-10141 | Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting | pan-os | 6.1 (v3.0) | Medium | 346755 |
| CVE-2018-12596 | Ektron CMS 9.20 SP2 - Improper Access Restrictions | ektron cms | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-12455 | Intelbras NPLUG 1.0.0.14 - Authentication Bypass | nplug | 8.1 (v3.0) | High | 390716 |
| CVE-2018-8006 | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting | activemq | 6.1 (v3.1) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-17440 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 9.8 (v3.0) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17442 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 8.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17441 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-17443 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-18069 | WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting | wpml | 6.1 (v3.0) | Medium | 392301 |
| CVE-2018-17587 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5750 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17588 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5021 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17590 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5442 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17591 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5343v2 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17593 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5453 firmware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-17310 | RICOH MP C1803 JPN Printer - Cross-Site Scripting | mp c1803 jpn firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2018-17313 | RICOH MP C1803 JPN Printer - Cross-Site Scripting | mp c307 firmware | 6.1 (v3.0) | Medium | 350147 |
| CVE-2018-16283 | WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion | wechat brodcast | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-16299 | WordPress Localize My Post 1.0 - Local File Inclusion | localize my post | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-17173 | LG Supersign EZ CMS - Remote Code Execution | supersign cms | 9.8 (v3.0) | Critical | 340014 , 340029 , 344361 , 344363 , 344370 |
| CVE-2018-16833 | ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting | manageengine desktop central | 6.1 (v3.0) | Medium | 333141 , 342259 , 350147 , 350148 |
| CVE-2018-17254 | Joomla! JCK Editor SQL Injection | jck editor | 9.8 (v3.1) | Critical | 340016 , 340017 , 340157 , 341245 , 360147 , 360148 |
| CVE-2018-17153 | Western Digital MyCloud NAS - Authentication Bypass | my cloud wdbctl0020hwt firmware | 9.8 (v3.0) | Critical | 344363 |
| CVE-2018-17082 | Apache2 - Transfer-Encoding Chunked XSS | php | 6.1 (v3.0) | Medium | 392301 |
| CVE-2018-16288 | LG SuperSign EZ CMS 2.5 - Local File Inclusion | supersign cms | 8.6 (v3.0) | High | 347009 |
| CVE-2018-16979 | Monstra CMS 3.0.4 - HTTP Header Injection | monstra | 6.1 (v3.0) | Medium | 330708 , 390722 |
| CVE-2018-16836 | Rubedo CMS <=3.4.0 - Directory Traversal | rubedo | 9.8 (v3.1) | Critical | 347009 |
| CVE-2018-16763 | FUEL CMS 1.4.1 - Remote Code Execution | fuel cms | 9.8 (v3.1) | Critical | 340023 , 344360 , 344370 , 347009 , 380026 |
| CVE-2018-16736 | Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting | rcfilters | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2018-16363 | WordPress File Manager < 3.0 - Cross-Site Scripting | file manager | 5.4 (v3.0) | Medium | 341266 , 346755 , 377360 |
| CVE-2018-16059 | WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion | wirelesshart fieldgate swg70 firmware | 5.3 (v3.0) | Medium | 392301 |
| CVE-2018-15917 | Jorani Leave Management System 0.6.5 - Cross-Site Scripting | jorani | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-16159 | WordPress Gift Voucher <4.1.8 - Blind SQL Injection | gift vouchers | 9.8 (v3.0) | Critical | 380122 |
| CVE-2018-15745 | Argus Surveillance DVR 4.0.0.0 - Local File Inclusion | dvr | 7.5 (v3.0) | High | 340007 |
| CVE-2017-17762 | Episerver 7 - Blind XML External Entity Injection | episerver | 7.5 (v3.0) | High | 344372 |
| CVE-2018-16134 | Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting | cybrohttpserver | 6.1 (v3.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2018-16133 | Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal | cybrohttpserver | 5.3 (v3.0) | Medium | 344365 , 347019 , 390716 |
| CVE-2018-15884 | RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin) | mp c4504ex firmware | 8.8 (v3.0) | High | 350147 |
| CVE-2018-15535 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 7.5 (v3.0) | High | 340007 , 344360 , 344370 , 345493 , 347009 , 390709 , 390720 , 390727 , 392301 , 392648 |
| CVE-2018-15536 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 5.5 (v3.0) | Medium | 340007 , 344360 , 344370 , 345493 , 347009 , 390709 , 390720 , 390727 , 392301 , 392648 |
| CVE-2018-11776 | Apache Struts2 S2-057 - Remote Code Execution | struts | 8.1 (v3.1) | High | 337209 , 337211 , 340193 , 347009 |
| CVE-2018-15534 | Geutebrueck re_porter 7.8.974.20 - Credential Disclosure | re porter 16 firmware | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-11511 | ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection | asustor data master | 9.8 (v3.0) | Critical | 341245 , 380026 , 380122 |
| CVE-2018-15138 | LG-Ericsson iPECS NMS 30M - Local File Inclusion | ipecs nms | 7.5 (v3.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2016-4975 | Apache mod_userdir CRLF injection | http server | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2018-15142 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 8.8 (v3.0) | High | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2018-15140 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2018-15141 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium | 340029 , 344360 , 344370 , 360152 , 390709 |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 8.8 (v3.0) | High | 333141 , 341256 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium | 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148 |
| CVE-2018-14728 | Responsive filemanager 9.13.1 Server-Side Request Forgery | responsive filemanager | 9.8 (v3.0) | Critical | 392301 |
| CVE-2018-14912 | cgit < 1.2.1 - Directory Traversal | cgit | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-13980 | Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion | zeta producer | 5.5 (v3.1) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-14064 | VelotiSmart Wifi - Directory Traversal | velotismart wifi firmware | 9.8 (v3.0) | Critical | 347009 |
| CVE-2018-12463 | Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection | fortify software security center | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2018-8024 | Apache Spark UI - Cross-Site Scripting | spark | 5.4 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-7765 | Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection | u.motion builder | 8.8 (v3.0) | High | 341245 , 344364 , 344366 |
| CVE-2018-12998 | Zoho manageengine - Cross-Site Scripting | firewall analyzer | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-12909 | Webgrind <= 1.5 - Local File Inclusion | webgrind | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2018-1306 | Apache Portals Pluto 3.0.0 - Remote Code Execution | pluto | 7.5 (v3.0) | High | 390727 , 392648 |
| CVE-2018-3760 | Ruby On Rails - Local File Inclusion | cloudforms | 7.5 (v3.0) | High | 347009 |
| CVE-2018-10956 | IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion | orchid core vms | 7.5 (v3.0) | High | 347009 |
| CVE-2018-12613 | PhpMyAdmin <4.8.2 - Local File Inclusion | phpmyadmin | 8.8 (v3.1) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-8727 | Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion | dvms workstation | 7.5 (v3.0) | High | 390716 |
| CVE-2015-4664 | Xceedium Xsuite - Multiple Vulnerabilities | privileged access manager | 9.8 (v3.0) | Critical | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2018-11222 | Pandora FMS <=7.0NG.722 - Remote Code Execution | pandora fms | 7.5 (v3.0) | High | 390726 , 392647 |
| CVE-2018-6671 | McAfee ePO 5.9.1 - Registered Executable Local Access Bypass | epolicy orchestrator | 6.5 (v3.0) | Medium | 344364 , 344365 , 344366 |
| CVE-2018-6961 | VMware NSX SD-WAN Edge - Command Injection | nsx sd-wan edge | 8.1 (v3.1) | High | 344363 , 393655 |
| CVE-2018-12111 | Canon PrintMe EFI - Cross-Site Scripting | efi printme | 6.1 (v3.0) | Medium | 340099 , 340147 , 341099 , 346755 , 347198 |
| CVE-2018-12095 | OEcms 3.1 - Cross-Site Scripting | oecms | 5.4 (v3.0) | Medium | 340147 , 340148 , 341266 , 346755 |
| CVE-2018-12054 | Schools Alert Management Script - Arbitrary File Read | schools alert management script | 7.5 (v3.0) | High | 344360 |
| CVE-2018-12031 | Eaton Intelligent Power Manager 1.6 - Directory Traversal | intelligent power manager | 9.8 (v3.0) | Critical | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-3714 | node-srv - Local File Inclusion | node-srv | 6.5 (v3.1) | Medium | 347009 |
| CVE-2018-11709 | WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting | wpforo forum | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-11133 | Quest KACE SMA /common/run_cross_report.php 'fmt' XSS | kace system management appliance | 6.1 (v3.0) | Medium | 346755 |
| CVE-2018-11535 | Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection | slac | 9.8 (v3.0) | Critical | 331028 , 340016 , 340155 , 340157 , 340159 , 341155 , 341245 , 342259 , 344370 , 345493 , 360147 , 360148 , 380026 |
| CVE-2018-11442 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High | 340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147 |
| CVE-2018-11445 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High | 340147 , 340148 , 340149 , 341245 , 341256 , 342259 , 344361 , 344362 , 344363 , 344370 , 345490 , 345493 , 350147 |
| CVE-2018-11231 | Opencart Divido - Sql Injection | divido | 8.1 (v3.0) | High | 392301 |
| CVE-2018-10095 | Dolibarr <7.0.2 - Cross-Site Scripting | dolibarr | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2018-10735 | NagiosXI <= 5.4.12 commandline.php SQL injection | nagios xi | 7.2 (v3.0) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2018-10736 | NagiosXI <= 5.4.12 - SQL injection | nagios xi | 7.2 (v3.0) | High | 340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2018-10737 | NagiosXI <= 5.4.12 logbook.php SQL injection | nagios xi | 7.2 (v3.0) | High | 331028 , 340155 , 341155 , 341245 |
| CVE-2018-10738 | NagiosXI <= 5.4.12 menuaccess.php - SQL injection | nagios xi | 7.2 (v3.0) | High | 331028 , 340016 , 340155 , 340157 , 340159 , 341155 , 341245 , 360147 , 360148 , 380026 |
| CVE-2018-5230 | Atlassian Jira Confluence - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium | 340112 , 340147 , 346755 |
| CVE-2015-1503 | IceWarp Mail Server < 11.1.1 - Directory Traversal | mail server | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 , 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2018-1247 | RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting | authentication manager | 7.1 (v3.0) | High | 392301 |
| CVE-2018-10562 | Dasan GPON Devices - Remote Code Execution | gpon router firmware | 9.8 (v3.1) | Critical | 392301 |
| CVE-2018-9302 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-1335 | Apache Tika < 1.1.8 - Header Command Injection | tika | 8.1 (v3.0) | High | 340138 , 391213 |
| CVE-2018-10201 | Ncomputing vSPace Pro 10 and 11 - Directory Traversal | vspace pro | 7.5 (v3.0) | High | 344365 , 390716 |
| CVE-2018-10230 | Zend Server <9.13 - Cross-Site Scripting | zend server | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-9118 | WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion | wp background takeover advertisements | 7.5 (v3.0) | High | 336461 , 344360 , 381206 |
| CVE-2018-1273 | Spring Data Commons - Remote Code Execution | spring data commons | 9.8 (v3.1) | Critical | 344360 , 344370 |
| CVE-2017-14611 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | 9.1 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-9038 | Monstra CMS 3.0.4 - Arbitrary Folder Deletion | monstra | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2018-1217 | Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control | emc avamar | 9.8 (v3.0) | Critical | 391213 |
| CVE-2018-1271 | Spring MVC Framework - Local File Inclusion | spring framework | 5.9 (v3.1) | Medium | 390716 |
| CVE-2018-9205 | Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion | avatar uploader | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-9238 | Yahei PHP Prober 0.4.7 - Cross-Site Scripting | yahei php prober | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-9160 | SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response | sickrage | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2018-7171 | TwonkyMedia Server 7.0.11-8.5 - Directory Traversal | twonky server | 7.5 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2018-7203 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting | twonky server | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2018-7600 | Drupal - Remote Code Execution | drupal | 9.8 (v3.1) | Critical | 330791 , 340152 |
| CVE-2018-7700 | DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution | dedecms | 8.8 (v3.0) | High | 344370 |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-7192 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 344361 , 344364 , 346755 , 347198 |
| CVE-2018-7193 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2018-7196 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2018-1213 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 8.8 (v3.0) | High | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2017-15715 | Apache httpd <=2.4.29 - Arbitrary File Upload | http server | 8.1 (v3.0) | High | 344365 |
| CVE-2018-1203 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1204 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-7543 | WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting | duplicator | 6.1 (v3.1) | Medium | 333140 , 340148 , 346755 , 380026 |
| CVE-2018-1186 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1187 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1188 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1189 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1201 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-1202 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium | 330791 , 333141 , 340147 , 340148 , 340152 , 341256 , 342259 , 346755 , 390585 |
| CVE-2018-7719 | Acrolinx Server <5.2.5 - Local File Inclusion | acrolinx server | 7.5 (v3.0) | High | 347019 |
| CVE-2018-7422 | WordPress Site Editor <=1.1.1 - Local File Inclusion | site editor | 7.5 (v3.0) | High | 336461 , 344360 , 347009 , 381206 , 390709 , 393771 |
| CVE-2018-5233 | Grav CMS <1.3.0 - Cross-Site Scripting | grav cms | 6.1 (v3.0) | Medium | 341266 |
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium | 333141 , 337209 , 337210 , 337211 , 340145 , 340147 , 340148 , 340149 , 340156 , 341145 , 341245 , 341256 , 342259 , 344370 , 346755 , 350147 , 390572 , 390585 , 390704 |
| CVE-2018-1000130 | Jolokia Agent - JNDI Code Injection | webarchive agent | 8.1 (v3.0) | High | 344362 , 390724 |
| CVE-2018-1000129 | Jolokia 1.3.7 - Cross-Site Scripting | jolokia | 6.1 (v3.0) | Medium | 346755 , 347198 |
| CVE-2018-7538 | Tuleap 9.17.99.189 - Blind SQL Injection | tuleap | 9.8 (v3.0) | Critical | 341245 , 344370 , 380026 , 380122 |
| CVE-2018-6530 | D-Link - Unauthenticated Remote Code Execution | dir-860l firmware | 9.8 (v3.1) | Critical | 330791 , 340152 , 344363 |
| CVE-2018-7653 | YzmCMS v3.6 - Cross-Site Scripting | yzmcms | 6.1 (v3.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2015-4117 | Vesta Control Panel 0.9.8 - OS Command Injection | control panel | 8.8 (v3.0) | High | 344370 |
| CVE-2018-7448 | CMS Made Simple 2.1.6 - Remote Code Execution | cms made simple | 7.5 (v3.0) | High | 344363 , 360152 , 390704 , 390724 |
| CVE-2018-7490 | uWSGI PHP Plugin Local File Inclusion | uwsgi | 7.5 (v3.0) | High | 347009 |
| CVE-2014-3206 | Seagate BlackArmor NAS - Command Injection | blackarmor nas 220 firmware | 9.8 (v3.0) | Critical | 311235 , 340014 , 340193 , 344364 , 344366 |
| CVE-2018-7314 | Joomla! Component PrayerCenter 3.0.2 - SQL Injection | prayercenter | 9.8 (v3.0) | Critical | 340157 , 341245 , 360147 , 360148 |
| CVE-2015-6544 | Combodo iTop <2.2.0-2459 - Cross-Site Scripting | itop | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390703 |
| CVE-2018-7251 | Anchor CMS 0.12.3 - Error Log Exposure | anchor | 9.8 (v3.0) | Critical | 390716 |
| CVE-2017-14535 | Trixbox - 2.8.0.4 OS Command Injection | trixbox | 8.8 (v3.1) | High | 340023 , 344360 , 344361 , 344363 , 347009 |
| CVE-2017-14537 | Trixbox 2.8.0 - Path Traversal | trixbox | 6.5 (v3.1) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2017-5799 | HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion | opencall media platform | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-5798 | HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion | opencall media platform | 6.1 (v3.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-12544 | HPE System Management - Cross-Site Scripting | system management homepage | 5.4 (v3.0) | Medium | 344366 |
| CVE-2018-0127 | Cisco RV132W/RV134W Router - Information Disclosure | rv132w firmware | 9.8 (v3.1) | Critical | 312863 , 390716 |
| CVE-2018-6605 | Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection | zh baidumap | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2018-6008 | Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion | jtag members directory | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2017-17976 | PerfexCRM 1.9.7 - Arbitrary File Upload | perfex crm | 9.8 (v3.0) | Critical | 392301 |
| CVE-2017-14523 | Wonder CMS 2.3.1 - 'Host' Header Injection | wondercms | 7.5 (v3.0) | High | 392301 |
| CVE-2018-6184 | Zeit Next.js < 4.2.3 - Local File Inclusion | next.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-17999 | RISE 1.9 - 'search' SQL Injection | rise ultimate project manager | 9.8 (v3.0) | Critical | 341245 , 380026 , 380122 , 390724 |
| CVE-2017-14094 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 9.8 (v3.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2017-14097 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 9.8 (v3.0) | Critical | 330791 , 340007 , 340152 |
| CVE-2017-11398 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 8.8 (v3.0) | High | 330791 , 340007 , 340152 |
| CVE-2017-14095 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 8.1 (v3.0) | High | 330791 , 340007 , 340152 |
| CVE-2017-14096 | Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control | smart protection server | 6.1 (v3.0) | Medium | 330791 , 340007 , 340152 |
| CVE-2018-5715 | SugarCRM 3.5.1 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium | 340147 , 340148 , 341245 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2017-17970 | Muviko 1.1 - SQL Injection | muviko | 9.8 (v3.0) | Critical | 340016 , 340017 , 340144 , 340156 , 340157 , 340159 , 341245 , 360147 , 360148 , 380026 , 380122 , 390727 , 392301 , 392648 |
| CVE-2017-18024 | AvantFAX 3.3.3 - Cross-Site Scripting | avantfax | 6.1 (v3.0) | Medium | 340147 , 340148 , 342259 , 346755 , 350148 |
| CVE-2018-5316 | WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting | sagepay server gateway for woocommerce | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-9965 | Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal | pelco videoxpert | 5.8 (v3.0) | Medium | 344365 , 390716 |
| CVE-2018-3810 | Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass | smart google code inserter | 9.8 (v3.0) | Critical | 380026 |
| CVE-2017-18001 | Trustwave SWG 11.8.0.27 - SSH Unauthorized Access | secure web gateway | 9.8 (v3.0) | Critical | 330039 , 330791 , 340152 |
| CVE-2017-16949 | Accesspress Anonymous Post Pro < 3.2.0 - Arbitrary File Upload | anonymous post pro | 9.8 (v3.0) | Critical | 345493 |
| CVE-2017-17731 | DedeCMS 5.7 - SQL Injection | dedecms | 9.8 (v3.0) | Critical | 344370 |
| CVE-2017-17672 | vBulletin 5.x - 'cacheTemplates' Remote Arbitrary File Deletion | vbulletin | 9.8 (v3.0) | Critical | 344370 , 390614 |
| CVE-2017-17451 | WordPress Mailster <=1.5.4 - Cross-Site Scripting | wp mailster | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585 |
| CVE-2017-17092 | WordPress < 4.9.1 - Authenticated JavaScript File Upload | WordPress | 5.4 (v3.0) | Medium | 377360 |
| CVE-2017-17059 | WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting | amtythumb | 6.1 (v3.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 , 392301 |
| CVE-2017-14186 | FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium | 346755 , 350148 |
| CVE-2017-17043 | WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting | emag marketplace connector | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-16935 | Ametys CMS 4.0.2 - Password Reset | ametys | 9.8 (v3.0) | Critical | 345493 , 390724 |
| CVE-2015-3934 | Fiyo CMS 2.0_1.9.1 - SQL Injection | fiyo cms | 9.8 (v3.0) | Critical | 341245 , 344366 , 380026 , 380122 |
| CVE-2017-16894 | Laravel <5.5.21 - Information Disclosure | laravel | 7.5 (v3.0) | High | 390709 |
| CVE-2017-1000170 | WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion | jqueryfiletree | 7.5 (v3.1) | High | 392301 |
| CVE-2017-16877 | Nextjs <2.4.1 - Local File Inclusion | next.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-1000163 | Phoenix Framework - Open Redirect | phoenix | 6.1 (v3.0) | Medium | 344365 |
| CVE-2017-12635 | Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation | couchdb | 9.8 (v3.0) | Critical | 392301 |
| CVE-2017-16806 | Ulterius Server < 1.9.5.0 - Directory Traversal | ulterius server | 7.5 (v3.0) | High | 347009 , 390709 , 390716 |
| CVE-2015-7501 | Red Hat JBoss - Insecure Deserialization | jboss enterprise application platform | 9.8 (v3.0) | Critical | 344380 |
| CVE-2015-3933 | GeniXCMS 0.0.3 - 'register.php' SQL Injection | genixcms | 9.8 (v3.0) | Critical | 331028 , 331702 , 340016 , 340017 , 340155 , 340157 , 340159 , 341155 , 341245 , 344365 , 360147 , 360148 , 360152 , 380026 , 390720 , 390724 , 390726 , 392647 |
| CVE-2017-11512 | ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval | servicedesk | 7.5 (v3.0) | High | 340007 , 344365 , 347019 |
| CVE-2014-1203 | Eyou E-Mail <3.6 - Remote Code Execution | eyou | 9.8 (v3.1) | Critical | 340023 , 341245 , 344360 , 344361 , 344363 , 344370 |
| CVE-2014-3744 | Node.js st module Directory Traversal | node.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-15687 | Logitech Media Server - Cross-Site Scripting | media server | 6.1 (v3.0) | Medium | 340099 , 341099 , 346755 , 347198 |
| CVE-2017-10366 | Oracle PeopleSoft 8.5x - Remote Code Execution | peoplesoft enterprise peopletools | 9.8 (v3.0) | Critical | 390703 , 392301 |
| CVE-2017-10271 | Oracle WebLogic Server - Remote Command Execution | weblogic server | 7.5 (v3.1) | High | 344362 , 344363 , 344364 , 344366 |
| CVE-2017-15647 | FiberHome Routers - Local File Inclusion | routerfiberhome firmware | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2017-15643 | Ikraus Anti Virus 2.16.7 - Remote Code Execution | ikarus antivirus | 7.4 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2014-8357 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9118 | ZHONE < S3.0.501 - Multiple Vulnerabilities | znid 2426a firmware | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9148 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 9.8 (v3.0) | Critical | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-9147 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 7.5 (v3.0) | High | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2017-15363 | Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion | restler | 7.5 (v3.1) | High | 340007 |
| CVE-2017-15287 | Dreambox WebControl 2.0.0 - Cross-Site Scripting | bouqueteditor | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2017-12617 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High | 345493 , 392301 |
| CVE-2017-6090 | PhpColl 2.5.1 Arbitrary File Upload | phpcollab | 8.8 (v3.0) | High | 391746 |
| CVE-2017-14955 | Check_MK 1.2.8p25 - Information Disclosure | checkmk | 5.9 (v3.1) | Medium | 330791 , 340152 |
| CVE-2017-14942 | Intelbras WRN 150 - Authentication Bypass | wrn150 | 9.8 (v3.0) | Critical | 390716 |
| CVE-2017-14849 | Node.js <8.6.0 - Directory Traversal | node.js | 7.5 (v3.0) | High | 347009 |
| CVE-2017-14622 | WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting | 2kb amazon affiliates store | 6.1 (v3.0) | Medium | 341266 , 346755 |
| CVE-2015-4667 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 9.8 (v3.0) | Critical | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4669 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 7.8 (v3.0) | High | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4668 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 6.1 (v3.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2017-14725 | WordPress < 4.8.2 - Authenticated Open Redirect | WordPress | 5.4 (v3.0) | Medium | 377360 |
| CVE-2017-14651 | WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting | api manager | 4.8 (v3.1) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148 |
| CVE-2017-12611 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.0) | Critical | 337207 , 337209 , 337211 , 337218 , 340014 , 340029 , 340193 , 344360 , 344362 , 344363 , 344370 , 347009 |
| CVE-2015-4074 | Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion | helpdesk pro | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2015-2826 | WordPress Plugin Simple Ads Manager - Information Disclosure | simple ads manager | 5.3 (v3.0) | Medium | 344370 , 390904 |
| CVE-2015-4683 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 9.8 (v3.0) | Critical | 330791 , 340152 , 392301 |
| CVE-2017-12615 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High | 337209 , 337210 , 337211 , 340095 , 340128 , 344360 , 345493 , 347009 , 380018 , 380026 , 390904 , 392301 |
| CVE-2015-4681 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 7.8 (v3.0) | High | 330791 , 340152 , 392301 |
| CVE-2015-4685 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 7.0 (v3.0) | High | 330791 , 340152 , 392301 |
| CVE-2015-4682 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 6.5 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2015-4684 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | 6.5 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9805 | Apache Struts2 S2-052 - Remote Code Execution | struts | 8.1 (v3.1) | High | 344360 , 344364 , 344366 |
| CVE-2017-14335 | Hanbanggaoke IP Camera - Arbitrary Password Change | hb7024xt firmware | 7.5 (v3.0) | High | 345493 |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 347198 , 350147 , 350148 , 390727 , 392301 , 392648 |
| CVE-2015-8349 | SourceBans <2.0 - Cross-Site Scripting | sourcebans | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-8350 | WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS | call to action | 6.1 (v3.0) | Medium | 340148 , 341266 , 346755 , 377360 |
| CVE-2017-9834 | WordPress Plugin WatuPRO 5.5.1 - SQL Injection | watupro | 9.8 (v3.0) | Critical | 340156 , 380122 |
| CVE-2017-12794 | Django Debug Page - Cross-Site Scripting | django | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2017-14135 | OpenDreambox 2.0.0 - Remote Code Execution | opendreambox | 9.8 (v3.0) | Critical | 344364 |
| CVE-2014-8675 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 7.5 (v3.0) | High | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2017-7855 | IceWarp WebMail 11.3.1.5 - Cross-Site Scripting | server | 6.1 (v3.0) | Medium | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2014-8676 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.3 (v3.0) | Medium | 331028 , 340007 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344360 , 344363 , 344370 , 347009 , 360147 , 360148 , 360153 , 390709 , 390726 , 392647 |
| CVE-2014-8677 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.3 (v3.0) | Medium | 331028 , 340016 , 340017 , 340144 , 340155 , 340156 , 340157 , 340159 , 341155 , 341245 , 344363 , 344370 , 360147 , 360148 , 360153 , 390726 , 392647 |
| CVE-2017-9979 | QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities | quantastor | 6.1 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9978 | QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities | quantastor | 5.3 (v3.0) | Medium | 330791 , 340152 , 392301 |
| CVE-2017-9640 | Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write | i-vu | 6.3 (v3.0) | Medium | 390727 , 390904 , 392301 , 392648 |
| CVE-2017-11610 | XML-RPC Server - Remote Code Execution | supervisor | 8.8 (v3.0) | High | 344364 |
| CVE-2017-9506 | Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery | oauth | 6.1 (v3.0) | Medium | 382291 |
| CVE-2017-10075 | Oracle Content Server - Cross-Site Scripting | webcenter content | 8.2 (v3.0) | High | 333141 , 341256 , 342259 , 346755 , 347198 |
| CVE-2017-12583 | DokuWiki - Cross-Site Scripting | dokuwiki | 6.1 (v3.0) | Medium | 333141 , 346755 , 347198 |
| CVE-2017-11629 | FineCMS <=5.0.10 - Cross-Site Scripting | finecms | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2017-9413 | Subsonic 6.1.1 - Server-Side Request Forgery | subsonic | 8.8 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-9822 | DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution | dotnetnuke | 8.8 (v3.1) | High | 344365 , 344370 |
| CVE-2017-11444 | Subrion CMS <4.1.5.10 - SQL Injection | subrion cms | 9.8 (v3.0) | Critical | 341245 |
| CVE-2017-11456 | Geneko Routers - Path Traversal | gwr352 3g router firmware | 7.5 (v3.0) | High | 346019 |
| CVE-2017-9811 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 9.8 (v3.0) | Critical | 390704 , 390724 |
| CVE-2017-9810 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 8.8 (v3.0) | High | 390704 , 390724 |
| CVE-2017-1000028 | Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High | 347009 , 390716 |
| CVE-2017-1000029 | Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High | 347009 |
| CVE-2017-9812 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 7.5 (v3.0) | High | 390704 , 390724 |
| CVE-2017-9813 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 6.1 (v3.0) | Medium | 390704 , 390724 |
| CVE-2017-11165 | DataTaker DT80 dEX 1.50.012 - Information Disclosure | dt80 dex firmware | 9.8 (v3.1) | Critical | 390716 |
| CVE-2017-9791 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.1) | Critical | 337207 |
| CVE-2017-11107 | phpLDAPadmin <= 1.2.3 - Reflected XSS | phpldapadmin | 6.1 (v3.1) | Medium | 340147 , 341256 , 341266 , 342259 , 350148 |
| CVE-2017-10974 | Yaws 1.91 - Local File Inclusion | yaws | 7.5 (v3.0) | High | 350591 |
| CVE-2017-9841 | PHPUnit - Remote Code Execution | phpunit | 9.8 (v3.1) | Critical | 392648 , 393782 |
| CVE-2017-9833 | BOA Web Server 0.94.14 - Arbitrary File Access | boa | 7.5 (v3.1) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2017-9355 | Subsonic 6.1.1 - XML External Entity Injection | subsonic | 7.4 (v3.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2017-9416 | Odoo 8.0/9.0/10.0 - Local File Inclusion | odoo | 6.5 (v3.0) | Medium | 347009 , 390716 |
| CVE-2017-9288 | WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting | raygun4wp | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-6256 | SAP Business One for Android 1.2.3 - XML External Entity Injection | business one | 9.6 (v3.0) | Critical | 344372 |
| CVE-2017-5868 | OpenVPN Access Server 2.1.4 - CRLF Injection | openvpn access server | 6.1 (v3.0) | Medium | 330708 , 390714 |
| CVE-2016-4977 | Spring Security OAuth2 Remote Command Execution | spring security oauth | 8.8 (v3.0) | High | 393655 |
| CVE-2015-4455 | WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload | aviary image editor add-on for gravity forms | 9.8 (v3.0) | Critical | 340007 , 391742 , 391743 |
| CVE-2015-5469 | WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion | mdc youtube downloader | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2017-9140 | Reflected XSS - Telerik Reporting Module | telerik reporting | 6.1 (v3.0) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2017-9072 | RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting | flatcalendarxp | 6.1 (v3.0) | Medium | 392301 |
| CVE-2017-8917 | Joomla! <3.7.1 - SQL Injection | joomla! | 9.8 (v3.0) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2017-8295 | WordPress Core < 4.7.4 - Unauthorized Password Reset | WordPress | 5.9 (v3.0) | Medium | 377360 |
| CVE-2016-10367 | Opsview Monitor Pro - Local File Inclusion | opsview | 7.5 (v3.0) | High | 390709 |
| CVE-2017-5689 | Intel Active Management Technology - System Privileges | proliant ml10 gen9 server firmware | 9.8 (v3.1) | Critical | 390726 , 392647 |
| CVE-2017-5631 | KMCIS CaseAware - Cross-Site Scripting | caseaware | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 , 346755 , 350147 , 350148 , 360030 |
| CVE-2017-8225 | GoAhead Camera - Credential Disclosure | wireless ip camera (p2p) firmware | 9.8 (v3.0) | Critical | 390716 |
| CVE-2015-0104 | IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution | change and configuration management database | 8.8 (v3.0) | High | 392301 |
| CVE-2015-7245 | D-Link DVG-N5402SP - Local File Inclusion | dvg-n5402sp firmware | 7.5 (v3.0) | High | 392301 |
| CVE-2017-3546 | Oracle PeopleSoft - Server-Side Request Forgery | peoplesoft enterprise peopletools | 6.5 (v3.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2017-3548 | Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE | peoplesoft enterprise peopletools | 6.5 (v3.0) | Medium | 330791 , 340152 |
| CVE-2017-3528 | Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect | applications framework | 5.4 (v3.0) | Medium | 344365 |
| CVE-2016-1555 | NETGEAR WNAP320 Access Point Firmware - Remote Command Injection | wnap320 firmware | 9.8 (v3.1) | Critical | 340014 , 344364 , 344366 |
| CVE-2016-4337 | Ktools Photostore 4.7.5 - Blind SQL Injection | photostore | 9.8 (v3.0) | Critical | 390726 , 392647 |
| CVE-2017-7462 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 9.8 (v3.0) | Critical | 330925 , 344360 , 347009 |
| CVE-2017-7461 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 4.9 (v3.0) | Medium | 330925 , 344360 , 347009 |
| CVE-2017-6190 | D-Link DWR-116 / DWR-116A1 - Arbitrary File Download | dwr-116 firmware | 7.5 (v3.0) | High | 347009 , 390727 , 392648 |
| CVE-2017-7185 | Cesanta Mongoose OS - Use-After-Free | mongoose embedded web server library | 7.5 (v3.0) | High | 330791 , 340152 |
| CVE-2017-6884 | Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection | emg2926 firmware | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium | 340147 , 340148 , 342259 , 345493 , 346755 , 350148 , 390724 |
| CVE-2017-7402 | Pixie 1.0.4 - Arbitrary File Upload | pixie | 9.8 (v3.0) | Critical | 345493 |
| CVE-2017-7391 | Magmi 0.7.22 - Cross-Site Scripting | magmi | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2017-5850 | OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service | openbsd | 7.5 (v3.0) | High | 390727 , 392301 , 392648 |
| CVE-2017-6443 | EPSON TMNet WebConfig 1.00 - Cross-Site Scripting | tmnet webconfig | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2017-6823 | Fiyo CMS 2.0.6.1 - Privilege Escalation | fiyo cms | 8.8 (v3.0) | High | 345493 , 390724 |
| CVE-2017-5638 | Apache Struts 2 - Remote Command Execution | struts | 9.8 (v3.1) | Critical | 332791 , 334168 , 390719 |
| CVE-2017-6478 | MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting | mangoswebv4 | 6.1 (v3.1) | Medium | 341266 , 346755 |
| CVE-2016-9682 | Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection | sonicwall secure remote access server | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-9269 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 9.9 (v3.0) | Critical | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9315 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 8.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9314 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 7.8 (v3.0) | High | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-9316 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2016-10134 | Zabbix - SQL Injection | zabbix | 9.8 (v3.0) | Critical | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2016-10043 | Radisys MRF - Command Injection | web panel | 10.0 (v3.0) | Critical | 341245 |
| CVE-2016-6600 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-6602 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-6603 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 9.8 (v3.0) | Critical | 390727 , 392301 , 392648 |
| CVE-2016-6601 | WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities | webnms framework | 7.5 (v3.0) | High | 344360 , 347009 , 390709 , 390727 , 392301 , 392648 |
| CVE-2016-7981 | SPIP <3.1.2 - Cross-Site Scripting | spip | 6.1 (v3.0) | Medium | 341256 , 341266 , 346755 |
| CVE-2016-4808 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 8.8 (v3.0) | High | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-4806 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 7.5 (v3.0) | High | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-4807 | Web2py 2.14.5 - Multiple Vulnerabilities | web2py | 4.8 (v3.0) | Medium | 344360 , 344364 , 344366 , 344370 |
| CVE-2016-10108 | Western Digital MyCloud NAS - Command Injection | mycloud nas | 9.8 (v3.0) | Critical | 344364 , 344366 |
| CVE-2016-6277 | NETGEAR Routers - Remote Code Execution | d6220 firmware | 8.8 (v3.1) | High | 347009 |
| CVE-2016-3473 | Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection | business intelligence publisher | 7.7 (v3.0) | High | 330791 , 340152 , 344370 , 344372 , 380018 , 390704 , 392301 |
| CVE-2016-1000126 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | admin-font-editor | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000127 | WordPress AJAX Random Post <=2.00 - Cross-Site Scripting | ajax-random-post | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000128 | WordPress anti-plagiarism <=3.60 - Cross-Site Scripting | anti-plagiarism | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000129 | WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting | defa-online-image-protector | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000130 | WordPress e-search <=1.0 - Cross-Site Scripting | e-search | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000131 | WordPress e-search <=1.0 - Cross-Site Scripting | esearch | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000132 | WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting | tooltip glossary | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000133 | WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting | forget about shortcode buttons | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000134 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000135 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000136 | WordPress heat-trackr 1.0 - Cross-Site Scripting | heat-trackr | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000137 | WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting | hero-maps-pro | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000138 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | indexisto | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000139 | WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting | infusionsoft | 6.1 (v3.0) | Medium | 340147 , 341256 , 341266 , 342259 |
| CVE-2016-1000140 | WordPress New Year Firework <=1.1.9 - Cross-Site Scripting | new-year-firework | 6.1 (v3.0) | Medium | 340147 , 341266 |
| CVE-2016-1000141 | WordPress Page Layout builder v1.9.3 - Cross-Site Scripting | page-layout-builder | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000142 | WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting | parsi-font | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000143 | WordPress Photoxhibit 2.1.8 - Cross-Site Scripting | photoxhibit | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000146 | WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting | pondol-formmail | 6.1 (v3.0) | Medium | 322100 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000148 | WordPress S3 Video <=0.983 - Cross-Site Scripting | s3-video | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2016-1000149 | WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting | simpel-reserveren | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2016-1000152 | WordPress Tidio-form <=1.0 - Cross-Site Scripting | tidio-form | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2016-1000153 | WordPress Tidio Gallery <=1.1 - Cross-Site Scripting | tidio-gallery | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000154 | WordPress WHIZZ <=1.0.7 - Cross-Site Scripting | whizz | 6.1 (v3.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2016-1000155 | WordPress WPSOLR <=8.6 - Cross-Site Scripting | wpsolr-search-engine | 6.1 (v3.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2015-2080 | Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers | fedora | 7.5 (v3.0) | High | 344361 , 344363 , 344364 , 344365 , 390724 |
| CVE-2015-1000005 | WordPress Candidate Application Form <= 1.3 - Local File Inclusion | candidate-application-form | 7.5 (v3.0) | High | 337473 , 344360 , 347009 , 390709 |
| CVE-2015-1000010 | WordPress Simple Image Manipulator < 1.0 - Local File Inclusion | simple-image-manipulator | 7.5 (v3.0) | High | 337473 , 344360 , 347009 , 390709 |
| CVE-2015-1000012 | WordPress MyPixs <=0.3 - Local File Inclusion | mypixs | 7.5 (v3.0) | High | 344360 , 347009 , 390709 |
| CVE-2016-6435 | Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion | secure firewall management center | 6.5 (v3.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2016-5674 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 9.8 (v3.0) | Critical | 344363 , 392301 |
| CVE-2016-5675 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-5678 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 9.8 (v3.0) | Critical | 392301 |
| CVE-2016-5679 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 8.8 (v3.0) | High | 392301 |
| CVE-2016-5680 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | nvrmini 2 | 8.8 (v3.0) | High | 392301 |
| CVE-2016-5676 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 7.5 (v3.0) | High | 392301 |
| CVE-2016-5677 | NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities | readynas surveillance | 7.5 (v3.0) | High | 392301 |
| CVE-2016-5771 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.1) | Critical | 344365 |
| CVE-2016-5773 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.0) | Critical | 344365 |
| CVE-2016-1337 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 8.1 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-1328 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-1336 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2016-4309 | Symphony CMS 2.6.7 - Session Fixation | symphony | 7.5 (v3.1) | High | 390727 , 392301 , 392648 |
| CVE-2016-3088 | Apache ActiveMQ Fileserver - Arbitrary File Write | activemq | 9.8 (v3.1) | Critical | 392301 |
| CVE-2015-6834 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 9.8 (v3.0) | Critical | 344365 |
| CVE-2016-3081 | Apache S2-032 Struts - Remote Code Execution | struts | 8.1 (v3.0) | High | 337209 , 337211 , 344360 , 347009 , 390904 |
| CVE-2016-2386 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver application server java | 9.8 (v3.1) | Critical | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2016-2389 | SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion | netweaver | 7.5 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2016-2388 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver application server java | 5.3 (v3.1) | Medium | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2016-1910 | SAP NetWeaver J2EE Engine 7.40 - SQL Injection | netweaver | 5.3 (v3.0) | Medium | 340016 , 340156 , 341245 , 380026 , 390704 |
| CVE-2015-5471 | Swim Team <= v1.44.10777 - Local File Inclusion | swim team | 5.3 (v3.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2015-4694 | WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval | zip attachments | 8.6 (v3.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-6018 | ZYXEL PMG5318-B20A - OS Command Injection | pmg5318-b20a firmware | 9.8 (v3.0) | Critical | 330791 , 340152 |
| CVE-2015-4027 | Acunetix WVS 10 - Local Privilege Escalation | web vulnerability scanner | 7.2 (v2.0) | High | 330791 , 340152 , 390726 , 392647 |
| CVE-2015-6401 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 7.5 (v2.0) | High | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-6402 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 4.3 (v2.0) | Medium | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-7297 | Joomla! Core SQL Injection | joomla! | 7.5 (v2.0) | High | 340157 , 340159 , 341245 , 360147 , 360148 |
| CVE-2015-5285 | Kallithea 0.2.9 - 'came_from' HTTP Response Splitting | kallithea | 5.0 (v2.0) | Medium | 390722 , 390727 , 392648 |
| CVE-2015-6477 | Nordex NC2 - Cross-Site Scripting | nordex control 2 scada | 6.1 (v3.1) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-4040 | F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal | enterprise manager | 4.0 (v2.0) | Medium | 344370 , 390724 |
| CVE-2015-6920 | WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting | sourceafrica | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148 |
| CVE-2015-5688 | Geddy <13.0.8 - Local File Inclusion | geddy | 5.0 (v2.0) | Medium | 347009 |
| CVE-2015-2807 | Navis DocumentCloud <0.1.1 - Cross-Site Scripting | navis documentcloud | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148 |
| CVE-2015-5161 | Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection | zend framework | 6.8 (v2.0) | Medium | 344372 , 390727 , 392301 , 392648 |
| CVE-2015-4425 | Pimcore CMS Build 3450 - Directory Traversal | pimcore | 4.9 (v2.0) | Medium | 390726 , 392647 |
| CVE-2015-5531 | ElasticSearch <1.6.1 - Local File Inclusion | elasticsearch | 5.0 (v2.0) | Medium | 347009 , 392301 |
| CVE-2015-4666 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 5.0 (v2.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347009 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2015-4665 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 4.3 (v2.0) | Medium | 320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9735 | WordPress RevSlider - Remote Code Execution via File Upload | showbiz pro | 7.5 (v2.0) | High | 337469 |
| CVE-2015-3897 | Bonita BPM Portal <6.5.3 - Local File Inclusion | bonita bpm portal | 5.0 (v2.0) | Medium | 340007 , 344360 |
| CVE-2015-4420 | Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities | opsview | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 |
| CVE-2015-4414 | WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal | se html5 album audio player | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-3648 | ResourceSpace - Local File inclusion | resourcespace | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-2996 | SysAid Help Desk <15.2 - Local File Inclusion | sysaid | 8.5 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2015-1389 | Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting | clearpass policy manager | 4.3 (v2.0) | Medium | 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-4127 | WordPress Church Admin <0.810 - Cross-Site Scripting | church admin | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-4062 | WordPress NewStatPress 0.9.8 - SQL Injection | newstatpress | 6.5 (v2.0) | Medium | 341245 , 380122 |
| CVE-2015-4063 | NewStatPress <0.9.9 - Cross-Site Scripting | newstatpress | 3.5 (v2.0) | Low | 341266 , 346755 |
| CVE-2015-1880 | Fortinet FortiOS <=5.2.3 - Cross-Site Scripting | fortios | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2015-3337 | Elasticsearch - Local File Inclusion | elasticsearch | 4.3 (v2.0) | Medium | 347009 |
| CVE-2012-5451 | TVMOBiLi 2.1.0.3557 - Denial of Service | tvmobili | 5.0 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2015-3035 | TP-LINK - Local File Inclusion | tl-wr841n (9.0) firmware | 7.5 (v3.1) | High | 347009 |
| CVE-2015-1635 | Microsoft Windows 'HTTP.sys' - Remote Code Execution | Windows 7 | 9.8 (v3.1) | Critical | 363434 |
| CVE-2014-9145 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 7.5 (v2.0) | High | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-9146 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | fiyo cms | 4.3 (v2.0) | Medium | 340007 , 340156 , 341145 , 344360 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2015-2824 | WordPress Plugin Simple Ads Manager - Multiple SQL Injections | simple ads manager | 7.5 (v2.0) | High | 344361 , 344363 , 344364 , 344366 , 344370 , 360152 , 360153 , 380026 , 390720 , 390724 , 390726 , 390904 , 392647 |
| CVE-2015-2166 | Ericsson Drutt MSDP - Local File Inclusion | drutt mobile service delivery platform | 5.0 (v2.0) | Medium | 347009 |
| CVE-2015-2755 | WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting | ab google map travel | 6.8 (v2.0) | Medium | 346755 , 377360 |
| CVE-2014-7884 | ArcSight Logger - Arbitrary File Upload / Code Execution | arcsight logger | 9.0 (v2.0) | High | 390726 , 392647 |
| CVE-2015-2275 | WoltLab Community Gallery - Persistent Cross-Site Scripting | community gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 342259 , 344365 , 344370 , 346755 , 390726 , 392647 |
| CVE-2015-2196 | WordPress Spider Calendar <=1.4.9 - SQL Injection | spider calendar | 7.5 (v2.0) | High | 340016 , 340156 , 380122 |
| CVE-2015-2067 | Magento Server MAGMI - Directory Traversal | magmi | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-2068 | Magento Server Mass Importer - Cross-Site Scripting | magmi | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2015-1427 | ElasticSearch - Remote Code Execution | elasticsearch | 9.8 (v3.1) | Critical | 344360 , 380026 , 390724 |
| CVE-2015-1518 | RedaxScript CMS 2.2.0 - SQL Injection | redaxscript | 7.5 (v2.0) | High | 334073 , 341245 , 344363 , 344364 , 344365 , 344370 , 350147 , 360152 , 360153 , 380026 , 390724 , 390726 , 392647 |
| CVE-2015-1579 | WordPress Slider Revolution - Local File Disclosure | divi | 5.0 (v2.0) | Medium | 336461 , 337479 , 344360 , 381206 |
| CVE-2015-1400 | NPDS CMS REvolution-13 - SQL Injection | revolution | 7.5 (v2.0) | High | 334168 , 390726 , 391213 , 392647 |
| CVE-2015-1428 | Sefrengo CMS 1.6.1 - Multiple SQL Injections | sefrengo | 7.5 (v2.0) | High | 390704 |
| CVE-2015-0231 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-0191 | eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection | fusion middleware | 4.3 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2014-10037 | DomPHP 0.83 - Directory Traversal | domphp | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2014-100004 | Sitecore CMS - Cross-Site Scripting | sitecore.net | 4.3 (v2.0) | Medium | 333141 , 347198 |
| CVE-2014-9464 | Microweber CMS 0.95 - SQL Injection | microweber | 7.5 (v2.0) | High | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9444 | Frontend Uploader <= 0.9.2 - Cross-Site Scripting | frontend uploader | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 |
| CVE-2014-9119 | WordPress DB Backup <=4.5 - Local File Inclusion | db backup | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 , 393759 |
| CVE-2013-6041 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 7.5 (v2.0) | High | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2013-6043 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 5.0 (v2.0) | Medium | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2014-8142 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-5462 | OpenEMR 4.1.2(7) - Multiple SQL Injections | openemr | 6.5 (v2.0) | Medium | 392301 |
| CVE-2014-8877 | WordPress Plugin CM Download Manager 2.0.0 - Code Injection | cm download manager | 10.0 (v2.0) | High | 340087 , 340095 , 390726 , 392301 , 392647 , 392648 |
| CVE-2014-9215 | PBBoard CMS 3.0.1 - SQL Injection | pbboard | 7.5 (v2.0) | High | 340095 , 340213 , 344363 , 344370 , 360153 , 380026 , 390724 , 390726 , 392647 |
| CVE-2014-8799 | WordPress Plugin DukaPress 2.5.2 - Directory Traversal | dukapress | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2014-9094 | WordPress DZS-VideoGallery Plugin Cross-Site Scripting | video gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2014-8682 | Gogs (Go Git Service) - SQL Injection | gogs | 7.5 (v2.0) | High | 340016 , 340017 , 340157 , 360147 , 360148 , 380026 |
| CVE-2014-8727 | F5 BIG-IP 10.1.0 - Directory Traversal | big-ip local traffic manager | 6.2 (v2.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2014-5258 | webEdition 6.3.8.0 - Directory Traversal | webedition cms | 4.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-7176 | Enalean Tuleap 7.4.99.5 - Blind SQL Injection | tuleap | 6.5 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2014-2531 | InterWorx Control Panel 5.0.13 build 574 - 'xhr.php?i' SQL Injection | web control panel | 6.5 (v2.0) | Medium | 392301 |
| CVE-2014-4577 | WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion | wp amasin - the amazon affiliate shop | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-6308 | Osclass Security Advisory 3.4.1 - Local File Inclusion | osclass | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-3704 | Drupal SQL Injection | drupal | 7.5 (v2.0) | High | 392301 |
| CVE-2014-5308 | TestLink 1.9.11 - Multiple SQL Injections | testlink | 9.0 (v2.0) | High | 350147 , 390726 , 392647 |
| CVE-2014-6287 | HTTP File Server <2.3c - Remote Command Execution | http file server | 9.8 (v3.1) | Critical | 390613 , 390614 |
| CVE-2014-6389 | PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution | phpcompta/noalyss | 7.5 (v2.0) | High | 340128 , 344363 , 350147 , 380018 , 390726 , 392301 , 392647 , 392648 |
| CVE-2011-4624 | GRAND FlAGallery 1.57 - Cross-Site Scripting | grand flagallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-6271 | ShellShock - Remote Code Execution | bash | 9.8 (v3.1) | Critical | 330701 , 344360 , 390719 , 393134 |
| CVE-2012-4240 | Group Office Calendar - '/calendar/json.php' SQL Injection | groupoffice | 6.5 (v2.0) | Medium | 340016 , 340157 , 341245 , 360147 , 360148 |
| CVE-2012-4768 | WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting | download monitor | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-5368 | WordPress Plugin WP Content Source Control - Directory Traversal | wp content source control | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2012-5685 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 7.5 (v2.0) | High | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2012-5683 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 6.8 (v2.0) | Medium | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2012-5684 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 4.3 (v2.0) | Medium | 340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704 |
| CVE-2014-1222 | Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities | vtiger crm | 4.0 (v2.0) | Medium | 340007 , 340156 , 341145 , 344360 , 345493 , 380026 , 380122 , 390709 , 390720 , 390726 , 392647 |
| CVE-2014-5181 | Last.fm Rotation 1.0 - Path Traversal | lastfm-rotation plugin | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-5187 | Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal | tom-m8te plugin | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2013-5758 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | sip-t38g | 9.0 (v2.0) | High | 330925 , 344360 , 344370 , 390724 , 390726 , 392647 |
| CVE-2013-5759 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | - | N/A | N/A | 330925 , 344360 , 390724 , 390726 , 392647 |
| CVE-2014-3120 | ElasticSearch v1.1.1/1.2 RCE | elasticsearch | 8.1 (v3.1) | High | 344360 , 344370 , 380026 , 390724 |
| CVE-2014-5111 | Fonality trixbox - Local File Inclusion | trixbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium | 333141 , 340156 , 341245 , 341256 , 342259 , 346755 , 390724 |
| CVE-2013-5755 | Yealink VoIP Phone SIP-T38G - Remote Command Execution | sip-t38g | 10.0 (v2.0) | High | 344370 , 390724 , 390726 , 392647 |
| CVE-2014-4940 | WordPress Plugin Tera Charts - Local File Inclusion | tera-charts | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-4941 | Cross RSS 1.7 - Local File Inclusion | wp-cross-rss | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2014-3515 | Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities | php | 7.5 (v2.0) | High | 344365 |
| CVE-2014-0864 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 6.8 (v2.0) | Medium | 392301 |
| CVE-2014-0867 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 5.8 (v2.0) | Medium | 392301 |
| CVE-2014-0865 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.9 (v2.0) | Medium | 392301 |
| CVE-2014-0868 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.9 (v2.0) | Medium | 392301 |
| CVE-2014-0866 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0869 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0870 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0871 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 4.3 (v2.0) | Medium | 392301 |
| CVE-2014-0894 | IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities | algo credit limits | 3.5 (v2.0) | Low | 392301 |
| CVE-2014-4513 | ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting | activehelper livehelp live chat | 4.3 (v2.0) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2014-2962 | Belkin N150 Router 1.00.08/1.00.09 - Path Traversal | n150 f9k1009 firmware | 7.8 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2012-5876 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium | 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2012-5877 | Nero MediaHome 4.5.8.0 - Denial of Service | mediahome | 5.0 (v2.0) | Medium | 390726 , 390727 , 392301 , 392647 , 392648 |
| CVE-2014-2846 | WD Arkeia Virtual Appliance 10.2.9 - Local File Inclusion | arkeia virtual appliance firmware | 7.5 (v2.0) | High | 344360 |
| CVE-2014-2383 | Dompdf < v0.6.0 - Local File Inclusion | dompdf | 6.8 (v2.0) | Medium | 340077 , 340165 , 344360 , 347009 |
| CVE-2014-2908 | Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting | simatic s7 cpu 1200 firmware | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-2287 | WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting | uploader | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2013-5640 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High | 344360 , 390727 , 392301 , 392648 |
| CVE-2013-2642 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 9.3 (v2.0) | High | 344362 , 344364 , 344366 |
| CVE-2013-2641 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 5.0 (v2.0) | Medium | 344362 , 344364 , 344366 |
| CVE-2013-2643 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 4.3 (v2.0) | Medium | 344362 , 344364 , 344366 |
| CVE-2013-5639 | Gnew 2013.1 - Multiple Vulnerabilities (2) | gnew | 7.5 (v2.0) | High | 344360 , 390727 , 392301 , 392648 |
| CVE-2014-1944 | Ilch CMS 2.0 - Persistent Cross-Site Scripting | ilch cms | 4.3 (v2.0) | Medium | 344370 |
| CVE-2012-5192 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 5.0 (v2.0) | Medium | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380026 |
| CVE-2013-7137 | Burden 1.8 - Authentication Bypass | burden | 9.8 (v3.1) | Critical | 390727 , 392301 , 392648 |
| CVE-2014-1206 | Open Web Analytics 1.5.4 - 'owa_email_address' SQL Injection | open web analytics | 7.5 (v2.0) | High | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2013-7240 | WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal | advanced dewplayer | 5.0 (v2.0) | Medium | 336461 , 340007 , 344360 , 381206 |
| CVE-2013-7091 | Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion | zimbra collaboration suite | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-6042 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 4.3 (v2.0) | Medium | 333140 , 333141 , 340149 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 350148 , 390726 , 392647 |
| CVE-2013-6164 | Project'Or RIA 3.4.0 - 'objectDetail.php?objectId' SQL Injection | projeqtor | 7.5 (v2.0) | High | 392301 |
| CVE-2013-5694 | Opsview pre 4.4.1 - Blind SQL Injection | opsview | 7.5 (v2.0) | High | 344370 , 390704 , 390726 , 392647 |
| CVE-2013-6281 | WordPress Spreadsheet - Cross-Site Scripting | dhtmlxspreadsheet | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2013-5528 | Cisco Unified Communications Manager 7/8/9 - Directory Traversal | unified communications manager | 4.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2013-5979 | Xibo 1.2.2/1.4.1 - Directory Traversal | xibo | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2013-4625 | WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting | duplicator | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-2251 | Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution | struts | 9.8 (v3.1) | Critical | 337209 , 337211 , 344361 , 393655 |
| CVE-2013-4117 | WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting | category-grid-view-gallery | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-1965 | Apache Struts2 S2-012 RCE | struts | 9.3 (v2.0) | High | 337207 , 337209 , 337211 , 344360 |
| CVE-2013-3526 | WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting | trafficanalyzer | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2013-0249 | cURL - Buffer Overflow (PoC) | curl | 7.5 (v2.0) | High | 390727 , 392301 , 392648 |
| CVE-2011-5265 | Featurific For WordPress 1.6.2 - Cross-Site Scripting | featurific-for-wordpress | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2011-4618 | Advanced Text Widget < 2.0.2 - Cross-Site Scripting | advanced text widget plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2012-5875 | FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference | firefly media server | 5.0 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2012-6499 | WordPress Plugin Age Verification v0.4 - Open Redirect | age verification | 5.8 (v2.0) | Medium | 392301 |
| CVE-2012-4982 | Forescout CounterACT 6.3.4.1 - Open Redirect | counteract | 5.8 (v2.0) | Medium | 340162 , 340163 |
| CVE-2010-5286 | Joomla! Component Jstore - 'Controller' Local File Inclusion | com jstore | 10.0 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-5913 | WordPress Integrator 1.32 - Cross-Site Scripting | wordpress integrator | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-4940 | Axigen Mail Server Filename Directory Traversal | axigen free mail server | 6.4 (v2.0) | Medium | 344365 , 347019 |
| CVE-2012-4547 | AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting | awstats | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2012-3153 | Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153) | fusion middleware | 6.4 (v2.0) | Medium | 340165 |
| CVE-2011-4640 | WebTitan < 3.60 - Local File Inclusion | webtitan | 4.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-5278 | MODx manager - Local File Inclusion | modx revolution | 4.3 (v2.0) | Medium | 340007 , 390613 , 390614 |
| CVE-2012-4242 | WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting | mf gig calendar | 4.3 (v2.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2011-5179 | Skysa App Bar 1.04 - Cross-Site Scripting | skysa app bar integration plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2011-5181 | ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting | clickdesk live support-live chat plugin | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2012-4889 | ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting | firewall analyzer | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2011-4448 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 7.5 (v2.0) | High | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4449 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4452 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4450 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.4 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4451 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 4.3 (v2.0) | Medium | 331702 , 340007 , 344360 , 344361 , 344362 , 344363 , 344370 , 360152 , 390715 , 390726 , 392647 |
| CVE-2011-4926 | Adminimize 1.7.22 - Cross-Site Scripting | adminimize | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2011-5106 | WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting | flexible custom post type | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2011-5107 | Alert Before Your Post <= 0.1.1 - Cross-Site Scripting | alert before you post | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2012-1835 | WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting | all-in-one event calendar | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 |
| CVE-2012-2371 | WP-FaceThumb 0.1 - Cross-Site Scripting | wp-facethumb | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-4253 | MySQLDumper 1.24.4 - Directory Traversal | mysqldumper | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-4273 | 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting | 2-click-social-media-buttons | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-3350 | Webmatic 3.1.1 - Blind SQL Injection | webmatic | 6.8 (v2.0) | Medium | 341245 , 390727 , 392301 , 392648 |
| CVE-2012-1823 | PHP CGI v5.3.12/5.4.2 Remote Code Execution | php | 9.8 (v3.1) | Critical | 340165 , 378491 |
| CVE-2009-5114 | WebGlimpse 2.18.7 - Directory Traversal | webglimpse | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2012-0996 | 11in1 CMS 1.2.1 - Local File Inclusion (LFI) | 11in1 | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-1226 | Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities | dolibarr erp/crm | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2012-0991 | OpenEMR 4.1 - Local File Inclusion | openemr | 3.5 (v2.0) | Low | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2012-0981 | phpShowtime 2.0 - Directory Traversal | phpshowtime | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-4899 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 7.5 (v2.0) | High | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2011-4898 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 5.0 (v2.0) | Medium | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2012-0782 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 4.3 (v2.0) | Medium | 340147 , 340148 , 344370 , 346755 , 381209 , 381210 , 390727 , 392301 , 392648 |
| CVE-2012-0286 | stoneware webnetwork6 - Multiple Vulnerabilities | webnetwork | 6.8 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2012-0285 | stoneware webnetwork6 - Multiple Vulnerabilities | webnetwork | 4.3 (v2.0) | Medium | 390726 , 392301 , 392647 , 392648 |
| CVE-2012-0896 | Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access | count per day | 5.0 (v2.0) | Medium | 344360 , 347009 , 390709 |
| CVE-2012-0901 | YouSayToo auto-publishing 1.0 - Cross-Site Scripting | yousaytoo | 4.3 (v2.0) | Medium | 340147 , 341266 , 342259 |
| CVE-2012-0392 | Apache Struts2 S2-008 RCE | struts | 6.8 (v2.0) | Medium | 337207 , 337209 , 337210 , 337211 , 344360 , 344370 , 347009 |
| CVE-2011-4804 | Joomla! Component com_kp - 'Controller' Local File Inclusion | com obsuggest | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-5028 | Joomla! Component JE Job 1.0 - Local File Inclusion | com jejob | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-4977 | Joomla! Component Canteen 1.0 - Local File Inclusion | com canteen | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-3315 | Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal | unified ip interactive voice response | 7.8 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-2744 | Chyrp 2.x - Local File Inclusion | chyrp | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-2780 | Chyrp 2.x - Local File Inclusion | chyrp | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-1669 | WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) | wp custom pages | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-4769 | Joomla! Component Jimtawl 1.0.2 - Local File Inclusion | com jimtawl | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-0049 | Majordomo2 - SMTP/HTTP Directory Traversal | majordomo 2 | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-4719 | Joomla! Component JRadio - Local File Inclusion | com jradio | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2011-0518 | LotusCMS 3.0 - Remote Code Execution | fraise | 5.1 (v2.0) | Medium | 340095 , 393655 |
| CVE-2010-4617 | Joomla! Component JotLoader 2.2.1 - Local File Inclusion | com jotloader | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-4275 | Radius Manager 3.8.0 - Multiple Cross-Site Scripting Vulnerabilities | radius manager | 3.5 (v2.0) | Low | 346755 |
| CVE-2010-4297 | VMware Tools - Update OS Command Injection | workstation | 7.2 (v2.0) | High | 392301 |
| CVE-2010-4282 | Pandora Fms < 3.1.1 - Directory Traversal | pandora fms | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-4231 | Camtron CMNC-200 IP Camera - Directory Traversal | cmnc-200 firmware | 7.8 (v2.0) | High | 347009 |
| CVE-2010-3486 | SmarterMail < 7.2.3925 - Persistent Cross-Site Scripting | smartermail | 5.0 (v2.0) | Medium | 392301 |
| CVE-2010-3426 | Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion | com jphone | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-3203 | Joomla! Component PicSell 1.0 - Arbitrary File Retrieval | com picsell | 5.0 (v2.0) | Medium | 340007 , 344360 |
| CVE-2010-2861 | Adobe ColdFusion - Directory Traversal | coldfusion | 9.8 (v3.1) | Critical | 340007 , 344360 , 347009 , 390613 , 390614 , 390704 , 390709 |
| CVE-2010-2918 | Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion | com joomla visites | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-2920 | Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion | com foobla suggestions | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2857 | Joomla! Component Music Manager - Local File Inclusion | com music | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2682 | Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion | com realtyna | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2680 | Joomla! Component jesectionfinder - Local File Inclusion | com jesectionfinder | 6.8 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-2507 | Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion | com picasa2gallery | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2307 | Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal | surfboard sbv6120e | 5.0 (v2.0) | Medium | 347009 |
| CVE-2010-2259 | Joomla! Component com_bfsurvey - Local File Inclusion | com bfsurvey profree | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2128 | Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion | com jequoteform | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2122 | Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval | com simpledownload | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2033 | Joomla! Percha Categories Tree 0.6 - Local File Inclusion | com perchacategoriestree | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2034 | Joomla! Component Percha Image Attach 1.1 - Directory Traversal | com perchaimageattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2035 | Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal | com perchagallery | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2036 | Joomla! Component Percha Fields Attach 1.0 - Directory Traversal | com perchafieldsattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2037 | Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal | com perchadownloadsattach | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2045 | Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion | com dioneformwizard | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2050 | Joomla! Component MS Comment 0.8.0b - Local File Inclusion | com mscomment | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-2018 | Lokomedia CMS - Local File Inclusion | lokomedia cms | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-1952 | Joomla! Component BeeHeard 1.0 - Local File Inclusion | com beeheard | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1953 | Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion | com multimap | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1954 | Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion | com multiroot | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1955 | Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion | com blogfactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1956 | Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion | com gadgetfactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1957 | Joomla! Component Love Factory 1.3.4 - Local File Inclusion | com lovefactory | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1977 | Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion | com jwhmcs | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1980 | Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion | com joomlaflickr | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1983 | Joomla! Component redTWITTER 1.0 - Local File Inclusion | com redtwitter | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1979 | Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion | com datafeeds | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1981 | Joomla! Component Fabrik 2.0 - Local File Inclusion | fabrik | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1982 | Joomla! Component JA Voice 2.0 - Local File Inclusion | com javoice | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1875 | Joomla! Component Property - Local File Inclusion | com properties | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1878 | Joomla! Component OrgChart 1.0.0 - Local File Inclusion | com orgchart | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1858 | Joomla! Component SMEStorage - Local File Inclusion | com smestorage | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1717 | Joomla! Component iF surfALERT 1.2 - Local File Inclusion | if surfalert | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1715 | Joomla! Component Online Exam 1.5.0 - Local File Inclusion | com onlineexam | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1718 | Joomla! Component Archery Scores 1.0.6 - Local File Inclusion | com archeryscores | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1719 | Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion | com mtfireeagle | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1722 | Joomla! Component Online Market 2.x - Local File Inclusion | com market | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1723 | Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion | com drawroot | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1714 | Joomla! Component Arcade Games 1.0 - Local File Inclusion | com arcadegames | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1653 | Joomla! Component Graphics 1.0.6 - Local File Inclusion | com graphics | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1657 | Joomla! Component SmartSite 1.0.0 - Local File Inclusion | com smartsite | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1658 | Joomla! Component NoticeBoard 1.3 - Local File Inclusion | com noticeboard | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1659 | Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion | com ultimateportfolio | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1602 | Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion | com zimbcomment | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1603 | Joomla! Component ZiMBCore 0.1 - Local File Inclusion | com zimbcore | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1607 | Joomla! Component WMI 1.5.0 - Local File Inclusion | com wmi | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1601 | Joomla! Component JA Comment - Local File Inclusion | com jacomment | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1429 | Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure | jboss enterprise application platform | 5.0 (v2.0) | Medium | 382240 |
| CVE-2010-1531 | Joomla! Component redSHOP 1.0 - Local File Inclusion | com redshop | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1533 | Joomla! Component TweetLA 1.0.1 - Local File Inclusion | com tweetla | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1535 | Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion | com travelbook | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1532 | Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion | com powermail | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1534 | Joomla! Component Shoutbox Pro - Local File Inclusion | com shoutbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1540 | Joomla! Component com_blog - Directory Traversal | com myblog | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1495 | Joomla! Component Matamko 1.01 - Local File Inclusion | com matamko | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1491 | Joomla! Component MMS Blog 2.3.0 - Local File Inclusion | com mmsblog | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1494 | Joomla! Component AWDwall 1.5.4 - Local File Inclusion | com awdwall | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1470 | Joomla! Component Web TV 1.0 - Local File Inclusion | com webtv | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1471 | Joomla! Component Address Book 1.5.0 - Local File Inclusion | com addressbook | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1472 | Joomla! Component Horoscope 1.5.0 - Local File Inclusion | com horoscope | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1469 | Joomla! Component JProject Manager 1.0 - Local File Inclusion | com jprojectmanager | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1473 | Joomla! Component Advertising 0.25 - Local File Inclusion | com advertising | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1474 | Joomla! Component Sweetykeeper 1.5 - Local File Inclusion | com sweetykeeper | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1475 | Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion | com preventive | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1476 | Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion | com alphauserpoints | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1478 | Joomla! Component Jfeedback 1.2 - Local File Inclusion | com jfeedback | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1461 | Joomla! Component Photo Battle 1.0.1 - Local File Inclusion | com photobattle | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1352 | Joomla! Component Juke Box 1.7 - Local File Inclusion | com jukebox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1353 | Joomla! Component LoginBox - Local File Inclusion | com loginbox | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1354 | Joomla! Component VJDEO 1.0 - Local File Inclusion | com vjdeo | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1340 | Joomla! Component com_jresearch - 'Controller' Local File Inclusion | com jresearch | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1345 | Joomla! Component Cookex Agency CKForms - Local File Inclusion | com ckforms | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1306 | Joomla! Component Picasa 2.0 - Local File Inclusion | com joomlapicasa2 | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1304 | Joomla! Component User Status - Local File Inclusion | com userstatus | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1305 | Joomla! Component JInventory 1.23.02 - Local File Inclusion | com jinventory | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1307 | Joomla! Component Magic Updater - Local File Inclusion | com joomlaupdater | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1308 | Joomla! Component SVMap 1.1.1 - Local File Inclusion | com svmap | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1312 | Joomla! Component News Portal 1.5.x - Local File Inclusion | com news portal | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1314 | Joomla! Component Highslide 1.5 - Local File Inclusion | com hsconfig | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1315 | Joomla! Component webERPcustomer - Local File Inclusion | com weberpcustomer | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1313 | Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion | com sebercart | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1302 | Joomla! Component DW Graph - Local File Inclusion | com dwgraphs | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1219 | Joomla! Component com_janews - Local File Inclusion | com janews | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1217 | Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion | je form creator | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1056 | Joomla! Component com_rokdownloads - Local File Inclusion | com rokdownloads | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-1081 | Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion | com communitypolls | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0972 | Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion | com gcalendar | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0985 | Joomla! Component com_abbrev - Local File Inclusion | com abbrev | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0982 | Joomla! Component com_cartweberp - Local File Inclusion | com cartweberp | 4.3 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-4679 | Joomla! Portfolio Nexus - Remote File Inclusion | com if nexus | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-0942 | Joomla! Component com_jvideodirect - Directory Traversal | com jvideodirect | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0943 | Joomla! Component com_jashowcase - Directory Traversal | com jashowcase | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0944 | Joomla! Component com_jcollection - Directory Traversal | com jcollection | 5.0 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0759 | Joomla! Plugin Core Design Scriptegrator - Local File Inclusion | scriptegrator plugin | 7.5 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2010-0696 | Joomla! Component Jw_allVideos - Arbitrary File Retrieval | jw allvideos | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2010-0467 | Joomla! Component CCNewsLetter - Local File Inclusion | com ccnewsletter | 5.8 (v3.1) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2010-0157 | Joomla! Component com_biblestudy - Local File Inclusion | joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-4223 | KR-Web <=1.1b2 - Remote File Inclusion | kr-php web content server | 7.5 (v2.0) | High | 340162 , 340163 |
| CVE-2009-4202 | Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion | joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-1479 | boxalino 09.05.25-0421 - Directory Traversal | boxalino | 7.5 (v2.0) | High | 340007 , 344360 , 390709 |
| CVE-2009-3318 | Joomla! Roland Breedveld Album 1.14 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-3053 | Joomla! Agora 3.0.0b - Local File Inclusion | Joomla! | 6.8 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6982 | Devalcms 1.4a - Cross-Site Scripting | devalcms | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 |
| CVE-2009-1872 | Adobe Coldfusion <=8.0.1 - Cross-Site Scripting | coldfusion | 4.3 (v2.0) | Medium | 340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2009-2100 | Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-2015 | Joomla! MooFAQ 1.0 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-1558 | Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion | wvc54gca | 7.8 (v2.0) | High | 344360 , 347009 , 390709 |
| CVE-2009-1496 | Joomla! Cmimarketplace 0.1 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6668 | nweb2fax <=0.2.7 - Local File Inclusion | nweb2fax | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2009-1151 | PhpMyAdmin Scripts - Remote Code Execution | phpmyadmin | 9.8 (v3.1) | Critical | 340029 , 344360 |
| CVE-2009-0932 | Horde/Horde Groupware - Local File Inclusion | horde | 6.4 (v2.0) | Medium | 340007 , 340029 , 344360 , 390613 , 390614 , 390709 |
| CVE-2008-6465 | Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting | h-sphere | 4.3 (v2.0) | Medium | 333141 , 340149 , 342259 , 346755 , 347198 , 360030 |
| CVE-2008-6222 | Joomla! ProDesk 1.0/1.2 - Local File Inclusion | pro desk support center | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-6172 | Joomla! Component RWCards 3.0.11 - Local File Inclusion | rwcards | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2009-0545 | ZeroShell <= 1.0beta11 Remote Code Execution | zeroshell | 10.0 (v2.0) | High | 312657 , 340007 , 340029 , 344360 , 344370 , 347009 , 390709 |
| CVE-2008-6080 | Joomla! ionFiles 4.4.2 - Local File Inclusion | com ionfiles | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-5587 | phpPgAdmin <=4.2.1 - Local File Inclusion | phppgadmin | 4.3 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2008-4764 | Joomla! <=2.0.0 RC2 - Local File Inclusion | com extplorer | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-4668 | Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion | com imagebrowser | 9.0 (v2.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2008-1547 | Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection | exchange server | 4.3 (v2.0) | Medium | 390716 |
| CVE-2008-2938 | toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities | tomcat | 4.3 (v2.0) | Medium | 392301 |
| CVE-2008-2650 | CMSimple 3.1 - Local File Inclusion | cmsimple | 6.8 (v2.0) | Medium | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2008-2398 | AppServ Open Project <=2.5.10 - Cross-Site Scripting | appserv | 4.3 (v2.0) | Medium | 333141 , 341256 , 342259 , 346755 |
| CVE-2008-1059 | WordPress Sniplets 1.1.2 - Local File Inclusion | sniplets plugin | 7.5 (v2.0) | High | 336461 , 340007 , 344360 , 381206 |
| CVE-2008-1061 | WordPress Sniplets <=1.2.2 - Cross-Site Scripting | sniplets plugin | 4.3 (v2.0) | Medium | 340147 , 341266 |
| CVE-2007-5728 | phpPgAdmin <=4.1.1 - Cross-Site Scripting | phppgadmin | 4.3 (v2.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2007-4556 | OpenSymphony XWork/Apache Struts2 - Remote Code Execution | xwork | 6.8 (v2.0) | Medium | 337207 , 337209 , 337211 , 344360 |
| CVE-2007-4504 | Joomla! RSfiles <=1.0.2 - Local File Inclusion | rsfiles | 5.0 (v2.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2007-3385 | Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure | tomcat | 4.3 (v2.0) | Medium | 390727 , 392301 , 392648 |
| CVE-2007-2449 | Apache Tomcat 4.x-7.x - Cross-Site Scripting | tomcat | 4.3 (v2.0) | Medium | 340147 , 341266 , 346755 |
| CVE-2007-0885 | Jira Rainbow.Zen - Cross-Site Scripting | rainbow.zen | 6.8 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2006-3835 | toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities | tomcat | 5.0 (v2.0) | Medium | 392301 |
| CVE-2006-3392 | Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure | webmin | 5.0 (v2.0) | Medium | 347009 |
| CVE-2006-2842 | Squirrelmail <=1.4.6 - Local File Inclusion | squirrelmail | 7.5 (v2.0) | High | 340007 , 340029 , 344360 , 347009 , 390613 , 390614 , 390709 |
| CVE-2006-2826 | PHPLib < 7.4 - SQL Injection | phplib | 7.5 (v2.0) | High | 340017 , 340181 , 341245 , 344370 , 360147 , 360148 |
| CVE-2006-1681 | Cherokee HTTPD <=0.5 - Cross-Site Scripting | cherokee httpd | 4.3 (v2.0) | Medium | 341266 |
| CVE-2006-0887 | PHPLib < 7.4 - SQL Injection | phplib | 7.5 (v2.0) | High | 340017 , 340181 , 341245 , 344370 , 360147 , 360148 |
| CVE-2005-4385 | Cofax <=2.0RC3 - Cross-Site Scripting | cofax | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2005-3128 | SquirrelMail Address Add 1.4.2 - Cross-Site Scripting | address add plugin | 4.3 (v2.0) | Medium | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2004-0519 | SquirrelMail 1.4.x - Folder Name Cross-Site Scripting | propack | 6.8 (v2.0) | Medium | 341266 , 346755 |
| CVE-2002-1131 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | squirrelmail | 7.5 (v2.0) | High | 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2001-1341 | Solare Datensysteme Solar-Log Devices 2.8.4-56/3.5.2-85 - Multiple Vulnerabilities | ipc at chip embedded-webserver | 5.0 (v2.0) | Medium | 390716 , 392301 |
| CVE-2000-0760 | Jakarta Tomcat 3.1 and 3.0 - Information Disclosure | tomcat | 6.4 (v2.0) | Medium | 310094 |
| CVE-2000-0114 | Microsoft FrontPage Extensions - Information Disclosure | internet information server | 5.0 (v2.0) | Medium | 310226 , 392301 |
| CVE-2026-53629 | GLPI - Blind SQL Injection in History Log Filter (LogBleed) | - | 8.8 (v3.1) | High | 380026 |
| CVE-2024-23167 | GestSup - Cross-Site Scripting | gestsup | 8.6 | High | 333141 |
| CVE-2026-57582 | GeoNetwork - Reflected Cross-Site Scripting | core-geonetwork | 8.2 (v3.1) | High | 346755 |
| CVE-2024-25669 | CaseAware a360inc - Cross-Site Scripting | caseaware | 6.1 | Medium | 347198 |
| CVE-2018-10818 | LG NAS Devices - Remote Code Execution | - | N/A | N/A | 340014 |
| CVE-2019-8962 | FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) | - | N/A | N/A | 345490 |
| CVE-2023-1434 | Odoo - Cross-Site Scripting | odoo | N/A | N/A | 341266 |
| CVE-2023-46391 | WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS) | - | N/A | N/A | 340147 , 340148 , 346755 , 390585 |
| CVE-2025-32101 | UNA CMS <= 14.0.0-RC4 - PHP Object Injection | - | N/A | N/A | 390501 , 390614 |