• CVE-2000-0114: Microsoft FrontPage Extensions - Information Disclosure
• CVE-2000-0760: Jakarta Tomcat 3.1 and 3.0 - Information Disclosure
• CVE-2002-1131: SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting
• CVE-2004-0519: SquirrelMail 1.4.x - Folder Name Cross-Site Scripting
• CVE-2005-3128: SquirrelMail Address Add 1.4.2 - Cross-Site Scripting
• CVE-2005-4385: Cofax <=2.0RC3 - Cross-Site Scripting
• CVE-2006-1681: Cherokee HTTPD <=0.5 - Cross-Site Scripting
• CVE-2006-2842: Squirrelmail <=1.4.6 - Local File Inclusion
• CVE-2006-3392: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
• CVE-2006-3835: toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities
• CVE-2007-0885: Jira Rainbow.Zen - Cross-Site Scripting
• CVE-2007-2449: Apache Tomcat 4.x-7.x - Cross-Site Scripting
• CVE-2007-3385: Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure
• CVE-2007-4504: Joomla! RSfiles <=1.0.2 - Local File Inclusion
• CVE-2007-4556: OpenSymphony XWork/Apache Struts2 - Remote Code Execution
• CVE-2007-5728: phpPgAdmin <=4.1.1 - Cross-Site Scripting
• CVE-2008-1059: WordPress Sniplets 1.1.2 - Local File Inclusion
• CVE-2008-1061: WordPress Sniplets <=1.2.2 - Cross-Site Scripting
• CVE-2008-1547: Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection
• CVE-2008-2398: AppServ Open Project <=2.5.10 - Cross-Site Scripting
• CVE-2008-2650: CMSimple 3.1 - Local File Inclusion
• CVE-2008-2938: toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities
• CVE-2008-4668: Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion
• CVE-2008-4764: Joomla! <=2.0.0 RC2 - Local File Inclusion
• CVE-2008-5587: phpPgAdmin <=4.2.1 - Local File Inclusion
• CVE-2008-6080: Joomla! ionFiles 4.4.2 - Local File Inclusion
• CVE-2008-6172: Joomla! Component RWCards 3.0.11 - Local File Inclusion
• CVE-2008-6222: Joomla! ProDesk 1.0/1.2 - Local File Inclusion
• CVE-2008-6465: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
• CVE-2008-6668: nweb2fax <=0.2.7 - Local File Inclusion
• CVE-2008-6982: Devalcms 1.4a - Cross-Site Scripting
• CVE-2009-0545: ZeroShell <= 1.0beta11 Remote Code Execution
• CVE-2009-0932: Horde/Horde Groupware - Local File Inclusion
• CVE-2009-1151: PhpMyAdmin Scripts - Remote Code Execution
• CVE-2009-1496: Joomla! Cmimarketplace 0.1 - Local File Inclusion
• CVE-2009-1558: Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion
• CVE-2009-1872: Adobe Coldfusion <=8.0.1 - Cross-Site Scripting
• CVE-2009-2015: Joomla! MooFAQ 1.0 - Local File Inclusion
• CVE-2009-2100: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion
• CVE-2009-3053: Joomla! Agora 3.0.0b - Local File Inclusion
• CVE-2009-3318: Joomla! Roland Breedveld Album 1.14 - Local File Inclusion
• CVE-2009-4202: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion
• CVE-2009-4223: KR-Web <=1.1b2 - Remote File Inclusion
• CVE-2009-4679: Joomla! Portfolio Nexus - Remote File Inclusion
• CVE-2009-5114: WebGlimpse 2.18.7 - Directory Traversal
• CVE-2010-0157: Joomla! Component com_biblestudy - Local File Inclusion
• CVE-2010-0467: Joomla! Component CCNewsLetter - Local File Inclusion
• CVE-2010-0696: Joomla! Component Jw_allVideos - Arbitrary File Retrieval
• CVE-2010-0759: Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
• CVE-2010-0942: Joomla! Component com_jvideodirect - Directory Traversal
• CVE-2010-0943: Joomla! Component com_jashowcase - Directory Traversal
• CVE-2010-0944: Joomla! Component com_jcollection - Directory Traversal
• CVE-2010-0972: Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion
• CVE-2010-0982: Joomla! Component com_cartweberp - Local File Inclusion
• CVE-2010-0985: Joomla! Component com_abbrev - Local File Inclusion
• CVE-2010-1056: Joomla! Component com_rokdownloads - Local File Inclusion
• CVE-2010-1081: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion
• CVE-2010-1217: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion
• CVE-2010-1219: Joomla! Component com_janews - Local File Inclusion
• CVE-2010-1302: Joomla! Component DW Graph - Local File Inclusion
• CVE-2010-1304: Joomla! Component User Status - Local File Inclusion
• CVE-2010-1305: Joomla! Component JInventory 1.23.02 - Local File Inclusion
• CVE-2010-1306: Joomla! Component Picasa 2.0 - Local File Inclusion
• CVE-2010-1307: Joomla! Component Magic Updater - Local File Inclusion
• CVE-2010-1308: Joomla! Component SVMap 1.1.1 - Local File Inclusion
• CVE-2010-1312: Joomla! Component News Portal 1.5.x - Local File Inclusion
• CVE-2010-1313: Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion
• CVE-2010-1314: Joomla! Component Highslide 1.5 - Local File Inclusion
• CVE-2010-1315: Joomla! Component webERPcustomer - Local File Inclusion
• CVE-2010-1340: Joomla! Component com_jresearch - 'Controller' Local File Inclusion
• CVE-2010-1345: Joomla! Component Cookex Agency CKForms - Local File Inclusion
• CVE-2010-1352: Joomla! Component Juke Box 1.7 - Local File Inclusion
• CVE-2010-1353: Joomla! Component LoginBox - Local File Inclusion
• CVE-2010-1354: Joomla! Component VJDEO 1.0 - Local File Inclusion
• CVE-2010-1429: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure
• CVE-2010-1461: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion
• CVE-2010-1469: Joomla! Component JProject Manager 1.0 - Local File Inclusion
• CVE-2010-1470: Joomla! Component Web TV 1.0 - Local File Inclusion
• CVE-2010-1471: Joomla! Component Address Book 1.5.0 - Local File Inclusion
• CVE-2010-1472: Joomla! Component Horoscope 1.5.0 - Local File Inclusion
• CVE-2010-1473: Joomla! Component Advertising 0.25 - Local File Inclusion
• CVE-2010-1474: Joomla! Component Sweetykeeper 1.5 - Local File Inclusion
• CVE-2010-1475: Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion
• CVE-2010-1476: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion
• CVE-2010-1478: Joomla! Component Jfeedback 1.2 - Local File Inclusion
• CVE-2010-1491: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion
• CVE-2010-1494: Joomla! Component AWDwall 1.5.4 - Local File Inclusion
• CVE-2010-1495: Joomla! Component Matamko 1.01 - Local File Inclusion
• CVE-2010-1531: Joomla! Component redSHOP 1.0 - Local File Inclusion
• CVE-2010-1532: Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion
• CVE-2010-1533: Joomla! Component TweetLA 1.0.1 - Local File Inclusion
• CVE-2010-1534: Joomla! Component Shoutbox Pro - Local File Inclusion
• CVE-2010-1535: Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion
• CVE-2010-1540: Joomla! Component com_blog - Directory Traversal
• CVE-2010-1601: Joomla! Component JA Comment - Local File Inclusion
• CVE-2010-1602: Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion
• CVE-2010-1603: Joomla! Component ZiMBCore 0.1 - Local File Inclusion
• CVE-2010-1607: Joomla! Component WMI 1.5.0 - Local File Inclusion
• CVE-2010-1653: Joomla! Component Graphics 1.0.6 - Local File Inclusion
• CVE-2010-1657: Joomla! Component SmartSite 1.0.0 - Local File Inclusion
• CVE-2010-1658: Joomla! Component NoticeBoard 1.3 - Local File Inclusion
• CVE-2010-1659: Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion
• CVE-2010-1714: Joomla! Component Arcade Games 1.0 - Local File Inclusion
• CVE-2010-1715: Joomla! Component Online Exam 1.5.0 - Local File Inclusion
• CVE-2010-1717: Joomla! Component iF surfALERT 1.2 - Local File Inclusion
• CVE-2010-1718: Joomla! Component Archery Scores 1.0.6 - Local File Inclusion
• CVE-2010-1719: Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion
• CVE-2010-1722: Joomla! Component Online Market 2.x - Local File Inclusion
• CVE-2010-1723: Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion
• CVE-2010-1858: Joomla! Component SMEStorage - Local File Inclusion
• CVE-2010-1875: Joomla! Component Property - Local File Inclusion
• CVE-2010-1878: Joomla! Component OrgChart 1.0.0 - Local File Inclusion
• CVE-2010-1952: Joomla! Component BeeHeard 1.0 - Local File Inclusion
• CVE-2010-1953: Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion
• CVE-2010-1954: Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion
• CVE-2010-1955: Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion
• CVE-2010-1956: Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion
• CVE-2010-1957: Joomla! Component Love Factory 1.3.4 - Local File Inclusion
• CVE-2010-1977: Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion
• CVE-2010-1979: Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion
• CVE-2010-1980: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion
• CVE-2010-1981: Joomla! Component Fabrik 2.0 - Local File Inclusion
• CVE-2010-1982: Joomla! Component JA Voice 2.0 - Local File Inclusion
• CVE-2010-1983: Joomla! Component redTWITTER 1.0 - Local File Inclusion
• CVE-2010-2018: Lokomedia CMS - Local File Inclusion
• CVE-2010-2033: Joomla! Percha Categories Tree 0.6 - Local File Inclusion
• CVE-2010-2034: Joomla! Component Percha Image Attach 1.1 - Directory Traversal
• CVE-2010-2035: Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal
• CVE-2010-2036: Joomla! Component Percha Fields Attach 1.0 - Directory Traversal
• CVE-2010-2037: Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal
• CVE-2010-2045: Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion
• CVE-2010-2050: Joomla! Component MS Comment 0.8.0b - Local File Inclusion
• CVE-2010-2122: Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval
• CVE-2010-2128: Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion
• CVE-2010-2259: Joomla! Component com_bfsurvey - Local File Inclusion
• CVE-2010-2307: Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal
• CVE-2010-2507: Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion
• CVE-2010-2680: Joomla! Component jesectionfinder - Local File Inclusion
• CVE-2010-2682: Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion
• CVE-2010-2857: Joomla! Component Music Manager - Local File Inclusion
• CVE-2010-2861: Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
• CVE-2010-2918: Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion
• CVE-2010-2920: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion
• CVE-2010-3203: Joomla! Component PicSell 1.0 - Arbitrary File Retrieval
• CVE-2010-3426: Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion
• CVE-2010-4231: Camtron CMNC-200 IP Camera - Directory Traversal
• CVE-2010-4239: Tiki Wiki CMS Groupware 5.2 - Local File Inclusion
• CVE-2010-4282: Pandora Fms < 3.1.1 - Directory Traversal
• CVE-2010-4617: Joomla! Component JotLoader 2.2.1 - Local File Inclusion
• CVE-2010-4719: Joomla! Component JRadio - Local File Inclusion
• CVE-2010-4769: Joomla! Component Jimtawl 1.0.2 - Local File Inclusion
• CVE-2010-4977: Joomla! Component Canteen 1.0 - Local File Inclusion
• CVE-2010-5028: Joomla! Component JE Job 1.0 - Local File Inclusion
• CVE-2010-5278: MODx manager - Local File Inclusion
• CVE-2010-5286: Joomla! Component Jstore - 'Controller' Local File Inclusion
• CVE-2011-0049: Majordomo2 - SMTP/HTTP Directory Traversal
• CVE-2011-0518: LotusCMS 3.0 - Remote Code Execution
• CVE-2011-1669: WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)
• CVE-2011-2744: Chyrp 2.x - Local File Inclusion
• CVE-2011-2780: Chyrp 2.x - Local File Inclusion
• CVE-2011-3315: Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal
• CVE-2011-4336: Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting
• CVE-2011-4448: WikkaWiki 1.3.2 - Multiple Vulnerabilities
• CVE-2011-4449: WikkaWiki 1.3.2 - Multiple Vulnerabilities
• CVE-2011-4450: WikkaWiki 1.3.2 - Multiple Vulnerabilities
• CVE-2011-4451: WikkaWiki 1.3.2 - Multiple Vulnerabilities
• CVE-2011-4452: WikkaWiki 1.3.2 - Multiple Vulnerabilities
• CVE-2011-4618: Advanced Text Widget < 2.0.2 - Cross-Site Scripting
• CVE-2011-4624: GRAND FlAGallery 1.57 - Cross-Site Scripting
• CVE-2011-4640: WebTitan < 3.60 - Local File Inclusion
• CVE-2011-4804: Joomla! Component com_kp - 'Controller' Local File Inclusion
• CVE-2011-4898: WordPress Core 3.3.1 - Multiple Vulnerabilities
• CVE-2011-4899: WordPress Core 3.3.1 - Multiple Vulnerabilities
• CVE-2011-4926: Adminimize 1.7.22 - Cross-Site Scripting
• CVE-2011-5106: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
• CVE-2011-5107: Alert Before Your Post <= 0.1.1 - Cross-Site Scripting
• CVE-2011-5179: Skysa App Bar 1.04 - Cross-Site Scripting
• CVE-2011-5181: ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting
• CVE-2011-5265: Featurific For WordPress 1.6.2 - Cross-Site Scripting
• CVE-2012-0285: stoneware webnetwork6 - Multiple Vulnerabilities
• CVE-2012-0286: stoneware webnetwork6 - Multiple Vulnerabilities
• CVE-2012-0392: Apache Struts2 S2-008 RCE
• CVE-2012-0782: WordPress Core 3.3.1 - Multiple Vulnerabilities
• CVE-2012-0896: Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access
• CVE-2012-0901: YouSayToo auto-publishing 1.0 - Cross-Site Scripting
• CVE-2012-0981: phpShowtime 2.0 - Directory Traversal
• CVE-2012-0991: OpenEMR 4.1 - Local File Inclusion
• CVE-2012-0996: 11in1 CMS 1.2.1 - Local File Inclusion (LFI)
• CVE-2012-10018: WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload
• CVE-2012-1226: Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities
• CVE-2012-1258: Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
• CVE-2012-1259: Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
• CVE-2012-1260: Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
• CVE-2012-1261: Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
• CVE-2012-1823: PHP CGI v5.3.12/5.4.2 Remote Code Execution
• CVE-2012-1835: WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting
• CVE-2012-2371: WP-FaceThumb 0.1 - Cross-Site Scripting
• CVE-2012-3153: Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
• CVE-2012-3350: Webmatic 3.1.1 - Blind SQL Injection
• CVE-2012-4240: Group Office Calendar - '/calendar/json.php' SQL Injection
• CVE-2012-4242: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting
• CVE-2012-4253: MySQLDumper 1.24.4 - Directory Traversal
• CVE-2012-4273: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting
• CVE-2012-4547: AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting
• CVE-2012-4768: WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting
• CVE-2012-4889: ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting
• CVE-2012-4940: Axigen Mail Server Filename Directory Traversal
• CVE-2012-4982: Forescout CounterACT 6.3.4.1 - Open Redirect
• CVE-2012-5192: Bitweaver 2.8.1 - Multiple Vulnerabilities
• CVE-2012-5193: Bitweaver 2.8.1 - Multiple Vulnerabilities
• CVE-2012-5451: TVMOBiLi 2.1.0.3557 - Denial of Service
• CVE-2012-5875: FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference
• CVE-2012-5876: Nero MediaHome 4.5.8.0 - Denial of Service
• CVE-2012-5877: Nero MediaHome 4.5.8.0 - Denial of Service
• CVE-2012-5913: WordPress Integrator 1.32 - Cross-Site Scripting
• CVE-2012-6499: WordPress Plugin Age Verification v0.4 - Open Redirect
• CVE-2013-0249: cURL - Buffer Overflow (PoC)
• CVE-2013-1965: Apache Struts2 S2-012 RCE
• CVE-2013-2251: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
• CVE-2013-2287: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting
• CVE-2013-2678: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2679: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2680: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2681: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2682: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2683: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-2684: Cisco Linksys E4200 - Multiple Vulnerabilities
• CVE-2013-3526: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting
• CVE-2013-4117: WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting
• CVE-2013-4625: WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting
• CVE-2013-4861: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
• CVE-2013-4862: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
• CVE-2013-4863: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
• CVE-2013-4864: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
• CVE-2013-4865: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
• CVE-2013-5528: Cisco Unified Communications Manager 7/8/9 - Directory Traversal
• CVE-2013-5639: Gnew 2013.1 - Multiple Vulnerabilities (2)
• CVE-2013-5640: Gnew 2013.1 - Multiple Vulnerabilities (2)
• CVE-2013-5694: Opsview pre 4.4.1 - Blind SQL Injection
• CVE-2013-5755: Yealink VoIP Phone SIP-T38G - Remote Command Execution
• CVE-2013-5758: Yealink VoIP Phone SIP-T38G - Privilege Escalation
• CVE-2013-5759: Yealink VoIP Phone SIP-T38G - Privilege Escalation
• CVE-2013-5979: Xibo 1.2.2/1.4.1 - Directory Traversal
• CVE-2013-6041: Webuzo 2.1.3 - Multiple Vulnerabilities
• CVE-2013-6042: Webuzo 2.1.3 - Multiple Vulnerabilities
• CVE-2013-6043: Webuzo 2.1.3 - Multiple Vulnerabilities
• CVE-2013-6281: WordPress Spreadsheet - Cross-Site Scripting
• CVE-2013-7091: Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion
• CVE-2013-7137: Burden 1.8 - Authentication Bypass
• CVE-2013-7240: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal
• CVE-2013-7285: XStream <1.4.6/1.4.10 - Remote Code Execution
• CVE-2014-0191: eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
• CVE-2014-0864: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0865: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0866: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0867: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0868: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0869: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0870: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0871: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-0894: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
• CVE-2014-100004: Sitecore CMS - Cross-Site Scripting
• CVE-2014-10037: DomPHP 0.83 - Directory Traversal
• CVE-2014-1203: Eyou E-Mail <3.6 - Remote Code Execution
• CVE-2014-1222: Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
• CVE-2014-1944: Ilch CMS 2.0 - Persistent Cross-Site Scripting
• CVE-2014-2383: Dompdf < v0.6.0 - Local File Inclusion
• CVE-2014-2908: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
• CVE-2014-2962: Belkin N150 Router 1.00.08/1.00.09 - Path Traversal
• CVE-2014-3120: ElasticSearch v1.1.1/1.2 RCE
• CVE-2014-3206: Seagate BlackArmor NAS - Command Injection
• CVE-2014-3704: Drupal SQL Injection
• CVE-2014-3744: Node.js st module Directory Traversal
• CVE-2014-4513: ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting
• CVE-2014-4535: Import Legacy Media <= 0.1 - Cross-Site Scripting
• CVE-2014-4536: Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting
• CVE-2014-4539: Movies <= 0.6 - Cross-Site Scripting
• CVE-2014-4544: Podcast Channels < 0.28 - Cross-Site Scripting
• CVE-2014-4550: Shortcode Ninja <= 1.4 - Cross-Site Scripting
• CVE-2014-4558: WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting
• CVE-2014-4561: Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting
• CVE-2014-4577: WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion
• CVE-2014-4592: WP Planet <= 0.1 - Cross-Site Scripting
• CVE-2014-4940: WordPress Plugin Tera Charts - Local File Inclusion
• CVE-2014-4941: Cross RSS 1.7 - Local File Inclusion
• CVE-2014-5111: Fonality trixbox - Local File Inclusion
• CVE-2014-5181: Last.fm Rotation 1.0 - Path Traversal
• CVE-2014-5187: Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal
• CVE-2014-5258: webEdition 6.3.8.0 - Directory Traversal
• CVE-2014-5308: TestLink 1.9.11 - Multiple SQL Injections
• CVE-2014-5368: WordPress Plugin WP Content Source Control - Directory Traversal
• CVE-2014-6271: ShellShock - Remote Code Execution
• CVE-2014-6287: HTTP File Server <2.3c - Remote Command Execution
• CVE-2014-6308: Osclass Security Advisory 3.4.1 - Local File Inclusion
• CVE-2014-6389: PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution
• CVE-2014-7176: Enalean Tuleap 7.4.99.5 - Blind SQL Injection
• CVE-2014-7884: ArcSight Logger - Arbitrary File Upload / Code Execution
• CVE-2014-8356: ZHONE < S3.0.501 - Multiple Vulnerabilities
• CVE-2014-8357: ZHONE < S3.0.501 - Multiple Vulnerabilities
• CVE-2014-8673: SO Planning 1.32 - Multiple Vulnerabilities
• CVE-2014-8674: SO Planning 1.32 - Multiple Vulnerabilities
• CVE-2014-8675: SO Planning 1.32 - Multiple Vulnerabilities
• CVE-2014-8676: SO Planning 1.32 - Multiple Vulnerabilities
• CVE-2014-8677: SO Planning 1.32 - Multiple Vulnerabilities
• CVE-2014-8682: Gogs (Go Git Service) - SQL Injection
• CVE-2014-8799: WordPress Plugin DukaPress 2.5.2 - Directory Traversal
• CVE-2014-8877: WordPress Plugin CM Download Manager 2.0.0 - Code Injection
• CVE-2014-9094: WordPress DZS-VideoGallery Plugin Cross-Site Scripting
• CVE-2014-9118: ZHONE < S3.0.501 - Multiple Vulnerabilities
• CVE-2014-9119: WordPress DB Backup <=4.5 - Local File Inclusion
• CVE-2014-9145: Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
• CVE-2014-9146: Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
• CVE-2014-9147: Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
• CVE-2014-9148: Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
• CVE-2014-9215: PBBoard CMS 3.0.1 - SQL Injection
• CVE-2014-9444: Frontend Uploader <= 0.9.2 - Cross-Site Scripting
• CVE-2014-9464: Microweber CMS 0.95 - SQL Injection
• CVE-2014-9606: Netsweeper 4.0.8 - Cross-Site Scripting
• CVE-2014-9607: Netsweeper 4.0.4 - Cross-Site Scripting
• CVE-2014-9608: Netsweeper 4.0.3 - Cross-Site Scripting
• CVE-2014-9609: Netsweeper 4.0.8 - Directory Traversal
• CVE-2014-9614: Netsweeper 4.0.5 - Default Weak Account
• CVE-2014-9615: Netsweeper 4.0.4 - Cross-Site Scripting
• CVE-2014-9735: WordPress RevSlider - Remote Code Execution via File Upload
• CVE-2015-0104: IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
• CVE-2015-1000005: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
• CVE-2015-1000010: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
• CVE-2015-1000012: WordPress MyPixs <=0.3 - Local File Inclusion
• CVE-2015-1389: Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting
• CVE-2015-1400: NPDS CMS REvolution-13 - SQL Injection
• CVE-2015-1427: ElasticSearch - Remote Code Execution
• CVE-2015-1503: IceWarp Mail Server < 11.1.1 - Directory Traversal
• CVE-2015-1518: RedaxScript CMS 2.2.0 - SQL Injection
• CVE-2015-1579: WordPress Slider Revolution - Local File Disclosure
• CVE-2015-1635: Microsoft Windows 'HTTP.sys' - Remote Code Execution
• CVE-2015-1880: Fortinet FortiOS <=5.2.3 - Cross-Site Scripting
• CVE-2015-2067: Magento Server MAGMI - Directory Traversal
• CVE-2015-2068: Magento Server Mass Importer - Cross-Site Scripting
• CVE-2015-2080: Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers
• CVE-2015-2166: Ericsson Drutt MSDP - Local File Inclusion
• CVE-2015-2196: WordPress Spider Calendar <=1.4.9 - SQL Injection
• CVE-2015-2275: WoltLab Community Gallery - Persistent Cross-Site Scripting
• CVE-2015-2755: WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting
• CVE-2015-2807: Navis DocumentCloud <0.1.1 - Cross-Site Scripting
• CVE-2015-2824: WordPress Plugin Simple Ads Manager - Multiple SQL Injections
• CVE-2015-2826: WordPress Plugin Simple Ads Manager - Information Disclosure
• CVE-2015-2996: SysAid Help Desk <15.2 - Local File Inclusion
• CVE-2015-3035: TP-LINK - Local File Inclusion
• CVE-2015-3337: Elasticsearch - Local File Inclusion
• CVE-2015-3648: ResourceSpace - Local File inclusion
• CVE-2015-3897: Bonita BPM Portal <6.5.3 - Local File Inclusion
• CVE-2015-3933: GeniXCMS 0.0.3 - 'register.php' SQL Injection
• CVE-2015-4027: Acunetix WVS 10 - Local Privilege Escalation
• CVE-2015-4062: WordPress NewStatPress 0.9.8 - SQL Injection
• CVE-2015-4063: NewStatPress <0.9.9 - Cross-Site Scripting
• CVE-2015-4074: Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion
• CVE-2015-4117: Vesta Control Panel 0.9.8 - OS Command Injection
• CVE-2015-4127: WordPress Church Admin <0.810 - Cross-Site Scripting
• CVE-2015-4414: WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
• CVE-2015-4425: Pimcore CMS Build 3450 - Directory Traversal
• CVE-2015-4455: WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
• CVE-2015-4632: Koha 3.20.1 - Directory Traversal
• CVE-2015-4664: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4665: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4666: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4667: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4668: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4669: Xceedium Xsuite - Multiple Vulnerabilities
• CVE-2015-4694: WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval
• CVE-2015-5161: eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
• CVE-2015-5285: Kallithea 0.2.9 - 'came_from' HTTP Response Splitting
• CVE-2015-5469: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion
• CVE-2015-5471: Swim Team <= v1.44.10777 - Local File Inclusion
• CVE-2015-5531: ElasticSearch <1.6.1 - Local File Inclusion
• CVE-2015-5688: Geddy <13.0.8 - Local File Inclusion
• CVE-2015-6401: Cisco EPC 3928 - Multiple Vulnerabilities
• CVE-2015-6402: Cisco EPC 3928 - Multiple Vulnerabilities
• CVE-2015-6477: Nordex NC2 - Cross-Site Scripting
• CVE-2015-6544: Combodo iTop <2.2.0-2459 - Cross-Site Scripting
• CVE-2015-6920: WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting
• CVE-2015-6970: Bosch Security Systems Dinion NBN-498 - Web Interface XML Injection
• CVE-2015-7245: D-Link DVG-N5402SP - Local File Inclusion
• CVE-2015-7297: Joomla! Core SQL Injection
• CVE-2015-8349: SourceBans <2.0 - Cross-Site Scripting
• CVE-2015-8350: WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
• CVE-2015-9312: NewStatPress <=1.0.4 - Cross-Site Scripting
• CVE-2015-9323: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
• CVE-2015-9406: mTheme Unus < 2.3 - Directory Traversal
• CVE-2015-9414: WordPress Symposium <=15.8.1 - Cross-Site Scripting
• CVE-2016-1000126: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting
• CVE-2016-1000127: WordPress AJAX Random Post <=2.00 - Cross-Site Scripting
• CVE-2016-1000128: WordPress anti-plagiarism <=3.60 - Cross-Site Scripting
• CVE-2016-1000129: WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting
• CVE-2016-1000130: WordPress e-search <=1.0 - Cross-Site Scripting
• CVE-2016-1000131: WordPress e-search <=1.0 - Cross-Site Scripting
• CVE-2016-1000132: WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting
• CVE-2016-1000133: WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting
• CVE-2016-1000134: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting
• CVE-2016-1000135: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting
• CVE-2016-1000136: WordPress heat-trackr 1.0 - Cross-Site Scripting
• CVE-2016-1000137: WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting
• CVE-2016-1000138: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting
• CVE-2016-1000139: WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting
• CVE-2016-1000140: WordPress New Year Firework <=1.1.9 - Cross-Site Scripting
• CVE-2016-1000141: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting
• CVE-2016-1000142: WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting
• CVE-2016-1000143: WordPress Photoxhibit 2.1.8 - Cross-Site Scripting
• CVE-2016-1000146: WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting
• CVE-2016-1000148: WordPress S3 Video <=0.983 - Cross-Site Scripting
• CVE-2016-1000149: WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting
• CVE-2016-1000152: WordPress Tidio-form <=1.0 - Cross-Site Scripting
• CVE-2016-1000153: WordPress Tidio Gallery <=1.1 - Cross-Site Scripting
• CVE-2016-1000154: WordPress WHIZZ <=1.0.7 - Cross-Site Scripting
• CVE-2016-1000155: WordPress WPSOLR <=8.6 - Cross-Site Scripting
• CVE-2016-10108: Western Digital MyCloud NAS - Command Injection
• CVE-2016-10134: Zabbix - SQL Injection
• CVE-2016-10367: Opsview Monitor Pro - Local File Inclusion
• CVE-2016-10924: Wordpress Zedna eBook download <1.2 - Local File Inclusion
• CVE-2016-10940: WordPress zm-gallery plugin 1.0 SQL Injection
• CVE-2016-10956: WordPress Mail Masta 1.0 - Local File Inclusion
• CVE-2016-10960: WordPress wSecure Lite < 2.4 - Remote Code Execution
• CVE-2016-10973: Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting
• CVE-2016-10993: ScoreMe Theme - Cross-Site Scripting
• CVE-2016-1328: Cisco EPC 3928 - Multiple Vulnerabilities
• CVE-2016-1336: Cisco EPC 3928 - Multiple Vulnerabilities
• CVE-2016-1337: Cisco EPC 3928 - Multiple Vulnerabilities
• CVE-2016-15042: WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload
• CVE-2016-15043: WP Mobile Detector <= 3.5 - Unrestricted File Upload
• CVE-2016-1555: NETGEAR WNAP320 Access Point Firmware - Remote Command Injection
• CVE-2016-2389: SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion
• CVE-2016-3081: Apache S2-032 Struts - Remote Code Execution
• CVE-2016-3088: Apache ActiveMQ Fileserver - Arbitrary File Write
• CVE-2016-3473: Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection
• CVE-2016-4309: Symphony CMS 2.6.7 - Session Fixation
• CVE-2016-4337: Ktools Photostore 4.7.5 - Blind SQL Injection
• CVE-2016-4806: Web2py 2.14.5 - Multiple Vulnerabilities
• CVE-2016-4807: Web2py 2.14.5 - Multiple Vulnerabilities
• CVE-2016-4808: Web2py 2.14.5 - Multiple Vulnerabilities
• CVE-2016-4975: Apache mod_userdir CRLF injection
• CVE-2016-4977: Spring Security OAuth2 Remote Command Execution
• CVE-2016-5674: NUUO NVR camera `debugging_center_utils_.php` - Command Execution
• CVE-2016-6277: NETGEAR Routers - Remote Code Execution
• CVE-2016-6600: WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
• CVE-2016-6601: WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
• CVE-2016-6602: WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
• CVE-2016-6603: WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
• CVE-2016-7981: SPIP <3.1.2 - Cross-Site Scripting
• CVE-2016-8527: Aruba Airwave <8.2.3.1 - Cross-Site Scripting
• CVE-2016-9682: Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection
• CVE-2017-1000028: Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion
• CVE-2017-1000029: Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion
• CVE-2017-1000163: Phoenix Framework - Open Redirect
• CVE-2017-1000170: WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion
• CVE-2017-10075: Oracle Content Server - Cross-Site Scripting
• CVE-2017-10271: Oracle WebLogic Server - Remote Command Execution
• CVE-2017-10974: Yaws 1.91 - Local File Inclusion
• CVE-2017-11107: phpLDAPadmin <= 1.2.3 - Reflected XSS
• CVE-2017-11165: DataTaker DT80 dEX 1.50.012 - Information Disclosure
• CVE-2017-11398: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
• CVE-2017-11444: Subrion CMS <4.1.5.10 - SQL Injection
• CVE-2017-11456: Geneko Routers - Path Traversal
• CVE-2017-11512: ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval
• CVE-2017-11610: XML-RPC Server - Remote Code Execution
• CVE-2017-11629: FineCMS <=5.0.10 - Cross-Site Scripting
• CVE-2017-12544: HPE System Management - Cross-Site Scripting
• CVE-2017-12583: DokuWiki - Cross-Site Scripting
• CVE-2017-12611: Apache Struts2 S2-053 - Remote Code Execution
• CVE-2017-12615: Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)
• CVE-2017-12617: Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)
• CVE-2017-12635: Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
• CVE-2017-12794: Django Debug Page - Cross-Site Scripting
• CVE-2017-14094: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
• CVE-2017-14095: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
• CVE-2017-14096: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
• CVE-2017-14097: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
• CVE-2017-14135: OpenDreambox 2.0.0 - Remote Code Execution
• CVE-2017-14186: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
• CVE-2017-14523: Wonder CMS 2.3.1 - 'Host' Header Injection
• CVE-2017-14535: Trixbox - 2.8.0.4 OS Command Injection
• CVE-2017-14537: Trixbox 2.8.0 - Path Traversal
• CVE-2017-14611: Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery
• CVE-2017-14622: WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting
• CVE-2017-14651: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
• CVE-2017-14725: WordPress < 4.8.2 - Authenticated Open Redirect
• CVE-2017-14849: Node.js <8.6.0 - Directory Traversal
• CVE-2017-14942: Intelbras WRN 150 - Authentication Bypass
• CVE-2017-15287: Dreambox WebControl 2.0.0 - Cross-Site Scripting
• CVE-2017-15363: Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion
• CVE-2017-15643: Ikraus Anti Virus 2.16.7 - Remote Code Execution
• CVE-2017-15647: FiberHome Routers - Local File Inclusion
• CVE-2017-15687: Logitech Media Server - Cross-Site Scripting
• CVE-2017-15715: Apache httpd <=2.4.29 - Arbitrary File Upload
• CVE-2017-16806: Ulterius Server < 1.9.5.0 - Directory Traversal
• CVE-2017-16877: Nextjs <2.4.1 - Local File Inclusion
• CVE-2017-16894: Laravel <5.5.21 - Information Disclosure
• CVE-2017-16935: Ametys CMS 4.0.2 - Password Reset
• CVE-2017-17043: WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting
• CVE-2017-17059: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting
• CVE-2017-17092: WordPress < 4.9.1 - Authenticated JavaScript File Upload
• CVE-2017-17451: WordPress Mailster <=1.5.4 - Cross-Site Scripting
• CVE-2017-17731: DedeCMS 5.7 - SQL Injection
• CVE-2017-17970: Muviko 1.1 - SQL Injection
• CVE-2017-17976: PerfexCRM 1.9.7 - Arbitrary File Upload
• CVE-2017-17999: RISE 1.9 - 'search' SQL Injection
• CVE-2017-18001: Trustwave SWG 11.8.0.27 - SSH Unauthorized Access
• CVE-2017-18024: AvantFAX 3.3.3 - Cross-Site Scripting
• CVE-2017-18487: AdPush < 1.44 - Cross-Site Scripting
• CVE-2017-18490: Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting
• CVE-2017-18491: Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting
• CVE-2017-18492: Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting
• CVE-2017-18493: Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting
• CVE-2017-18494: Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting
• CVE-2017-18496: Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting
• CVE-2017-18500: Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting
• CVE-2017-18501: Social Login by BestWebSoft < 0.2 - Cross-Site Scripting
• CVE-2017-18502: Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting
• CVE-2017-18505: BestWebSoft's Twitter < 2.55 - Cross-Site Scripting
• CVE-2017-18516: LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting
• CVE-2017-18517: Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting
• CVE-2017-18518: SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting
• CVE-2017-18527: Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting
• CVE-2017-18528: PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting
• CVE-2017-18529: PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting
• CVE-2017-18530: Rating by BestWebSoft < 0.2 - Cross-Site Scripting
• CVE-2017-18532: Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting
• CVE-2017-18536: WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting
• CVE-2017-18537: Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting
• CVE-2017-18542: Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting
• CVE-2017-18556: Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
• CVE-2017-18557: Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting
• CVE-2017-18558: Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting
• CVE-2017-18562: Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting
• CVE-2017-18564: Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting
• CVE-2017-18565: Updater by BestWebSoft < 1.35 - Cross-Site Scripting
• CVE-2017-18566: User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting
• CVE-2017-18580: WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
• CVE-2017-18590: Timesheet Plugin < 0.1.5 - Cross-Site Scripting
• CVE-2017-18598: WordPress Qards - Cross-Site Scripting
• CVE-2017-3131: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
• CVE-2017-3132: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
• CVE-2017-3133: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
• CVE-2017-3528: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
• CVE-2017-3546: Oracle PeopleSoft - Server-Side Request Forgery
• CVE-2017-5631: KMCIS CaseAware - Cross-Site Scripting
• CVE-2017-5638: Apache Struts 2 - Remote Command Execution
• CVE-2017-5689: Intel Active Management Technology - System Privileges
• CVE-2017-5798: HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion
• CVE-2017-5799: HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion
• CVE-2017-5850: OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service
• CVE-2017-5868: OpenVPN Access Server 2.1.4 - CRLF Injection
• CVE-2017-6090: PhpColl 2.5.1 Arbitrary File Upload
• CVE-2017-6190: D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
• CVE-2017-6338: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities
• CVE-2017-6339: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities
• CVE-2017-6340: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities
• CVE-2017-6443: EPSON TMNet WebConfig 1.00 - Cross-Site Scripting
• CVE-2017-6478: MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting
• CVE-2017-6823: Fiyo CMS 2.0.6.1 - Privilege Escalation
• CVE-2017-7391: Magmi 0.7.22 - Cross-Site Scripting
• CVE-2017-7855: IceWarp WebMail 11.3.1.5 - Cross-Site Scripting
• CVE-2017-8295: WordPress Core < 4.7.4 - Unauthorized Password Reset
• CVE-2017-8917: Joomla! <3.7.1 - SQL Injection
• CVE-2017-9140: Reflected XSS - Telerik Reporting Module
• CVE-2017-9288: WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting
• CVE-2017-9355: Subsonic 6.1.1 - XML External Entity Injection
• CVE-2017-9413: Subsonic 6.1.1 - Server-Side Request Forgery
• CVE-2017-9416: Odoo 8.0/9.0/10.0 - Local File Inclusion
• CVE-2017-9506: Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery
• CVE-2017-9640: Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write
• CVE-2017-9791: Apache Struts2 S2-053 - Remote Code Execution
• CVE-2017-9805: Apache Struts2 S2-052 - Remote Code Execution
• CVE-2017-9822: DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution
• CVE-2017-9833: BOA Web Server 0.94.14 - Arbitrary File Access
• CVE-2017-9841: PHPUnit - Remote Code Execution
• CVE-2017-9965: Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal
• CVE-2017-9978: QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities
• CVE-2017-9979: QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities
• CVE-2018-0127: Cisco RV132W/RV134W Router - Information Disclosure
• CVE-2018-1000129: Jolokia 1.3.7 - Cross-Site Scripting
• CVE-2018-1000130: Jolokia Agent - JNDI Code Injection
• CVE-2018-1000856: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-1000861: Jenkins - Remote Command Injection
• CVE-2018-1002000: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002001: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002002: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002003: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002004: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002005: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002006: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002007: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002008: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-1002009: WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
• CVE-2018-10093: AudioCodes 420HD - Remote Code Execution
• CVE-2018-10095: Dolibarr <7.0.2 - Cross-Site Scripting
• CVE-2018-10201: Ncomputing vSPace Pro 10 and 11 - Directory Traversal
• CVE-2018-10230: Zend Server <9.13 - Cross-Site Scripting
• CVE-2018-10383: Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
• CVE-2018-10562: Dasan GPON Devices - Remote Code Execution
• CVE-2018-10735: NagiosXI <= 5.4.12 `commandline.php` SQL injection
• CVE-2018-10736: NagiosXI <= 5.4.12 - SQL injection
• CVE-2018-10737: NagiosXI <= 5.4.12 logbook.php SQL injection
• CVE-2018-10738: NagiosXI <= 5.4.12 menuaccess.php - SQL injection
• CVE-2018-10818: LG NAS Devices - Remote Code Execution
• CVE-2018-10822: D-Link Routers - Local File Inclusion
• CVE-2018-10823: D-Link Routers - Remote Command Injection
• CVE-2018-10956: IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion
• CVE-2018-11222: Pandora FMS <=7.0NG.722 - Remote Code Execution
• CVE-2018-11227: Monstra CMS <=3.0.4 - Cross-Site Scripting
• CVE-2018-11231: Opencart Divido - Sql Injection
• CVE-2018-11442: EasyService Billing 1.0 - Cross-Site Request Forgery
• CVE-2018-11445: EasyService Billing 1.0 - Cross-Site Request Forgery
• CVE-2018-11511: ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection
• CVE-2018-11535: Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
• CVE-2018-11686: FlexPaper/FlowPaper 2.3.6 - Remote Code Execution
• CVE-2018-11709: WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting
• CVE-2018-11776: Apache Struts2 S2-057 - Remote Code Execution
• CVE-2018-12031: Eaton Intelligent Power Manager 1.6 - Directory Traversal
• CVE-2018-12054: Schools Alert Management Script - Arbitrary File Read
• CVE-2018-12095: OEcms 3.1 - Cross-Site Scripting
• CVE-2018-12111: Canon PrintMe EFI - Cross-Site Scripting
• CVE-2018-12300: Seagate NAS OS 4.3.15.1 - Open Redirect
• CVE-2018-12455: Intelbras NPLUG 1.0.0.14 - Authentication Bypass
• CVE-2018-12596: Ektron CMS 9.20 SP2 - Improper Access Restrictions
• CVE-2018-12613: PhpMyAdmin <4.8.2 - Local File Inclusion
• CVE-2018-1271: Spring MVC Framework - Local File Inclusion
• CVE-2018-1273: Spring Data Commons - Remote Code Execution
• CVE-2018-12909: Webgrind <= 1.5 - Local File Inclusion
• CVE-2018-12998: Zoho manageengine - Cross-Site Scripting
• CVE-2018-1306: Apache Portals Pluto 3.0.0 - Remote Code Execution
• CVE-2018-1335: Apache Tika < 1.1.8 - Header Command Injection
• CVE-2018-13379: Fortinet FortiOS - Credentials Disclosure
• CVE-2018-13380: Fortinet FortiOS - Cross-Site Scripting
• CVE-2018-13980: Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion
• CVE-2018-14013: Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting
• CVE-2018-14064: VelotiSmart Wifi - Directory Traversal
• CVE-2018-14728: Responsive filemanager 9.13.1 Server-Side Request Forgery
• CVE-2018-14912: cgit < 1.2.1 - Directory Traversal
• CVE-2018-14916: Loytec LGATE-902 <6.4.2 - Local File Inclusion
• CVE-2018-14918: LOYTEC LGATE-902 6.3.2 - Local File Inclusion
• CVE-2018-15138: LG-Ericsson iPECS NMS 30M - Local File Inclusion
• CVE-2018-15140: OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions
• CVE-2018-15141: OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions
• CVE-2018-15142: OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions
• CVE-2018-15534: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure
• CVE-2018-15535: Responsive FileManager < 9.13.4 - Directory Traversal
• CVE-2018-15536: Responsive FileManager < 9.13.4 - Directory Traversal
• CVE-2018-15745: Argus Surveillance DVR 4.0.0.0 - Local File Inclusion
• CVE-2018-15811: DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization
• CVE-2018-15884: RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
• CVE-2018-15917: Jorani Leave Management System 0.6.5 - Cross-Site Scripting
• CVE-2018-16059: WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion
• CVE-2018-16139: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting
• CVE-2018-16159: WordPress Gift Voucher <4.1.8 - Blind SQL Injection
• CVE-2018-16167: LogonTracer <=1.2.0 - Remote Command Injection
• CVE-2018-16283: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
• CVE-2018-16288: LG SuperSign EZ CMS 2.5 - Local File Inclusion
• CVE-2018-16299: WordPress Localize My Post 1.0 - Local File Inclusion
• CVE-2018-16363: WordPress File Manager < 3.0 - Cross-Site Scripting
• CVE-2018-16716: NCBI ToolBox - Directory Traversal
• CVE-2018-16736: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting
• CVE-2018-16763: FUEL CMS 1.4.1 - Remote Code Execution
• CVE-2018-16833: ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting
• CVE-2018-16836: Rubedo CMS <=3.4.0 - Directory Traversal
• CVE-2018-16979: Monstra CMS 3.0.4 - HTTP Header Injection
• CVE-2018-17082: Apache2 - Transfer-Encoding Chunked XSS
• CVE-2018-17153: Western Digital MyCloud NAS - Authentication Bypass
• CVE-2018-17173: LG Supersign EZ CMS - Remote Code Execution
• CVE-2018-17246: Kibana - Local File Inclusion
• CVE-2018-17254: Joomla! JCK Editor SQL Injection
• CVE-2018-17310: RICOH MP C1803 JPN Printer - Cross-Site Scripting
• CVE-2018-17313: RICOH MP C1803 JPN Printer - Cross-Site Scripting
• CVE-2018-17431: Comodo Unified Threat Management Web Console - Remote Code Execution
• CVE-2018-17587: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
• CVE-2018-17588: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
• CVE-2018-17590: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
• CVE-2018-17591: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
• CVE-2018-17593: Airties AIR5342 1.0.0.18 - Cross-Site Scripting
• CVE-2018-18069: WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting
• CVE-2018-18323: Centos Web Panel 0.9.8.480 - Local File Inclusion
• CVE-2018-18325: DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization
• CVE-2018-18570: Planon <Live Build 41 - Cross-Site Scripting
• CVE-2018-18608: DedeCMS 5.7 SP2 - Cross-Site Scripting
• CVE-2018-18775: Microstrategy Web 7 - Cross-Site Scripting
• CVE-2018-18777: Microstrategy Web 7 - Local File Inclusion
• CVE-2018-18809: TIBCO JasperReports Library - Directory Traversal
• CVE-2018-18923: Ticketly 1.0 - 'kind_id' SQL Injection
• CVE-2018-18925: Gogs (Go Git Service) 0.11.66 - Remote Code Execution
• CVE-2018-19136: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19137: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19276: OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
• CVE-2018-19287: WordPress Ninja Forms <3.3.18 - Cross-Site Scripting
• CVE-2018-19326: Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion
• CVE-2018-19365: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
• CVE-2018-19439: Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting
• CVE-2018-19458: PHP Proxy 3.0.3 - Local File Inclusion
• CVE-2018-19749: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19751: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19752: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19753: Tarantella Enterprise <3.11 - Local File Inclusion
• CVE-2018-19877: Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting
• CVE-2018-19892: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19914: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-19915: DomainMOD <=4.11.01 - Cross-Site Scripting
• CVE-2018-19933: Bolt CMS < 3.6.2 - Cross-Site Scripting
• CVE-2018-20009: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-20010: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-20011: DomainMOD 4.11.01 - Cross-Site Scripting
• CVE-2018-20462: WordPress JSmol2WP <=1.07 - Cross-Site Scripting
• CVE-2018-20463: WordPress JSmol2WP <=1.07 - Local File Inclusion
• CVE-2018-20470: Tyto Sahi pro 7.x/8.x - Local File Inclusion
• CVE-2018-20503: SirsiDynix e-Library 3.5.x - Cross-Site Scripting
• CVE-2018-20824: Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting
• CVE-2018-20985: WordPress Payeezy Pay <=2.97 - Local File Inclusion
• CVE-2018-25114: osCommerce 2.3.4.1 - Remote Code Execution
• CVE-2018-3167: Oracle E-Business Suite - Blind SSRF
• CVE-2018-3238: Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting
• CVE-2018-3714: node-srv - Local File Inclusion
• CVE-2018-3760: Ruby On Rails - Local File Inclusion
• CVE-2018-3810: Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass
• CVE-2018-5230: Atlassian Jira Confluence - Cross-Site Scripting
• CVE-2018-5233: Grav CMS <1.3.0 - Cross-Site Scripting
• CVE-2018-5316: WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting
• CVE-2018-5404: KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
• CVE-2018-5405: KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
• CVE-2018-5406: KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
• CVE-2018-5715: SugarCRM 3.5.1 - Cross-Site Scripting
• CVE-2018-6008: Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion
• CVE-2018-6184: Zeit Next.js < 4.2.3 - Local File Inclusion
• CVE-2018-6605: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection
• CVE-2018-6961: VMware NSX SD-WAN Edge - Command Injection
• CVE-2018-7171: TwonkyMedia Server 7.0.11-8.5 - Directory Traversal
• CVE-2018-7203: TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting
• CVE-2018-7251: Anchor CMS 0.12.3 - Error Log Exposure
• CVE-2018-7282: TITool PrintMonitor - Blind SQL Injection
• CVE-2018-7314: Joomla! Component PrayerCenter 3.0.2 - SQL Injection
• CVE-2018-7422: WordPress Site Editor <=1.1.1 - Local File Inclusion
• CVE-2018-7490: uWSGI PHP Plugin Local File Inclusion
• CVE-2018-7538: Tuleap 9.17.99.189 - Blind SQL Injection
• CVE-2018-7653: YzmCMS v3.6 - Cross-Site Scripting
• CVE-2018-7690: Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure
• CVE-2018-7691: Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2)
• CVE-2018-7700: DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution
• CVE-2018-7719: Acrolinx Server <5.2.5 - Local File Inclusion
• CVE-2018-7765: Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection
• CVE-2018-7841: Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection
• CVE-2018-8006: Apache ActiveMQ <=5.15.5 - Cross-Site Scripting
• CVE-2018-8024: Apache Spark UI - Cross-Site Scripting
• CVE-2018-8033: Apache OFBiz - XML External Entity Injection
• CVE-2018-8727: Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion
• CVE-2018-9038: Monstra CMS 3.0.4 - Arbitrary Folder Deletion
• CVE-2018-9118: WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion
• CVE-2018-9160: SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response
• CVE-2018-9205: Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion
• CVE-2018-9302: Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery
• CVE-2019-0221: Apache Tomcat - Cross-Site Scripting
• CVE-2019-10068: Kentico CMS Insecure Deserialization Remote Code Execution
• CVE-2019-10092: Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting
• CVE-2019-1010287: Timesheet Next Gen <=1.5.3 - Cross-Site Scripting
• CVE-2019-10232: Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection
• CVE-2019-10475: Jenkins build-metrics 1.3 - Cross-Site Scripting
• CVE-2019-10647: ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)
• CVE-2019-10717: BlogEngine.NET 3.3.7.0 - Local File Inclusion
• CVE-2019-10758: mongo-express Remote Code Execution
• CVE-2019-11013: Nimble Streamer <=3.5.4-9 - Local File Inclusion
• CVE-2019-11269: Spring Security OAuth - Open Redirector
• CVE-2019-11370: Carel pCOWeb <B1.2.4 - Cross-Site Scripting
• CVE-2019-11398: UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting
• CVE-2019-11510: Pulse Connect Secure SSL VPN Arbitrary File Read
• CVE-2019-11581: Atlassian Jira Server-Side Template Injection
• CVE-2019-11844: RICOH SP 4520DN Printer - HTML Injection
• CVE-2019-11845: RICOH SP 4510DN Printer - HTML Injection
• CVE-2019-12276: GrandNode 4.40 - Local File Inclusion
• CVE-2019-12314: Deltek Maconomy 2.2.5 - Local File Inclusion
• CVE-2019-12461: WebPort 1.19.1 - Cross-Site Scripting
• CVE-2019-12581: Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting
• CVE-2019-12593: IceWarp Mail Server <=10.4.4 - Local File Inclusion
• CVE-2019-12616: phpMyAdmin 4.8 - Cross-Site Request Forgery
• CVE-2019-12725: Zeroshell 3.9.0 - Remote Command Execution
• CVE-2019-12935: Shopware < 5.5.8 - Cross-Site Scripting
• CVE-2019-12985: Citrix SD-WAN Center - Remote Command Injection
• CVE-2019-12986: Citrix SD-WAN Center - Remote Command Injection
• CVE-2019-12987: Citrix SD-WAN Center - Remote Command Injection
• CVE-2019-12988: Citrix SD-WAN Center - Remote Command Injection
• CVE-2019-12989: Citrix SD-WAN and NetScaler SD-WAN - SQL Injection
• CVE-2019-13372: D-Link Central WiFi Manager CWM(100) - Remote Code Execution
• CVE-2019-13392: MindPalette NateMail 3.0.15 - Cross-Site Scripting
• CVE-2019-13462: Lansweeper Unauthenticated SQL Injection
• CVE-2019-14205: WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion
• CVE-2019-14206: Nevma Adaptive Images - Arbitrary File Deletion
• CVE-2019-14251: T24 Web Server - Local File Inclusion
• CVE-2019-14312: Aptana Jaxer 1.0.3.4547 - Local File inclusion
• CVE-2019-14322: Pallets Werkzeug <0.15.5 - Local File Inclusion
• CVE-2019-14427: Ultimate Loan Manager 2.0 - Cross-Site Scripting
• CVE-2019-14470: WordPress UserPro 4.9.32 - Cross-Site Scripting
• CVE-2019-14530: OpenEMR <5.0.2 - Local File Inclusion
• CVE-2019-14696: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
• CVE-2019-14789: Custom 404 Pro < 3.2.8 - Cross-Site Scripting
• CVE-2019-14950: WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting
• CVE-2019-14974: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
• CVE-2019-15107: Webmin <= 1.920 - Unauthenticated Remote Command Execution
• CVE-2019-15501: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
• CVE-2019-15642: Webmin < 1.920 - Authenticated Remote Code Execution
• CVE-2019-15713: WordPress My Calendar <= 3.1.9 - Cross-Site Scripting
• CVE-2019-15811: DomainMOD <=4.13.0 - Cross-Site Scripting
• CVE-2019-15829: Gallery Photoblocks < 1.1.43 - Cross-Site Scripting
• CVE-2019-15889: WordPress Download Manager <2.9.94 - Cross-Site Scripting
• CVE-2019-16072: Enigma NMS < 65.0.0 - Authenticated OS Command Injection
• CVE-2019-16123: PilusCart <=1.4.1 - Local File Inclusion
• CVE-2019-16278: nostromo 1.9.6 - Remote Code Execution
• CVE-2019-16332: WordPress API Bearer Auth <20190907 - Cross-Site Scripting
• CVE-2019-16383: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
• CVE-2019-16469: Adobe Experience Manager - Expression Language Injection
• CVE-2019-16525: WordPress Checklist <1.1.9 - Cross-Site Scripting
• CVE-2019-16662: rConfig 3.9.2 - Remote Code Execution
• CVE-2019-16693: phpIPAM 1.4 - SQL-Injection
• CVE-2019-16758: Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal
• CVE-2019-16759: vBulletin 5.0.0-5.5.4 - Remote Command Execution
• CVE-2019-16920: D-Link Routers - Remote Code Execution
• CVE-2019-16931: WordPress Visualizer <3.3.1 - Cross-Site Scripting
• CVE-2019-16932: Visualizer <3.3.1 - Blind Server-Side Request Forgery
• CVE-2019-16996: Metinfo 7.0.0 beta - SQL Injection
• CVE-2019-16997: Metinfo 7.0.0 beta - SQL Injection
• CVE-2019-17270: Yachtcontrol Webapplication 1.0 - Remote Command Injection
• CVE-2019-17418: MetInfo 7.0.0 beta - SQL Injection
• CVE-2019-17503: Kirona Dynamic Resource Scheduler - Information Disclosure
• CVE-2019-17538: Jiangnan Online Judge 0.8.0 - Local File Inclusion
• CVE-2019-17564: Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization
• CVE-2019-18371: Xiaomi Mi WiFi R3G Routers - Local file Inclusion
• CVE-2019-18393: Ignite Realtime Openfire <4.42 - Local File Inclusion
• CVE-2019-18396: Technicolor TD5130.2 - Remote Command Execution
• CVE-2019-18665: DOMOS 5.5 - Local File Inclusion
• CVE-2019-18859: Digi AnywhereUSB 14 - Reflective Cross-Site Scripting
• CVE-2019-18922: Allied Telesis AT-GS950/8 - Local File Inclusion
• CVE-2019-18957: MicroStrategy Library <11.1.3 - Cross-Site Scripting
• CVE-2019-19134: WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting
• CVE-2019-1935: Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
• CVE-2019-1936: Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
• CVE-2019-19368: Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting
• CVE-2019-1937: Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
• CVE-2019-19411: Huawei Firewall - Local File Inclusion
• CVE-2019-1943: CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities
• CVE-2019-19731: Roxy Fileman 1.4.5 - Directory Traversal
• CVE-2019-19740: Octeth Oempro 4.8 - 'CampaignID' SQL Injection
• CVE-2019-19781: Citrix ADC and Gateway - Directory Traversal
• CVE-2019-19822: TOTOLINK/Realtek Routers - Information Disclosure
• CVE-2019-19823: TOTOLINK/Realtek Routers - Information Disclosure
• CVE-2019-19824: TOTOLINK Realtek SD Routers - Remote Command Injection
• CVE-2019-19908: phpMyChat-Plus 1.98 - Cross-Site Scripting
• CVE-2019-20141: WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting
• CVE-2019-20210: WordPress CTHthemes - Cross-Site Scripting
• CVE-2019-20224: Pandora FMS 7.0NG - Remote Command Injection
• CVE-2019-20499: D-Link DWL-2600AP - Multiple OS Command Injection
• CVE-2019-20500: D-Link DWL-2600AP - Multiple OS Command Injection
• CVE-2019-20501: D-Link DWL-2600AP - Multiple OS Command Injection
• CVE-2019-20504: Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution
• CVE-2019-25141: Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
• CVE-2019-25213: WordPress Advanced Access Manager - Path Traversal
• CVE-2019-25246: BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
• CVE-2019-2588: Oracle Business Intelligence - Path Traversal
• CVE-2019-2729: Oracle WebLogic Server Administration Console - Remote Code Execution
• CVE-2019-2767: Oracle Business Intelligence Publisher - XML External Entity Injection
• CVE-2019-3396: Atlassian Confluence Server - Path Traversal
• CVE-2019-3402: Jira < 8.1.1 - Cross-Site Scripting
• CVE-2019-3778: Spring Security OAuth - Open Redirector
• CVE-2019-3799: Spring Cloud Config Server - Local File Inclusion
• CVE-2019-3911: LabKey Server Community Edition <18.3.0 - Cross-Site Scripting
• CVE-2019-4013: IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload
• CVE-2019-5418: Rails File Content Disclosure
• CVE-2019-5434: Revive Adserver 4.2 - Remote Code Execution
• CVE-2019-6112: WordPress Sell Media 2.4.1 - Cross-Site Scripting
• CVE-2019-6340: Drupal - Remote Code Execution
• CVE-2019-6793: GitLab Enterprise Edition - Server-Side Request Forgery
• CVE-2019-6802: Pypiserver <1.2.5 - Carriage Return Line Feed Injection
• CVE-2019-7139: Magento - SQL Injection
• CVE-2019-7219: Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting
• CVE-2019-7254: eMerge E3 1.00-06 - Local File Inclusion
• CVE-2019-7255: Linear eMerge E3 - Cross-Site Scripting
• CVE-2019-7256: eMerge E3 1.00-06 - Remote Code Execution
• CVE-2019-7315: Genie Access WIP3BVAF IP Camera - Local File Inclusion
• CVE-2019-7438: JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting
• CVE-2019-7439: JioFi 4G M2S 1.0.2 - Denial of Service
• CVE-2019-7481: SonicWall SRA 4600 VPN - SQL Injection
• CVE-2019-7671: Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting
• CVE-2019-8446: Jira Improper Authorization
• CVE-2019-8937: HotelDruid 2.3.0 - Cross-Site Scripting
• CVE-2019-8982: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery
• CVE-2019-9041: ZZZCMS 1.6.1 - Remote Code Execution
• CVE-2019-9082: ThinkPHP < 3.2.4 - Remote Code Execution
• CVE-2019-9189: Prima Access Control 2.3.35 - Arbitrary File Upload
• CVE-2019-9194: elFinder <= 2.1.47 - Command Injection
• CVE-2019-9553: Bolt CMS 3.6.4 - Cross-Site Scripting
• CVE-2019-9556: Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting
• CVE-2019-9591: ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities
• CVE-2019-9592: ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities
• CVE-2019-9593: ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities
• CVE-2019-9618: WordPress GraceMedia Media Player 1.0 - Local File Inclusion
• CVE-2019-9762: PHPSHE 1.7 - SQL Injection
• CVE-2019-9880: WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure
• CVE-2019-9912: WP Google Maps < 7.10.43 - Cross-Site Scripting
• CVE-2019-9922: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion
• CVE-2020-10148: SolarWinds Orion API - Auth Bypass
• CVE-2020-10189: ManageEngine Desktop Central Java Deserialization
• CVE-2020-10220: rConfig 3.9 - SQL Injection
• CVE-2020-10257: ThemeREX Addons - Remote Code Execution
• CVE-2020-10546: rConfig 3.9.4 - SQL Injection
• CVE-2020-10547: rConfig 3.9.4 - SQL Injection
• CVE-2020-10548: rConfig 3.9.4 - SQL Injection
• CVE-2020-10549: rConfig <=3.9.4 - SQL Injection
• CVE-2020-10973: WAVLINK - Access Control
• CVE-2020-10987: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection
• CVE-2020-11110: Grafana <= 6.7.1 - Cross-Site Scripting
• CVE-2020-11455: LimeSurvey 4.1.11 - Local File Inclusion
• CVE-2020-11456: LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting
• CVE-2020-11457: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting
• CVE-2020-11530: WordPress Chop Slider 3 - Blind SQL Injection
• CVE-2020-11546: SuperWebmailer 7.21.0.01526 - Remote Code Execution
• CVE-2020-11738: WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion
• CVE-2020-11798: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal
• CVE-2020-11930: WordPress GTranslate <2.8.52 - Cross-Site Scripting
• CVE-2020-11978: Apache Airflow <=1.10.10 - Remote Code Execution
• CVE-2020-11984: Apache HTTP Server - Remote Code Execution
• CVE-2020-12054: WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting
• CVE-2020-12256: rConfig 3.9.4 - Cross-Site Scripting
• CVE-2020-12259: rConfig 3.9.4 - Cross-Site Scripting
• CVE-2020-12262: Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting
• CVE-2020-12447: Onkyo TX-NR585 Web Interface - Directory Traversal
• CVE-2020-12641: Roundcube Webmail - Command Injection
• CVE-2020-12706: php-fusion 9.03.50 - Persistent Cross-Site Scripting
• CVE-2020-12720: vBulletin SQL Injection
• CVE-2020-13117: Wavlink Multiple AP - Remote Command Injection
• CVE-2020-13121: Submitty <= 20.04.01 - Open Redirect
• CVE-2020-13158: Artica Proxy Community Edition <4.30.000000 - Local File Inclusion
• CVE-2020-13167: Netsweeper <=6.4.3 - Python Code Injection
• CVE-2020-13258: Contentful <=2020-05-21 - Cross-Site Scripting
• CVE-2020-13379: Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
• CVE-2020-13483: Bitrix24 <=20.0.0 - Cross-Site Scripting
• CVE-2020-13640: wpDiscuz <= 5.3.5 - SQL Injection
• CVE-2020-13820: Extreme Management Center 8.4.1.24 - Cross-Site Scripting
• CVE-2020-13851: Artica Pandora FMS 7.44 - Remote Code Execution
• CVE-2020-13886: Intelbras TIP 200/200 LITE/300 - Local File Inclusion
• CVE-2020-13942: Apache Unomi <1.5.2 - Remote Code Execution
• CVE-2020-13945: Apache APISIX - Insufficiently Protected Credentials
• CVE-2020-14413: NeDi 1.9C - Cross-Site Scripting
• CVE-2020-14750: Oracle WebLogic Server - Remote Command Execution
• CVE-2020-14864: Oracle Fusion - Directory Traversal/Local File Inclusion
• CVE-2020-14883: Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
• CVE-2020-15415: DrayTek Vigor - Command Injection
• CVE-2020-15500: TileServer GL <=3.0.0 - Cross-Site Scripting
• CVE-2020-15568: TerraMaster TOS <.1.29 - Remote Code Execution
• CVE-2020-15599: Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting
• CVE-2020-15718: RosarioSIS 6.7.2 - Cross-Site Scripting
• CVE-2020-15920: Mida eFramework <=2.9.0 - Remote Command Execution
• CVE-2020-17362: Nova Lite < 1.3.9 - Cross-Site Scripting
• CVE-2020-17456: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution
• CVE-2020-17463: Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)
• CVE-2020-17496: vBulletin 5.5.4 - 5.6.2- Remote Command Execution
• CVE-2020-17505: Artica Web Proxy 4.30 - OS Command Injection
• CVE-2020-17506: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection
• CVE-2020-17519: Apache Flink - Local File Inclusion
• CVE-2020-17530: Apache Struts 2.0.0-2.5.25 - Remote Code Execution
• CVE-2020-18268: Z-Blog <=1.5.2 - Open Redirect
• CVE-2020-18662: Gnuboard5 5.3.2.8 - SQL Injection
• CVE-2020-19282: Jeesns 1.4.2 - Cross-Site Scripting
• CVE-2020-19283: Jeesns 1.4.2 - Cross-Site Scripting
• CVE-2020-19295: Jeesns 1.4.2 - Cross-Site Scripting
• CVE-2020-19360: FHEM 6.0 - Local File Inclusion
• CVE-2020-1943: Apache OFBiz <=16.11.07 - Cross-Site Scripting
• CVE-2020-19515: qdPM 9.1 - Cross-site Scripting
• CVE-2020-19625: Gridx 1.3 - Remote Code Execution
• CVE-2020-20285: ZZcms - Cross-Site Scripting
• CVE-2020-20300: WeiPHP 5.0 - SQL Injection
• CVE-2020-2036: Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting
• CVE-2020-2096: Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting
• CVE-2020-20969: PluckCMS 4.7.10 - Unrestricted File Upload
• CVE-2020-20982: shadoweb wdja v1.5.1 - Cross-Site Scripting
• CVE-2020-20988: DomainMOD 4.13.0 - Cross-Site Scripting
• CVE-2020-21224: Inspur ClusterEngine 4.0 - Remote Code Execution
• CVE-2020-22165: PHPGurukul Hospital Management System 4.0 - SQL Injection
• CVE-2020-22208: 74cms - ajax_street.php 'x' SQL Injection
• CVE-2020-22209: 74cms - ajax_common.php SQL Injection
• CVE-2020-22210: 74cms - ajax_officebuilding.php SQL Injection
• CVE-2020-22211: 74cms - ajax_street.php 'key' SQL Injection
• CVE-2020-23517: Aryanic HighMail (High CMS) - Cross-Site Scripting
• CVE-2020-23575: Kyocera Printer d-COPIA253MF - Directory Traversal
• CVE-2020-24193: Daily Tracker System 1.0 - Authentication Bypass
• CVE-2020-24223: Mara CMS 7.5 - Cross-Site Scripting
• CVE-2020-24285: INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion
• CVE-2020-24391: Mongo-Express - Remote Code Execution
• CVE-2020-24579: D-Link DSL 2888a - Authentication Bypass/Remote Command Execution
• CVE-2020-24589: WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection
• CVE-2020-24609: Savsoft Quiz 5 - Stored Cross-Site Scripting
• CVE-2020-24701: OX Appsuite - Cross-Site Scripting
• CVE-2020-24902: Quixplorer <=2.4.1 - Cross-Site Scripting
• CVE-2020-24903: Cute Editor for ASP.NET 6.4 - Cross-Site Scripting
• CVE-2020-24949: PHP-Fusion 9.03.50 - Remote Code Execution
• CVE-2020-24963: Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
• CVE-2020-25213: WordPress File Manager Plugin - Remote Code Execution
• CVE-2020-25223: Sophos UTM Preauth - Remote Code Execution
• CVE-2020-25494: SCO Openserver 5.0.7 - 'outputform' Command Injection
• CVE-2020-25495: SCO Openserver 5.0.7 - 'section' Reflected XSS
• CVE-2020-25506: D-Link DNS-320 - Unauthenticated Remote Code Execution
• CVE-2020-25760: Visitor Management System in PHP 1.0 - SQL Injection (Authenticated)
• CVE-2020-25864: HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting
• CVE-2020-26073: Cisco SD-WAN vManage Software - Local File Inclusion
• CVE-2020-26153: Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting
• CVE-2020-26217: XStream <1.4.14 - Remote Code Execution
• CVE-2020-26248: PrestaShop Product Comments <4.2.0 - SQL Injection
• CVE-2020-26919: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
• CVE-2020-27191: LionWiki <3.2.12 - Local File Inclusion
• CVE-2020-27467: Processwire CMS <2.7.1 - Local File Inclusion
• CVE-2020-27481: Good Layers LMS Plugin <= 2.1.4 - SQL Injection
• CVE-2020-27533: DedeCMS v.5.8 - _keyword_ Cross-Site Scripting
• CVE-2020-27615: WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
• CVE-2020-27735: Wing FTP 6.4.4 - Cross-Site Scripting
• CVE-2020-27982: IceWarp WebMail 11.4.5.0 - Cross-Site Scripting
• CVE-2020-28188: TerraMaster TOS - Unauthenticated Remote Command Execution
• CVE-2020-28351: Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting
• CVE-2020-28429: geojson2kml - Command Injection
• CVE-2020-29047: WP Hotel Booking < 1.10.4 - PHP Object Injection
• CVE-2020-29164: PacsOne Server <7.1.1 - Cross-Site Scripting
• CVE-2020-29214: Alumni Management System 1.0 - SQL Injection
• CVE-2020-29227: Car Rental Management System 1.0 - Local File Inclusion
• CVE-2020-29240: LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting
• CVE-2020-29279: 74CMS - Remote File Inclusion
• CVE-2020-29390: Zeroshell 3.9.3 - Command Injection
• CVE-2020-29395: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting
• CVE-2020-29470: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting
• CVE-2020-29477: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting
• CVE-2020-35131: Cockpit CMS 0.6.1 - Remote Code Execution
• CVE-2020-35241: Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting
• CVE-2020-35476: OpenTSDB <=2.4.0 - Remote Code Execution
• CVE-2020-35545: Spotweb 1.4.9 - 'search' SQL Injection
• CVE-2020-35580: SearchBlox <9.2.2 - Local File Inclusion
• CVE-2020-35598: Advanced Comment System 1.0 - Local File Inclusion
• CVE-2020-35713: Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution
• CVE-2020-35729: Klog Server <=2.41 - Unauthenticated Command Injection
• CVE-2020-35736: GateOne 1.1 - Local File Inclusion
• CVE-2020-35749: WordPress Simple Job Board <2.9.4 - Local File Inclusion
• CVE-2020-35774: twitter-server Cross-Site Scripting
• CVE-2020-3580: Cisco ASA/FTD Software - Cross-Site Scripting
• CVE-2020-36333: ThemeGrill Demo Importer < 1.6.2 - Database Reset
• CVE-2020-36510: WordPress 15Zine <3.3.0 - Cross-Site Scripting
• CVE-2020-36731: Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update
• CVE-2020-36836: WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion
• CVE-2020-37123: Pinger 1.0 - Remote Code Execution
• CVE-2020-5191: Hospital Management System 4.0 - Persistent Cross-Site Scripting
• CVE-2020-5192: Hospital Management System 4.0 - 'searchdata' SQL Injection
• CVE-2020-5307: PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection
• CVE-2020-5405: Spring Cloud Config - Local File Inclusion
• CVE-2020-5410: Spring Cloud Config Server - Local File Inclusion
• CVE-2020-5504: phpMyAdmin 5.0.0 - SQL Injection
• CVE-2020-5722: Grandstream UCM6200 - SQL Injection
• CVE-2020-5766: SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection
• CVE-2020-5775: Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery
• CVE-2020-5776: MAGMI - Cross-Site Request Forgery
• CVE-2020-5902: F5 BIG-IP TMUI - Remote Code Execution
• CVE-2020-6010: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
• CVE-2020-6171: CLink Office 2.0 - Cross-Site Scripting
• CVE-2020-6950: Eclipse Mojarra - Local File Read
• CVE-2020-7107: WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting
• CVE-2020-7108: WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting
• CVE-2020-7209: LinuxKI Toolset <= 6.01 - Remote Command Execution
• CVE-2020-7318: McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting
• CVE-2020-7980: Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution
• CVE-2020-7991: Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)
• CVE-2020-8115: Revive Adserver <=5.0.3 - Cross-Site Scripting
• CVE-2020-8163: Ruby on Rails <5.0.1 - Remote Code Execution
• CVE-2020-8191: Citrix ADC/Gateway - Cross-Site Scripting
• CVE-2020-8209: Citrix XenMobile Server - Local File Inclusion
• CVE-2020-8512: IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting
• CVE-2020-8515: DrayTek - Remote Code Execution
• CVE-2020-8615: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery
• CVE-2020-8641: Lotus Core CMS 1.0.1 - Local File Inclusion
• CVE-2020-8656: EyesOfNetwork - Hardcoded API Key & SQL Injection
• CVE-2020-8771: WordPress Time Capsule < 1.21.16 - Authentication Bypass
• CVE-2020-8813: Cacti v1.2.8 - Remote Code Execution
• CVE-2020-8982: Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read
• CVE-2020-9043: WordPress wpCentral <1.5.1 - Information Disclosure
• CVE-2020-9054: Zyxel NAS Firmware 5.21- Remote Code Execution
• CVE-2020-9314: Oracle iPlanet Web Server 7.0.x - Image Injection
• CVE-2020-9344: Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting
• CVE-2020-9480: Apache Spark - Authentication Bypass
• CVE-2020-9483: SkyWalking SQLI
• CVE-2021-1472: Cisco Small Business RV Series - OS Command Injection
• CVE-2021-1498: Cisco HyperFlex HX Data Platform - Remote Command Execution
• CVE-2021-20038: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
• CVE-2021-20086: Odoo Apps - Cross-Site Scripting via Prototype Pollution
• CVE-2021-20123: Draytek VigorConnect 1.6.0-B - Local File Inclusion
• CVE-2021-20124: Draytek VigorConnect 6.0-B3 - Local File Inclusion
• CVE-2021-20137: Gryphon Tower - Cross-Site Scripting
• CVE-2021-20150: Trendnet AC2600 TEW-827DRU - Credentials Disclosure
• CVE-2021-20158: Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change
• CVE-2021-20167: Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
• CVE-2021-20323: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
• CVE-2021-20617: Acmailer - Improper Access Control to OS Command Injection
• CVE-2021-20792: WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting
• CVE-2021-21234: Spring Boot Actuator Logview Directory Traversal
• CVE-2021-21307: Lucee Admin - Remote Code Execution
• CVE-2021-21315: Node.JS System Information Library <5.3.1 - Remote Command Injection
• CVE-2021-21345: XStream < 1.4.16 - Remote Code Execution
• CVE-2021-21402: Jellyfin <10.7.0 - Local File Inclusion
• CVE-2021-21479: SCIMono <0.0.19 - Remote Code Execution
• CVE-2021-21799: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting
• CVE-2021-21800: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting
• CVE-2021-21801: Advantech R-SeeNet - Cross-Site Scripting
• CVE-2021-21802: Advantech R-SeeNet - Cross-Site Scripting
• CVE-2021-21803: Advantech R-SeeNet - Cross-Site Scripting
• CVE-2021-21881: Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection
• CVE-2021-22005: VMware vCenter Server - Arbitrary File Upload
• CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution
• CVE-2021-22145: Elasticsearch 7.10.0-7.13.3 - Information Disclosure
• CVE-2021-22175: GitLab CI Lint API - Server-Side Request Forgery
• CVE-2021-22214: Gitlab CE/EE 10.5 - Server-Side Request Forgery
• CVE-2021-22502: Micro Focus Operations Bridge Reporter - Remote Code Execution
• CVE-2021-23241: MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion
• CVE-2021-23394: elFinder < 2.1.58 - Remote Code Execution
• CVE-2021-24145: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
• CVE-2021-24155: WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload
• CVE-2021-24165: WordPress Ninja Forms <3.4.34 - Open Redirect
• CVE-2021-24169: WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting
• CVE-2021-24170: User Profile Picture < 2.5.0 - Sensitive Information Disclosure
• CVE-2021-24210: WordPress PhastPress <1.111 - Open Redirect
• CVE-2021-24212: WooCommerce Help Scout - Arbitrary File Upload
• CVE-2021-24213: GiveWP <= 2.9.7 - Cross-Site Scripting
• CVE-2021-24214: WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting
• CVE-2021-24215: Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation
• CVE-2021-24227: Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion
• CVE-2021-24235: WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting
• CVE-2021-24237: WordPress Realteo <=1.2.3 - Cross-Site Scripting
• CVE-2021-24245: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
• CVE-2021-24274: WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting
• CVE-2021-24275: Popup by Supsystic <1.10.5 - Cross-Site scripting
• CVE-2021-24276: WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
• CVE-2021-24284: WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload
• CVE-2021-24285: WordPress Car Seller - Auto Classifieds Script - SQL Injection
• CVE-2021-24286: WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting
• CVE-2021-24287: WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting
• CVE-2021-24291: WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting
• CVE-2021-24298: WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting
• CVE-2021-24300: WordPress WooCommerce <1.13.22 - Cross-Site Scripting
• CVE-2021-24316: WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting
• CVE-2021-24320: WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting
• CVE-2021-24335: WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting
• CVE-2021-24340: WordPress Statistics <13.0.8 - Blind SQL Injection
• CVE-2021-24342: WordPress JNews Theme <8.0.6 - Cross-Site Scripting
• CVE-2021-24347: WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload
• CVE-2021-24364: WordPress Jannah Theme <5.4.4 - Cross-Site Scripting
• CVE-2021-24387: WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting
• CVE-2021-24389: WordPress FoodBakery <2.2 - Cross-Site Scripting
• CVE-2021-24405: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
• CVE-2021-24407: WordPress Jannah Theme <5.4.5 - Cross-Site Scripting
• CVE-2021-24409: Prismatic < 2.8 - Cross-Site Scripting
• CVE-2021-24435: WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting
• CVE-2021-24436: WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting
• CVE-2021-24442: Wordpress Polls Widget < 1.5.3 - SQL Injection
• CVE-2021-24452: WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting
• CVE-2021-24472: Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery
• CVE-2021-24488: WordPress Post Grid <2.1.8 - Cross-Site Scripting
• CVE-2021-24495: Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting
• CVE-2021-24498: WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting
• CVE-2021-24499: WordPress Workreap - Remote Code Execution
• CVE-2021-24510: WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting
• CVE-2021-24522: ProfilePress < 3.1.11 - Cross-Site Scripting
• CVE-2021-24527: Profile Builder < 3.4.9 - Improper Authentication
• CVE-2021-24554: WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection
• CVE-2021-24563: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
• CVE-2021-24627: G Auto-Hyperlink <= 1.0.1 - SQL Injection
• CVE-2021-24644: Images to WebP < 1.9 - Authenticated Local File Inclusion
• CVE-2021-24657: Limit Login Attempts WordPress - Stored Cross-site Scripting
• CVE-2021-24666: WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection
• CVE-2021-24681: Duplicate Page WordPress - Stored Cross-Site Scripting
• CVE-2021-24731: Pie Register < 3.7.1.6 - SQL Injection
• CVE-2021-24750: WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection
• CVE-2021-24762: WordPress Perfect Survey <1.5.2 - SQL Injection
• CVE-2021-24786: Download Monitor < 4.4.5 - SQL Injection
• CVE-2021-24791: Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
• CVE-2021-24827: WordPress Asgaros Forum <1.15.13 - SQL Injection
• CVE-2021-24838: WordPress AnyComment <0.3.5 - Open Redirect
• CVE-2021-24849: WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
• CVE-2021-24862: WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
• CVE-2021-24875: WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
• CVE-2021-24876: Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting
• CVE-2021-24910: WordPress Transposh Translation <1.0.8 - Cross-Site Scripting
• CVE-2021-24915: Contest Gallery < 13.1.0.6 - SQL injection
• CVE-2021-24926: WordPress Domain Check <1.0.17 - Cross-Site Scripting
• CVE-2021-24931: WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
• CVE-2021-24934: Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting
• CVE-2021-24940: WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting
• CVE-2021-24943: Registrations for the Events Calendar < 2.7.6 - SQL Injection
• CVE-2021-24946: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
• CVE-2021-24947: WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read
• CVE-2021-24956: Blog2Social < 6.8.7 - Cross-Site Scripting
• CVE-2021-24966: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
• CVE-2021-24970: WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion
• CVE-2021-24979: Paid Memberships Pro < 2.6.6 - Cross-Site Scripting
• CVE-2021-24987: WordPress Super Socializer <7.13.30 - Cross-Site Scripting
• CVE-2021-24991: WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting
• CVE-2021-25003: WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution
• CVE-2021-25008: The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting
• CVE-2021-25016: Chaty < 2.8.2 - Cross-Site Scripting
• CVE-2021-25052: WordPress Button Generator <2.3.3 - Remote File Inclusion
• CVE-2021-25055: WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting
• CVE-2021-25063: WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting
• CVE-2021-25065: Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting
• CVE-2021-25067: Landing Page Builder < 1.4.9.6 - Cross-Site Scripting
• CVE-2021-25074: WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect
• CVE-2021-25075: WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting
• CVE-2021-25078: Affiliates Manager < 2.9.0 - Cross Site Scripting
• CVE-2021-25079: Contact Form Entries < 1.2.4 - Cross-Site Scripting
• CVE-2021-25082: WordPress Popup Builder < 4.0.7 - Remote Code Execution
• CVE-2021-25085: WOOF WordPress plugin - Cross-Site Scripting
• CVE-2021-25094: Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution
• CVE-2021-25104: WordPress Ocean Extra <1.9.5 - Cross-Site Scripting
• CVE-2021-25112: WordPress WHMCS Bridge <6.4b - Cross-Site Scripting
• CVE-2021-25114: WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection
• CVE-2021-25120: Easy Social Feed < 6.2.7 - Cross-Site Scripting
• CVE-2021-25161: Aruba Instant Access Point (IAP) - Cross-Site Scripting
• CVE-2021-25281: SaltStack Salt <3002.5 - Auth Bypass
• CVE-2021-25864: Hue Magic 3.0.0 - Local File Inclusion
• CVE-2021-25899: Void Aural Rec Monitor 9.0.0.1 - SQL Injection
• CVE-2021-26085: Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read
• CVE-2021-26086: Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read
• CVE-2021-26247: Cacti - Cross-Site Scripting
• CVE-2021-26475: EPrints 3.4.2 - Cross-Site Scripting
• CVE-2021-26702: EPrints 3.4.2 - Cross-Site Scripting
• CVE-2021-26710: Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting
• CVE-2021-26723: Jenzabar 9.2x-9.2.2 - Cross-Site Scripting
• CVE-2021-26947: Odoo <= 15.0 - Cross-Site Scripting
• CVE-2021-27124: Doctor Appointment System 1.0 - SQL Injection
• CVE-2021-27132: Sercomm VD625 Smart Modems - CRLF Injection
• CVE-2021-27309: Clansphere CMS 2011.4 - Cross-Site Scripting
• CVE-2021-27310: Clansphere CMS 2011.4 - Cross-Site Scripting
• CVE-2021-27314: Doctor Appointment System 1.0 - SQL Injection
• CVE-2021-27316: Doctor Appointment System 1.0 - SQL Injection
• CVE-2021-27319: Doctor Appointment System 1.0 - SQL Injection
• CVE-2021-27320: Doctor Appointment System 1.0 - SQL Injection
• CVE-2021-27330: Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting
• CVE-2021-27519: FUDForum 3.1.0 - Cross-Site Scripting
• CVE-2021-27520: FUDForum 3.1.0 - Cross-Site Scripting
• CVE-2021-27695: openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting
• CVE-2021-27828: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
• CVE-2021-27931: LumisXP <10.0.0 - Blind XML External Entity Attack
• CVE-2021-28149: Hongdian H8922 3.0.5 Devices - Local File Inclusion
• CVE-2021-28151: Hongdian H8922 3.0.5 - Remote Command Injection
• CVE-2021-28377: Joomla! ChronoForums 2.0.11 - Local File Inclusion
• CVE-2021-28799: QNAP HBS 3 - Broken Access Control
• CVE-2021-28918: Netmask NPM Package - Server-Side Request Forgery
• CVE-2021-29006: rConfig 3.9.6 - Local File Inclusion
• CVE-2021-29625: Adminer <=4.8.0 - Cross-Site Scripting
• CVE-2021-3002: Seo Panel 4.8.0 - Cross-Site Scripting
• CVE-2021-30049: SysAid Technologies 20.3.64 b14 - Cross-Site Scripting
• CVE-2021-30118: Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution
• CVE-2021-30134: Php-mod/curl Library <2.3.2 - Cross-Site Scripting
• CVE-2021-3018: IPeakCMS 3.5 - SQL Injection
• CVE-2021-30203: Dzzoffice 2.02.1 - Cross-Site Scripting
• CVE-2021-30213: Knowage Suite 7.3 - Cross-Site Scripting
• CVE-2021-3110: PrestaShop 1.7.7.0 - SQL Injection
• CVE-2021-31195: Microsoft Exchange Server - Cross-Site Scripting
• CVE-2021-31249: CHIYU TCP/IP Converter - Carriage Return Line Feed Injection
• CVE-2021-31250: CHIYU TCP/IP Converter - Cross-Site Scripting
• CVE-2021-3129: Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution
• CVE-2021-31316: CentOS Web Panel - SQL Injection
• CVE-2021-31324: CentOS Web Panel - OS Command Injection
• CVE-2021-31537: SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting
• CVE-2021-31589: BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting
• CVE-2021-31682: WebCTRL OEM <= 6.5 - Cross-Site Scripting
• CVE-2021-31755: Tenda Router AC11 - Remote Command Injection
• CVE-2021-31805: Apache Struts2 S2-062 - Remote Code Execution
• CVE-2021-31856: Layer5 Meshery 0.5.2 - SQL Injection
• CVE-2021-31862: SysAid 20.4.74 - Cross-Site Scripting
• CVE-2021-3223: Node RED Dashboard <2.26.2 - Local File Inclusion
• CVE-2021-32305: Websvn <2.6.1 - Remote Code Execution
• CVE-2021-3239: E-Learning System 1.0 - SQL Injection
• CVE-2021-32478: Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect
• CVE-2021-3278: Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass
• CVE-2021-32789: WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection
• CVE-2021-32819: Nodejs Squirrelly - Remote Code Execution
• CVE-2021-32820: Express-handlebars - Local File Inclusion
• CVE-2021-32853: Erxes <0.23.0 - Cross-Site Scripting
• CVE-2021-33357: RaspAP <=2.6.5 - Remote Command Injection
• CVE-2021-33544: Geutebruck - Remote Command Injection
• CVE-2021-33690: SAP NetWeaver Development Infrastructure - Server Side Request Forgery
• CVE-2021-33807: Cartadis Gespage 8.2.1 - Directory Traversal
• CVE-2021-33851: WordPress Customize Login Image <3.5.3 - Cross-Site Scripting
• CVE-2021-33904: Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
• CVE-2021-34187: Chamilo model.ajax.php - SQL Injection
• CVE-2021-34369: Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)
• CVE-2021-34370: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
• CVE-2021-34429: Eclipse Jetty 11.0.5 - Sensitive File Disclosure
• CVE-2021-34621: WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness
• CVE-2021-34624: WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload
• CVE-2021-34630: GTranslate < 2.8.65 - Cross-Site Scripting
• CVE-2021-34640: WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting
• CVE-2021-34643: WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting
• CVE-2021-34805: FAUST iServer 9.0.018.018.4 - Local File Inclusion
• CVE-2021-35250: SolarWinds Serv-U 15.3 - Directory Traversal
• CVE-2021-35265: MaxSite CMS > V106 - Cross-Site Scripting
• CVE-2021-35380: TermTalk Server 3.24.0.2 - Local File Inclusion
• CVE-2021-35395: RealTek Jungle SDK - Arbitrary Command Injection
• CVE-2021-35488: Thruk 2.40-2 - Cross-Site Scripting
• CVE-2021-3577: Motorola Baby Monitors - Remote Command Execution
• CVE-2021-36260: Hikvision IP camera/NVR - Remote Command Execution
• CVE-2021-36380: Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection
• CVE-2021-36450: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting
• CVE-2021-36646: KodExplorer - Cross-Site Scripting
• CVE-2021-36748: PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection
• CVE-2021-36749: Apache Druid - Local File Inclusion
• CVE-2021-36873: WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting
• CVE-2021-37291: KevinLAB BEMS 1.0 - SQL Injection
• CVE-2021-37416: Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting
• CVE-2021-37425: Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)
• CVE-2021-37538: PrestaShop SmartBlog <4.0.6 - SQL Injection
• CVE-2021-37573: Tiny Java Web Server - Cross-Site Scripting
• CVE-2021-37589: Virtua Software Cobranca 12S - SQLi
• CVE-2021-37593: PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection
• CVE-2021-37833: Hotel Druid 3.0.2 - Cross-Site Scripting
• CVE-2021-3831: Gnuboard 5 - Cross-Site Scripting
• CVE-2021-38702: Cyberoam NetGenie Cross-Site Scripting
• CVE-2021-38704: ClinicCases 7.3.3 Cross-Site Scripting
• CVE-2021-39144: XStream 1.4.18 - Remote Code Execution
• CVE-2021-39165: Cachet <=2.3.18 - SQL Injection
• CVE-2021-39312: WordPress True Ranker <2.2.4 - Local File Inclusion
• CVE-2021-39316: WordPress DZS Zoomsounds <=6.50 - Local File Inclusion
• CVE-2021-39320: WordPress Under Construction <1.19 - Cross-Site Scripting
• CVE-2021-39322: WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting
• CVE-2021-39350: FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting
• CVE-2021-39411: Hospital Management System 1.0 - Cross-Site Scripting
• CVE-2021-39433: BIQS IT Biqs-drive v1.83 Local File Inclusion
• CVE-2021-40149: Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure
• CVE-2021-40150: Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure
• CVE-2021-40272: IRTS OP5 Monitor - Cross-Site Scripting
• CVE-2021-40438: Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
• CVE-2021-40542: Opensis-Classic 8.0 - Cross-Site Scripting
• CVE-2021-40617: openSIS Community Edition 8.0 - SQL Injection
• CVE-2021-40651: OS4Ed OpenSIS Community 8.0 - Local File Inclusion
• CVE-2021-40661: IND780 - Local File Inclusion
• CVE-2021-40822: Geoserver - Server-Side Request Forgery
• CVE-2021-40868: Cloudron 6.2 Cross-Site Scripting
• CVE-2021-40870: Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution
• CVE-2021-40960: Galera WebTemplate 1.0 Directory Traversal
• CVE-2021-40978: MKdocs 1.2.2 - Directory Traversal
• CVE-2021-41277: Metabase - Local File Inclusion
• CVE-2021-41291: ECOA Building Automation System - Directory Traversal Content Disclosure
• CVE-2021-41293: ECOA Building Automation System - Arbitrary File Retrieval
• CVE-2021-41349: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
• CVE-2021-41460: ECShop 4.1.0 - SQL Injection
• CVE-2021-41467: JustWriting - Cross-Site Scripting
• CVE-2021-41569: SAS/Internet 9.4 1520 - Local File Inclusion
• CVE-2021-41648: PuneethReddyHC action.php SQL Injection
• CVE-2021-41649: PuneethReddyHC Online Shopping System homeaction.php SQL Injection
• CVE-2021-41691: openSIS Student Information System 8.0 SQL Injection
• CVE-2021-41749: CraftCMS SEOmatic - Server-Side Template Injection
• CVE-2021-41773: Apache 2.4.49 - Path Traversal and Remote Code Execution
• CVE-2021-41878: i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)
• CVE-2021-4191: GitLab GraphQL API User Enumeration
• CVE-2021-41951: Resourcespace - Cross-Site Scripting
• CVE-2021-42013: Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
• CVE-2021-42237: Sitecore Experience Platform Pre-Auth RCE
• CVE-2021-42325: Froxlor 0.10.29.1 - SQL Injection (Authenticated)
• CVE-2021-42551: NetBiblio WebOPAC - Cross-Site Scripting
• CVE-2021-42565: myfactory FMS - Cross-Site Scripting
• CVE-2021-42567: Apereo CAS Cross-Site Scripting
• CVE-2021-42663: Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting
• CVE-2021-42667: Online Event Booking and Reservation System 2.3.0 - SQL Injection
• CVE-2021-43062: Fortinet FortiMail 7.0.1 - Cross-Site Scripting
• CVE-2021-43140: Simple Subscription Website 1.0 - SQLi Authentication Bypass
• CVE-2021-43287: Pre-Auth Takeover of Build Pipelines in GoCD
• CVE-2021-43421: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
• CVE-2021-43495: AlquistManager Local File Inclusion
• CVE-2021-43496: Clustering Local File Inclusion
• CVE-2021-43510: Sourcecodester Simple Client Management System 1.0 - SQL Injection
• CVE-2021-43574: Atmail 6.5.0 - Cross-Site Scripting
• CVE-2021-43725: Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)
• CVE-2021-43734: kkFileview v4.0.0 - Local File Inclusion
• CVE-2021-43778: GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.
• CVE-2021-43798: Grafana v8.x - Arbitrary File Read
• CVE-2021-43810: Admidio - Cross-Site Scripting
• CVE-2021-43831: Gradio < 2.5.0 - Arbitrary File Read
• CVE-2021-44228: Apache Log4j2 Remote Code Injection
• CVE-2021-4449: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload
• CVE-2021-44567: RosarioSIS 7.6 - SQL Injection
• CVE-2021-4463: Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
• CVE-2021-45043: HD-Network Realtime Monitoring System 2.0 - Local File Inclusion
• CVE-2021-45046: Apache Log4j2 - Remote Code Injection
• CVE-2021-45380: AppCMS - Cross-Site Scripting
• CVE-2021-45382: D-Link - Remote Command Execution
• CVE-2021-45422: Reprise License Manager 14.2 - Cross-Site Scripting
• CVE-2021-45425: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
• CVE-2021-45428: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload
• CVE-2021-45467: Control Web Panel (CWP) - File Inclusion
• CVE-2021-46005: Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting
• CVE-2021-46068: Vehicle Service Management System - Stored Cross-Site Scripting
• CVE-2021-46069: Vehicle Service Management System 1.0 - Stored Cross Site Scripting
• CVE-2021-46071: ehicle Service Management System 1.0 - Cross-Site Scripting
• CVE-2021-46072: Vehicle Service Management System 1.0 - Stored Cross Site Scripting
• CVE-2021-46073: Vehicle Service Management System 1.0 - Cross Site Scripting
• CVE-2021-46104: webp_server_go 0.4.0 - Path Traversal
• CVE-2021-46107: Ligeo Archives Ligeo Basics - Server Side Request Forgery
• CVE-2021-46381: DLINK DAP-1620 A1 v1.01 - Directory Traversal
• CVE-2021-46387: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
• CVE-2021-46417: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
• CVE-2021-46418: Telesquare TLR-2855KS6 - Arbitrary File Creation
• CVE-2021-46419: Telesquare TLR-2855KS6 - Arbitrary File Deletion
• CVE-2021-47795: GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting
• CVE-2022-0087: Keystone 6 Login Page - Open Redirect and Cross-Site Scripting
• CVE-2022-0147: WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting
• CVE-2022-0148: WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting
• CVE-2022-0149: WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting
• CVE-2022-0169: Photo Gallery by 10Web < 1.6.0 - SQL Injection
• CVE-2022-0189: WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
• CVE-2022-0201: WordPress Permalink Manager <2.2.15 - Cross-Site Scripting
• CVE-2022-0206: WordPress NewStatPress <1.3.6 - Cross-Site Scripting
• CVE-2022-0208: WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting
• CVE-2022-0212: WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting
• CVE-2022-0228: Popup Builder < 4.0.7 - SQL Injection
• CVE-2022-0234: WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting
• CVE-2022-0250: Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting
• CVE-2022-0271: LearnPress <4.1.6 - Cross-Site Scripting
• CVE-2022-0332: Moodle 3.11.4 - SQL Injection
• CVE-2022-0346: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution
• CVE-2022-0349: WordPress NotificationX <2.3.9 - SQL Injection
• CVE-2022-0377: WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
• CVE-2022-0378: Microweber Cross-Site Scripting
• CVE-2022-0381: WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting
• CVE-2022-0412: WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
• CVE-2022-0429: WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting
• CVE-2022-0434: WordPress Page Views Count <2.4.15 - SQL Injection
• CVE-2022-0437: karma-runner DOM-based Cross-Site Scripting
• CVE-2022-0439: Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
• CVE-2022-0479: Popup Builder Plugin - SQL Injection and Cross-Site Scripting
• CVE-2022-0533: Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting
• CVE-2022-0535: WordPress E2Pdf <1.16.45 - Cross-Site Scripting
• CVE-2022-0592: MapSVG < 6.2.20 - Unauthenticated SQLi
• CVE-2022-0599: WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting
• CVE-2022-0653: Wordpress Profile Builder Plugin Cross-Site Scripting
• CVE-2022-0656: uDraw <3.3.3 - Local File Inclusion
• CVE-2022-0658: CommonsBooking < 2.6.8 - SQL Injection
• CVE-2022-0666: Microweber < 1.2.11 - CRLF Injection
• CVE-2022-0678: Microweber <1.2.11 - Cross-Site Scripting
• CVE-2022-0679: WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion
• CVE-2022-0693: WordPress Master Elements <=8.0 - SQL Injection
• CVE-2022-0747: Infographic Maker iList < 4.3.8 - SQL Injection
• CVE-2022-0760: WordPress Simple Link Directory <7.7.2 - SQL injection
• CVE-2022-0765: WordPress Loco Translate < 2.6.1 - Cross-Site Scripting
• CVE-2022-0769: Users Ultra <= 3.1.0 - SQL Injection
• CVE-2022-0773: Documentor <= 1.5.3 - Unauthenticated SQL Injection
• CVE-2022-0781: WordPress Nirweb Support <2.8.2 - SQL Injection
• CVE-2022-0783: Multiple Shipping Address Woocommerce < 2.0 - SQL Injection
• CVE-2022-0784: WordPress Title Experiments Free <9.0.1 - SQL Injection
• CVE-2022-0785: WordPress Daily Prayer Time <2022.03.01 - SQL Injection
• CVE-2022-0786: WordPress KiviCare <2.3.9 - SQL Injection
• CVE-2022-0787: Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection
• CVE-2022-0788: WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
• CVE-2022-0814: Ubigeo de Peru < 3.6.4 - SQL Injection
• CVE-2022-0817: WordPress BadgeOS <=3.7.0 - SQL Injection
• CVE-2022-0826: WordPress WP Video Gallery <=1.7.1 - SQL Injection
• CVE-2022-0827: WordPress Best Books <=2.6.3 - SQL Injection
• CVE-2022-0846: SpeakOut Email Petitions < 2.14.15.1 - SQL Injection
• CVE-2022-0864: UpdraftPlus < 1.22.9 - Cross-Site Scripting
• CVE-2022-0867: WordPress ARPrice <3.6.1 - SQL Injection
• CVE-2022-0873: WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting
• CVE-2022-0879: Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting
• CVE-2022-0899: Header Footer Code Manager < 1.1.24 - Cross-Site Scripting
• CVE-2022-0928: Microweber < 1.2.12 - Stored Cross-Site Scripting
• CVE-2022-0948: WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
• CVE-2022-0949: WordPress Stop Bad Bots <6.930 - SQL Injection
• CVE-2022-0954: Microweber <1.2.11 - Stored Cross-Site Scripting
• CVE-2022-1007: WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
• CVE-2022-1013: WordPress Personal Dictionary <1.3.4 - Blind SQL Injection
• CVE-2022-1029: Limit Login Attempts - Stored Cross-Site Scripting
• CVE-2022-1057: WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
• CVE-2022-1119: WordPress Simple File List <3.2.8 - Local File Inclusion
• CVE-2022-1168: WordPress WP JobSearch <1.5.1 - Cross-Site Scripting
• CVE-2022-1170: JobMonster < 4.5.2.9 - Cross-Site Scripting
• CVE-2022-1221: WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting
• CVE-2022-1329: Elementor Website Builder - Remote Code Execution
• CVE-2022-1388: F5 BIG-IP iControl - REST Auth Bypass RCE
• CVE-2022-1390: WordPress Admin Word Count Column 2.2 - Local File Inclusion
• CVE-2022-1391: WordPress Cab fare calculator < 1.0.4 - Local File Inclusion
• CVE-2022-1398: External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
• CVE-2022-1439: Microweber <1.2.15 - Cross-Site Scripting
• CVE-2022-1453: RSVPMaker <= 9.2.5 - SQL Injection
• CVE-2022-1574: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
• CVE-2022-1609: The School Management < 9.9.7 - Remote Code Execution
• CVE-2022-1724: WordPress Simple Membership <4.1.1 - Cross-Site Scripting
• CVE-2022-1756: Newsletter < 7.4.5 - Cross-Site Scripting
• CVE-2022-1768: WordPress RSVPMaker <=9.3.2 - SQL Injection
• CVE-2022-1883: Terraboard <2.2.0 - SQL Injection
• CVE-2022-1904: WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting
• CVE-2022-1906: WordPress Copyright Proof <=4.16 - Cross-Site-Scripting
• CVE-2022-1910: WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting
• CVE-2022-1933: WordPress CDI <5.1.9 - Cross Site Scripting
• CVE-2022-1937: WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
• CVE-2022-1946: WordPress Gallery <2.0.0 - Cross-Site Scripting
• CVE-2022-1950: Youzify < 1.2.0 - Unauthenticated SQLi
• CVE-2022-2130: Microweber < 1.2.17 - Cross-Site Scripting
• CVE-2022-2168: WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting
• CVE-2022-2174: microweber 1.2.18 - Cross-site Scripting
• CVE-2022-2187: WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting
• CVE-2022-2219: Unyson < 2.7.27 - Cross Site Scripting
• CVE-2022-22242: Juniper Web Device Manager - Cross-Site Scripting
• CVE-2022-22536: SAP Memory Pipes (MPI) Desynchronization
• CVE-2022-22897: PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection
• CVE-2022-2290: Trilium <0.52.4 - Cross-Site Scripting
• CVE-2022-22954: VMware Workspace ONE Access - Server-Side Template Injection
• CVE-2022-23347: BigAnt Server v5.6.06 - Local File Inclusion
• CVE-2022-23397: Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting
• CVE-2022-23808: phpMyAdmin < 5.1.2 - Cross-Site Scripting
• CVE-2022-2383: WordPress Feed Them Social <3.0.1 - Cross-Site Scripting
• CVE-2022-23854: AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
• CVE-2022-23898: MCMS 5.2.5 - SQL Injection
• CVE-2022-24112: Apache APISIX - Remote Code Execution
• CVE-2022-24124: Casdoor 1.13.0 - Unauthenticated SQL Injection
• CVE-2022-24223: Atom CMS v2.0 - SQL Injection
• CVE-2022-24260: VoipMonitor - Pre-Auth SQL Injection
• CVE-2022-24264: Cuppa CMS v1.0 - SQL injection
• CVE-2022-24265: Cuppa CMS v1.0 - SQL injection
• CVE-2022-24266: Cuppa CMS v1.0 - SQL injection
• CVE-2022-24384: SmarterTools SmarterTrack - Cross-Site Scripting
• CVE-2022-24627: AudioCodes Device Manager Express - SQL Injection
• CVE-2022-2467: Garage Management System 1.0 - SQL Injection
• CVE-2022-24716: Icinga Web 2 - Arbitrary File Disclosure
• CVE-2022-24816: GeoServer <1.2.2 - Remote Code Execution
• CVE-2022-2486: Wavlink WN535K2/WN535K3 - OS Command Injection
• CVE-2022-2488: Wavlink WN535K2/WN535K3 - OS Command Injection
• CVE-2022-24899: Contao <4.13.3 - Cross-Site Scripting
• CVE-2022-24900: Piano LED Visualizer 1.3 - Local File Inclusion
• CVE-2022-25082: TOTOLink - Unauthenticated Command Injection
• CVE-2022-25125: MCMS 5.2.4 - SQL Injection
• CVE-2022-25323: ZEROF Web Server 2.0 - Cross-Site Scripting
• CVE-2022-25356: Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection
• CVE-2022-2546: WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting
• CVE-2022-25485: Cuppa CMS v1.0 - Local File Inclusion
• CVE-2022-25486: Cuppa CMS v1.0 - Local File Inclusion
• CVE-2022-25488: Atom CMS v2.0 - SQL Injection
• CVE-2022-25489: Atom CMS v2.0 - Cross-Site Scripting
• CVE-2022-25497: Cuppa CMS v1.0 - Local File Inclusion
• CVE-2022-2599: WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting
• CVE-2022-26134: Confluence - Remote Code Execution
• CVE-2022-26233: Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion
• CVE-2022-26271: 74cmsSE v3.4.1 - Arbitrary File Read
• CVE-2022-2633: All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
• CVE-2022-26564: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
• CVE-2022-26585: Mingsoft MCMS v5.2.7 - SQL Injection
• CVE-2022-26833: Open Automation Software OAS Platform V16.00.0121 - Missing Authentication
• CVE-2022-26960: elFinder <=2.1.60 - Local File Inclusion
• CVE-2022-27043: Yearning - Directory Traversal
• CVE-2022-2733: Openemr < 7.0.0.1 - Cross-Site Scripting
• CVE-2022-27593: QNAP QTS Photo Station External Reference - Local File Inclusion
• CVE-2022-27926: Zimbra Collaboration (ZCS) - Cross Site Scripting
• CVE-2022-27927: Microfinance Management System 1.0 - 'customer_number' SQLi
• CVE-2022-27984: Cuppa CMS v1.0 - SQL injection
• CVE-2022-27985: Cuppa CMS v1.0 - SQL injection
• CVE-2022-28032: Atom CMS v2.0 - SQL Injection
• CVE-2022-28033: Atom.CMS 2.0 - SQL Injection
• CVE-2022-28079: College Management System 1.0 - 'course_code' SQL Injection (Authenticated)
• CVE-2022-28080: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
• CVE-2022-28219: Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
• CVE-2022-28290: WordPress Country Selector <1.6.6 - Cross-Site Scripting
• CVE-2022-28363: Reprise License Manager 14.2 - Cross-Site Scripting
• CVE-2022-2840: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
• CVE-2022-28508: MantisBT < 2.25.2 - Cross-Site Scripting
• CVE-2022-2863: WordPress WPvivid Backup <0.9.76 - Local File Inclusion
• CVE-2022-28666: Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
• CVE-2022-29004: Diary Management System 1.0 - Cross-Site Scripting
• CVE-2022-29005: Online Birth Certificate System 1.2 - Stored Cross-Site Scripting
• CVE-2022-29006: Directory Management System 1.0 - SQL Injection
• CVE-2022-29007: Dairy Farm Shop Management System 1.0 - SQL Injection
• CVE-2022-29013: Razer Sila Gaming Router - Remote Code Execution
• CVE-2022-29014: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
• CVE-2022-29078: Node.js Embedded JavaScript 3.1.6 - Template Injection
• CVE-2022-29298: SolarView Compact 6.00 - Local File Inclusion
• CVE-2022-29299: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting
• CVE-2022-29301: SolarView Compact 6.00 - 'pow' Cross-Site Scripting
• CVE-2022-29303: SolarView Compact 6.00 - OS Command Injection
• CVE-2022-29316: Complete Online Job Search System 1.0 - Cross-Site Scripting
• CVE-2022-29383: NETGEAR ProSafe SSL VPN firmware - SQL Injection
• CVE-2022-29495: WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
• CVE-2022-30489: Wavlink WN-535G3 - Cross-Site Scripting
• CVE-2022-30513: School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
• CVE-2022-30514: School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
• CVE-2022-30525: Zyxel Firewall - OS Command Injection
• CVE-2022-3062: Simple File List < 4.4.12 - Cross Site Scripting
• CVE-2022-30776: Atmail 6.5.0 - Cross-Site Scripting
• CVE-2022-30777: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting
• CVE-2022-31062: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
• CVE-2022-31137: Roxy-WI < 6.1.1.0 - Remote Code Execution
• CVE-2022-31299: Haraj 3.7 - Cross-Site Scripting
• CVE-2022-31373: SolarView Compact 6.00 - Cross-Site Scripting
• CVE-2022-3142: NEX-Forms Plugin < 7.9.7 - SQL Injection
• CVE-2022-31470: Axigen WebMail - Cross-Site Scripting
• CVE-2022-31474: BackupBuddy - Local File Inclusion
• CVE-2022-31499: Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection
• CVE-2022-31798: Nortek Linear eMerge E3-Series - Cross-Site Scripting
• CVE-2022-31974: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-31975: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-31976: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-31977: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-31978: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-31984: Online Fire Reporting System v1.0 - SQL injection
• CVE-2022-32007: Complete Online Job Search System 1.0 - SQL Injection
• CVE-2022-32015: Complete Online Job Search System 1.0 - SQL Injection
• CVE-2022-32018: Complete Online Job Search System 1.0 - SQL Injection
• CVE-2022-32022: Car Rental Management System 1.0 - SQL Injection
• CVE-2022-32024: Car Rental Management System 1.0 - SQL Injection
• CVE-2022-32025: Car Rental Management System 1.0 - SQL Injection
• CVE-2022-32026: Car Rental Management System 1.0 - SQL Injection
• CVE-2022-32028: Car Rental Management System 1.0 - SQL Injection
• CVE-2022-32094: Hospital Management System 1.0 - SQL Injection
• CVE-2022-32195: Open edX <2022-06-06 - Cross-Site Scripting
• CVE-2022-3236: Sophos Firewall <= 19.0 MR1 - Remote Code Execution
• CVE-2022-32409: Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion
• CVE-2022-3242: Microweber <1.3.2 - Cross-Site Scripting
• CVE-2022-3254: AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection
• CVE-2022-32770: WWBN AVideo 11.6 - Cross-Site Scripting
• CVE-2022-32771: WWBN AVideo 11.6 - Cross-Site Scripting
• CVE-2022-32772: WWBN AVideo 11.6 - Cross-Site Scripting
• CVE-2022-33119: NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting
• CVE-2022-33891: Apache Spark UI - Remote Command Injection
• CVE-2022-33901: WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read
• CVE-2022-33965: WordPress Visitor Statistics <=5.7 - SQL Injection
• CVE-2022-34045: WAVLINK WN530HG4 - Improper Access Control
• CVE-2022-34048: Wavlink WN-533A8 - Cross-Site Scripting
• CVE-2022-34093: Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting
• CVE-2022-34094: Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting
• CVE-2022-34121: CuppaCMS v1.0 - Local File Inclusion
• CVE-2022-34125: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
• CVE-2022-34127: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
• CVE-2022-34128: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
• CVE-2022-34328: PMB 7.3.10 - Cross-Site Scripting
• CVE-2022-34590: Hospital Management System 1.0 - SQL Injection
• CVE-2022-3481: NotificationX Dropshipping < 4.4 - SQL Injection
• CVE-2022-3484: WordPress WPB Show Core - Cross-Site Scripting
• CVE-2022-3506: WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting
• CVE-2022-35155: Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
• CVE-2022-35405: Zoho ManageEngine - Remote Code Execution
• CVE-2022-35416: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting
• CVE-2022-35493: eShop 3.0.4 - Cross-Site Scripting
• CVE-2022-35507: Proxmox - CRLF Injection
• CVE-2022-35653: Moodle LTI module Reflected - Cross-Site Scripting
• CVE-2022-3578: WordPress ProfileGrid <5.1.1 - Cross-Site Scripting
• CVE-2022-35914: GLPI <=10.0.2 - Remote Command Execution
• CVE-2022-36446: Webmin <1.997 - Authenticated Remote Code Execution
• CVE-2022-36553: Hytec Inter HWL-2511-SS - Remote Command Execution
• CVE-2022-36642: Omnia MPX 1.5.0+r1 - Local File Inclusion
• CVE-2022-37042: Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution
• CVE-2022-37122: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal
• CVE-2022-37153: Artica Proxy 4.30.000000 - Cross-Site Scripting
• CVE-2022-37299: Shirne CMS 1.2.0 - Local File Inclusion
• CVE-2022-3766: phpMyFAQ < 3.1.8 - Cross-Site Scripting
• CVE-2022-3768: WordPress WPSmartContracts <1.3.12 - SQL Injection
• CVE-2022-3800: IBAX - SQL Injection
• CVE-2022-38295: Cuppa CMS v1.0 - Cross Site Scripting
• CVE-2022-38322: Temenos Transact - Cross-Site Scripting
• CVE-2022-38463: ServiceNow - Cross-Site Scripting
• CVE-2022-38467: CRM Perks Forms < 1.1.1 - Cross Site Scripting
• CVE-2022-38553: Academy Learning Management System <5.9.1 - Cross-Site Scripting
• CVE-2022-38580: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
• CVE-2022-38627: Nortek Linear eMerge E3-Series - SQL Injection
• CVE-2022-38637: Hospital Management System 1.0 - SQL Injection
• CVE-2022-38794: Zaver - Local File Inclusion
• CVE-2022-38812: AeroCMS 0.1.1 - SQL Injection
• CVE-2022-38840: Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)
• CVE-2022-3908: WordPress Helloprint <1.4.7 - Cross-Site Scripting
• CVE-2022-39195: LISTSERV 17 - Cross-Site Scripting
• CVE-2022-3933: WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting
• CVE-2022-3934: WordPress FlatPM <3.0.13 - Cross-Site Scripting
• CVE-2022-40032: Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
• CVE-2022-40347: Intern Record System v1.0 - SQL Injection (Unauthenticated)
• CVE-2022-40359: Kae's File Manager <=1.4.7 - Cross-Site Scripting
• CVE-2022-4050: WordPress JoomSport <5.2.8 - SQL Injection
• CVE-2022-4059: Cryptocurrency Widgets Pack < 2.0 - SQL Injection
• CVE-2022-4060: WordPress User Post Gallery <=2.19 - Remote Code Execution
• CVE-2022-40734: Laravel Filemanager v2.5.1 - Local File Inclusion
• CVE-2022-40843: Tenda AC1200 V-W15Ev2 - Authentication Bypass
• CVE-2022-40881: SolarView 6.00 - Remote Command Execution
• CVE-2022-4117: WordPress IWS Geo Form Fields <=1.0 - SQL Injection
• CVE-2022-4140: WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
• CVE-2022-41412: perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery
• CVE-2022-41441: ReQlogic v11.3 - Cross Site Scripting
• CVE-2022-41473: RPCMS 3.0.2 - Cross-Site Scripting
• CVE-2022-41800: F5 BIG-IP Appliance Mode - Command Injection
• CVE-2022-41840: Welcart eCommerce <=2.7.7 - Local File Inclusion
• CVE-2022-42118: Liferay Portal - Cross-site Scripting
• CVE-2022-4260: WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting
• CVE-2022-42746: CandidATS 3.0.0 - Cross-Site Scripting.
• CVE-2022-42747: CandidATS 3.0.0 - Cross-Site Scripting.
• CVE-2022-42748: CandidATS 3.0.0 - Cross-Site Scripting.
• CVE-2022-42749: CandidATS 3.0.0 - Cross-Site Scripting
• CVE-2022-4295: Show all comments < 7.0.1 - Cross-Site Scripting
• CVE-2022-4301: WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting
• CVE-2022-43014: OpenCATS 0.9.6 - Cross-Site Scripting
• CVE-2022-43015: OpenCATS 0.9.6 - Cross-Site Scripting
• CVE-2022-43016: OpenCATS 0.9.6 - Cross-Site Scripting
• CVE-2022-43017: OpenCATS 0.9.6 - Cross-Site Scripting
• CVE-2022-43018: OpenCATS 0.9.6 - Cross-Site Scripting
• CVE-2022-4306: WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
• CVE-2022-43128: Dreamer CMS v4.0.0 - SQL Injection
• CVE-2022-4320: WordPress Events Calendar <1.4.5 - Cross-Site Scripting
• CVE-2022-4321: PDF Generator for WordPress < 1.1.2 - Cross Site Scripting
• CVE-2022-4325: WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting
• CVE-2022-4328: WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
• CVE-2022-44290: WebTareas 2.4p5 - SQL Injection
• CVE-2022-44291: WebTareas 2.4p5 - SQL Injection
• CVE-2022-4447: WordPress Fontsy <=1.8.6 - SQL Injection
• CVE-2022-44588: Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection
• CVE-2022-44727: PrestaShop lgcookieslaw - SQL Injection
• CVE-2022-44877: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
• CVE-2022-45699: APsystems ECU-R Firmware - Command Injection
• CVE-2022-45805: WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection
• CVE-2022-45808: LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
• CVE-2022-45836: WordPress Download Manager <= 3.2.59 - Reflected XSS
• CVE-2022-46071: Helmet Store Showroom v1.0 - SQL Injection
• CVE-2022-46073: Helmet Store Showroom - Cross Site Scripting
• CVE-2022-46381: Linear eMerge E3-Series - Cross-Site Scripting
• CVE-2022-46443: Bangresto - SQL Injection
• CVE-2022-46888: NexusPHP <1.7.33 - Cross-Site Scripting
• CVE-2022-47501: Apache OFBiz < 18.12.07 - Local File Inclusion
• CVE-2022-47615: LearnPress Plugin < 4.2.0 - Local File Inclusion
• CVE-2022-47945: Thinkphp Lang - Local File Inclusion
• CVE-2022-47986: IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution
• CVE-2022-48012: OpenCATS 0.9.7 - Cross-Site Scripting
• CVE-2022-48197: Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting
• CVE-2022-48323: Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution
• CVE-2022-4897: WordPress BackupBuddy <8.8.3 - Cross Site Scripting
• CVE-2022-4971: Sassy Social Share <= 3.3.3 - Cross-Site Scripting
• CVE-2023-0037: WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection
• CVE-2023-0099: Simple URLs < 115 - Cross Site Scripting
• CVE-2023-0126: SonicWall SMA1000 LFI
• CVE-2023-0159: Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
• CVE-2023-0236: WordPress Tutor LMS <2.0.10 - Cross Site Scripting
• CVE-2023-0261: WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection
• CVE-2023-0297: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
• CVE-2023-0334: ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting
• CVE-2023-0448: WP Helper Lite < 4.3 - Cross-Site Scripting
• CVE-2023-0514: Membership Database <= 1.0 - Cross-Site Scripting
• CVE-2023-0527: Online Security Guards Hiring System - Cross-Site Scripting
• CVE-2023-0562: Bank Locker Management System v1.0 - SQL Injection
• CVE-2023-0563: Bank Locker Management System - Cross-Site Scripting
• CVE-2023-0600: WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection
• CVE-2023-0602: Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting
• CVE-2023-0630: Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection
• CVE-2023-0669: Fortra GoAnywhere MFT - Remote Code Execution
• CVE-2023-0676: phpIPAM 1.5.1 - Cross-site Scripting
• CVE-2023-0900: AP Pricing Tables Lite <= 1.1.6 - SQL Injection
• CVE-2023-0902: Employee Task Management System v1.0 - SQL Injection on edit-task.php
• CVE-2023-0903: Employee Task Management System v1.0 - SQL Injection on edit-task.php
• CVE-2023-0904: Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)
• CVE-2023-0905: Employee Task Management System v1.0 - Broken Authentication
• CVE-2023-0912: Auto Dealer Management System v1.0 - SQL Injection
• CVE-2023-0913: Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
• CVE-2023-0915: Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
• CVE-2023-0938: Music Gallery Site v1.0 - SQL Injection on music_list.php
• CVE-2023-0942: WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting
• CVE-2023-0948: WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting
• CVE-2023-0962: Music Gallery Site v1.0 - SQL Injection on page Master.php
• CVE-2023-0968: WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting
• CVE-2023-1020: Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
• CVE-2023-1080: WordPress GN Publisher <1.5.6 - Cross-Site Scripting
• CVE-2023-1119: WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting
• CVE-2023-1211: phpIPAM 1.5.1 - SQL Injection
• CVE-2023-1315: osTicket < v1.16.6 - Cross-Site Scripting
• CVE-2023-1318: osTicket < v1.16.6 - Cross-Site Scripting
• CVE-2023-1389: TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection
• CVE-2023-1408: Video List Manager <= 1.7 - SQL Injection
• CVE-2023-1434: Odoo - Cross-Site Scripting
• CVE-2023-1454: Jeecg-boot 3.5.0 qurestSql - SQL Injection
• CVE-2023-1546: MyCryptoCheckout < 2.124 - Cross-Site Scripting
• CVE-2023-1719: Bitrix Component - Cross-Site Scripting
• CVE-2023-1730: SupportCandy < 3.1.5 - Unauthenticated SQL Injection
• CVE-2023-1780: Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting
• CVE-2023-1835: Ninja Forms < 3.6.22 - Cross-Site Scripting
• CVE-2023-1880: Phpmyfaq v3.1.11 - Cross-Site Scripting
• CVE-2023-1890: Tablesome < 1.0.9 - Cross-Site Scripting
• CVE-2023-1892: Sidekiq < 7.0.8 - Cross-Site Scripting
• CVE-2023-1893: Login Configurator <=2.1 - Cross-Site Scripting
• CVE-2023-2009: Pretty Url <= 1.5.4 - Cross-Site Scripting
• CVE-2023-2023: Custom 404 Pro < 3.7.3 - Cross-Site Scripting
• CVE-2023-2059: DedeCMS 5.7.87 - Directory Traversal
• CVE-2023-2122: Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
• CVE-2023-2130: Purchase Order Management v1.0 - SQL Injection
• CVE-2023-2178: Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
• CVE-2023-22047: Oracle Peoplesoft - Unauthenticated File Read
• CVE-2023-2224: Seo By 10Web < 1.2.7 - Cross-Site Scripting
• CVE-2023-22463: KubePi JwtSigKey - Admin Authentication Bypass
• CVE-2023-2252: Directorist < 7.5.4 - Local File Inclusion
• CVE-2023-22527: Atlassian Confluence - Remote Code Execution
• CVE-2023-2256: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
• CVE-2023-2272: Tiempo.com <= 0.1.2 - Cross-Site Scripting
• CVE-2023-23063: Cellinx NVT Web Server - Local File Disclosure
• CVE-2023-2309: wpForo Forum <= 2.1.8 - Cross-Site Scripting
• CVE-2023-23161: Art Gallery Management System Project v1.0 - Cross-Site Scripting
• CVE-2023-23333: SolarView Compact 6.00 - OS Command Injection
• CVE-2023-23488: WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection
• CVE-2023-23489: WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
• CVE-2023-23491: Quick Event Manager < 9.7.5 - Cross-Site Scripting
• CVE-2023-23492: Login with Phone Number - Cross-Site Scripting
• CVE-2023-2356: Mlflow <2.3.0 - Local File Inclusion
• CVE-2023-23897: Ozette Plugins - Cross-Site Request Forgery
• CVE-2023-24000: WordPress GamiPress <= 2.5.7 - SQL Injection
• CVE-2023-24278: Squidex <7.4.0 - Cross-Site Scripting
• CVE-2023-24322: mojoPortal 2.7.0.0 - Cross-Site Scripting
• CVE-2023-24367: Temenos T24 R20 - Cross-Site Scripting
• CVE-2023-24488: Citrix Gateway and Citrix ADC - Cross-Site Scripting
• CVE-2023-24657: phpIPAM - 1.6 - Cross-Site Scripting
• CVE-2023-24733: PMB 7.4.6 - Cross-Site Scripting
• CVE-2023-24737: PMB v7.4.6 - Cross-Site Scripting
• CVE-2023-2479: Appium Desktop Server - Remote Code Execution
• CVE-2023-25135: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution
• CVE-2023-2518: WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting
• CVE-2023-25280: D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection
• CVE-2023-25346: ChurchCRM 4.5.3 - Cross-Site Scripting
• CVE-2023-25717: Ruckus Wireless Admin - Remote Code Execution
• CVE-2023-26067: Lexmark Printers - Command Injection
• CVE-2023-2624: KiviCare WordPress Plugin - Cross-Site Scripting
• CVE-2023-26256: STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion
• CVE-2023-26360: Adobe ColdFusion - Local File Read
• CVE-2023-26802: DCBI-Netlog-LAB v1.0 - Command Injection
• CVE-2023-26842: ChurchCRM 4.5.3 - Cross-Site Scripting
• CVE-2023-26843: ChurchCRM 4.5.3 - Cross-Site Scripting
• CVE-2023-27008: ATutor < 2.2.1 - Cross Site Scripting
• CVE-2023-27034: Jms Blog - SQL Injection
• CVE-2023-27167: Suprema BioStar 2 v2.8.16 - SQL Injection
• CVE-2023-27350: PaperCut - Unauthenticated Remote Code Execution
• CVE-2023-2745: WordPress Core <=6.2 - Directory Traversal
• CVE-2023-27637: PrestaShop `tshirtecommerce` Module - SQL Injection
• CVE-2023-27638: tshirtecommerce PrestaShop Module - SQL Injection
• CVE-2023-27639: PrestaShop TshirteCommerce - Directory Traversal
• CVE-2023-27640: PrestaShop tshirtecommerce - Directory Traversal
• CVE-2023-27641: L-Soft LISTSERV 16.5 - Cross-Site Scripting
• CVE-2023-2766: Weaver OA 9.5 - Information Disclosure
• CVE-2023-2779: Super Socializer < 7.13.52 - Cross-Site Scripting
• CVE-2023-27847: PrestaShop xipblog - SQL Injection
• CVE-2023-27922: Newsletter < 7.6.9 - Cross-Site Scripting
• CVE-2023-2813: Wordpress Multiple Themes - Reflected Cross-Site Scripting
• CVE-2023-2822: Ellucian Ethos Identity CAS - Cross-Site Scripting
• CVE-2023-28343: Altenergy Power Control Software C1.2.5 - Remote Command Injection
• CVE-2023-28665: Woo Bulk Price Update <2.2.2 - Cross-Site Scripting
• CVE-2023-28787: Quiz and Survey Master <= 8.1.4 - SQL Injection
• CVE-2023-29300: Adobe ColdFusion - Pre-Auth Remote Code Execution
• CVE-2023-29439: FooGallery plugin <= 2.2.35 - Cross-Site Scripting
• CVE-2023-2948: OpenEMR < 7.0.1 - Cross-Site Scripting
• CVE-2023-29489: cPanel < 11.109.9999.116 - Cross-Site Scripting
• CVE-2023-2949: OpenEMR < 7.0.1 - Cross-site Scripting
• CVE-2023-29623: Purchase Order Management v1.0 - Cross Site Scripting (Reflected)
• CVE-2023-29827: Embedded JavaScript(EJS) 3.1.6 - Template Injection
• CVE-2023-29887: Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion
• CVE-2023-30013: TOTOLink - Unauthenticated Command Injection
• CVE-2023-30150: PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
• CVE-2023-30192: PrestaShop 'possearchproducts' <= 1.7 - SQL Injection
• CVE-2023-30194: Prestashop posstaticfooter <= 1.0.0 - SQL Injection
• CVE-2023-30210: OURPHP <= 7.2.0 - Cross Site Scripting
• CVE-2023-30212: OURPHP <= 7.2.0 - Cross Site Scripting
• CVE-2023-30256: Webkul QloApps 1.5.2 - Cross-site Scripting
• CVE-2023-30258: MagnusBilling - Remote Code Execution
• CVE-2023-30625: Rudder Server < 1.3.0-rc.1 - SQL Injection
• CVE-2023-3077: MStore API < 3.9.8 - SQL Injection
• CVE-2023-30777: Advanced Custom Fields < 6.1.6 - Cross-Site Scripting
• CVE-2023-30868: Tree Page View Plugin < 1.6.7 - Cross-Site Scripting
• CVE-2023-30869: Easy Digital Downloads - Privilege Escalation
• CVE-2023-30943: Moodle - Cross-Site Scripting/Remote Code Execution
• CVE-2023-31059: Repetier Server - Directory Traversal
• CVE-2023-31465: TimeKeeper by FSMLabs - Remote Code Execution
• CVE-2023-31548: ChurchCRM v4.5.3 - Cross-Site Scripting
• CVE-2023-3169: tagDiv Composer < 4.2 - Stored Cross-Site Scripting
• CVE-2023-3188: Owncast - Server Side Request Forgery
• CVE-2023-3197: WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection
• CVE-2023-32235: Ghost CMS < 5.42.1 - Path Traversal
• CVE-2023-32563: Ivanti Avalanche - Remote Code Execution
• CVE-2023-32590: Subscribe to Category <= 2.7.4 - SQL Injection
• CVE-2023-32749: Pydio Cells 4.1.2 - Unauthorised Role Assignments
• CVE-2023-33338: Old Age Home Management System v1.0 - SQL Injection
• CVE-2023-33362: Piwigo 13.6.0 - SQL Injection
• CVE-2023-33439: Faculty Evaluation System v1.0 - SQL Injection
• CVE-2023-3345: LMS by Masteriyo < 1.6.8 - Information Exposure
• CVE-2023-33510: Jeecg P3 Biz Chat - Local File Inclusion
• CVE-2023-33629: H3C Magic R300-2100M - Remote Code Execution
• CVE-2023-3368: Chamilo LMS <= v1.11.20 Unauthenticated Command Injection
• CVE-2023-3380: WAVLINK WN579X3 - Remote Command Execution
• CVE-2023-33831: FUXA - Unauthenticated Remote Code Execution
• CVE-2023-34048: VMware vCenter Server - Out-of-Bounds Write
• CVE-2023-34092: Vite Dev Server - Information Exposure
• CVE-2023-34105: SRS - Command Injection
• CVE-2023-34124: SonicWall GMS and Analytics Web Services - Shell Injection
• CVE-2023-34133: SonicWall GMS and Analytics - SQL Injection
• CVE-2023-34192: Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting
• CVE-2023-34259: Kyocera TASKalfa printer - Path Traversal
• CVE-2023-34362: MOVEit Transfer - Remote Code Execution
• CVE-2023-3452: WordPress Canto Plugin <= 3.0.4 - File Inclusion
• CVE-2023-34537: Hoteldruid 3.0.5 - Cross-Site Scripting
• CVE-2023-34599: Gibbon v25.0.0 - Cross-Site Scripting
• CVE-2023-34659: JeecgBoot 3.5.0 - SQL Injection
• CVE-2023-34751: bloofoxCMS v0.5.2.1 - SQL Injection
• CVE-2023-34752: bloofoxCMS v0.5.2.1 - SQL Injection
• CVE-2023-34753: bloofoxCMS v0.5.2.1 - SQL Injection
• CVE-2023-34754: Bloofox v0.5.2.1 - SQL Injection
• CVE-2023-34755: bloofoxCMS v0.5.2.1 - SQL Injection
• CVE-2023-34756: Bloofox v0.5.2.1 - SQL Injection
• CVE-2023-3479: Hestiacp <= 1.7.7 - Cross-Site Scripting
• CVE-2023-34843: Traggo Server - Local File Inclusion
• CVE-2023-34960: Chamilo Command Injection
• CVE-2023-34990: FortiWLM - Directory Traversal
• CVE-2023-34993: Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
• CVE-2023-35155: XWiki - Cross-Site Scripting
• CVE-2023-35156: XWiki >= 6.0-rc-1 - Cross-Site Scripting
• CVE-2023-35158: XWiki - Cross-Site Scripting
• CVE-2023-35159: XWiki >= 3.4-milestone-1 - Cross-Site Scripting
• CVE-2023-35160: XWiki >= 2.5-milestone-2 - Cross-Site Scripting
• CVE-2023-35161: XWiki >= 6.2-milestone-1 - Cross-Site Scripting
• CVE-2023-35162: XWiki < 14.10.5 - Cross-Site Scripting
• CVE-2023-3521: FOSSBilling < 0.5.3 - Cross-Site Scripting
• CVE-2023-35843: NocoDB version <= 0.106.1 - Arbitrary File Read
• CVE-2023-35844: Lightdash version <= 0.510.3 Arbitrary File Read
• CVE-2023-36284: QloApps 1.6.0 - SQL Injection
• CVE-2023-36287: Webkul QloApps 1.6.0 - Cross-site Scripting
• CVE-2023-36289: Webkul QloApps 1.6.0 - Cross-site Scripting
• CVE-2023-36306: Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting
• CVE-2023-36346: POS Codekop v2.0 - Cross Site Scripting
• CVE-2023-3643: CAREL Boss Mini <= 1.4.0 - Local File Inclusion
• CVE-2023-36845: Juniper J-Web - Remote Code Execution
• CVE-2023-36934: MOVEit Transfer - SQL Injection
• CVE-2023-3710: Honeywell PM43 Printers - Command Injection
• CVE-2023-3722: Avaya Aura Device Services - OS Command Injection
• CVE-2023-37462: XWiki Platform - Remote Code Execution
• CVE-2023-37474: Copyparty <= 1.8.2 - Directory Traversal
• CVE-2023-37580: Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting
• CVE-2023-37629: Online Piggery Management System v1.0 - Unauthenticated File Upload
• CVE-2023-37679: NextGen Mirth Connect - Remote Code Execution
• CVE-2023-37728: IceWarp Webmail Server v10.2.1 - Cross Site Scripting
• CVE-2023-37979: Ninja Forms < 3.6.26 - Cross-Site Scripting
• CVE-2023-37988: Contact Form Generator <= 2.5.5 - Cross-Site Scripting
• CVE-2023-38040: Revive Adserver 5.4.1 - Cross-Site Scripting
• CVE-2023-38192: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting
• CVE-2023-38194: SuperWebMailer - Cross-Site Scripting
• CVE-2023-38203: Adobe ColdFusion - Deserialization of Untrusted Data
• CVE-2023-3843: mooDating 1.2 - Cross-site scripting
• CVE-2023-3844: MooDating 1.2 - Cross-Site Scripting
• CVE-2023-3845: MooDating 1.2 - Cross-Site Scripting
• CVE-2023-3846: MooDating 1.2 - Cross-Site Scripting
• CVE-2023-3847: MooDating 1.2 - Cross-Site scripting
• CVE-2023-3848: MooDating 1.2 - Cross-site scripting
• CVE-2023-3849: mooDating 1.2 - Cross-site scripting
• CVE-2023-38501: CopyParty v1.8.6 - Cross Site Scripting
• CVE-2023-38875: PHP Login System 2.0.1 - Cross-Site Scripting
• CVE-2023-38879: openSIS v9.0 - Path Traversal
• CVE-2023-38910: CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
• CVE-2023-38911: CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
• CVE-2023-38950: ZKTeco BioTime v8.5.5 - Path Traversal
• CVE-2023-38964: Academy LMS 6.0 - Cross-Site Scripting
• CVE-2023-39026: FileMage Gateway - Directory Traversal
• CVE-2023-39108: rConfig 3.9.4 - Server-Side Request Forgery
• CVE-2023-39109: rConfig 3.9.4 - Server-Side Request Forgery
• CVE-2023-39110: rConfig 3.9.4 - Server-Side Request Forgery
• CVE-2023-39141: Aria2 WebUI - Path traversal
• CVE-2023-39143: PaperCut < 22.1.3 - Path Traversal
• CVE-2023-3936: Blog2Social < 7.2.1 - Cross-Site Scripting
• CVE-2023-39361: Cacti 1.2.24 - SQL Injection
• CVE-2023-39598: IceWarp Email Client - Cross Site Scripting
• CVE-2023-39600: IceWarp 11.4.6.0 - Cross-Site Scripting
• CVE-2023-39650: PrestaShop Theme Volty CMS Blog - SQL Injection
• CVE-2023-39676: PrestaShop fieldpopupnewsletter Module - Cross Site Scripting
• CVE-2023-39700: IceWarp Mail Server v10.4.5 - Cross-Site Scripting
• CVE-2023-39796: WBCE 1.6.0 - SQL Injection
• CVE-2023-3990: Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
• CVE-2023-40279: OpenClinic GA 5.247.01 - Path Traversal (Authenticated)
• CVE-2023-40504: LG Simple Editor <= v3.21.0 - Command Injection
• CVE-2023-40600: EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure
• CVE-2023-40748: PHPJabbers Food Delivery Script - SQL Injection
• CVE-2023-40749: PHPJabbers Food Delivery Script v3.0 - SQL Injection
• CVE-2023-40750: PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting
• CVE-2023-40751: PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting
• CVE-2023-40752: PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting
• CVE-2023-40753: PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting
• CVE-2023-40755: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting
• CVE-2023-40924: SolarView Compact < 6.00 - Directory Traversal
• CVE-2023-4110: PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting
• CVE-2023-41109: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection
• CVE-2023-4111: PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting
• CVE-2023-4112: PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting
• CVE-2023-4113: PHPJabbers Service Booking Script 1.0 - Cross Site Scripting
• CVE-2023-4114: PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting
• CVE-2023-4115: PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting
• CVE-2023-4116: PHPJabbers Taxi Booking 2.0 - Cross Site Scripting
• CVE-2023-4136: CrafterCMS Engine - Cross-Site Scripting
• CVE-2023-4148: Ditty < 3.1.25 - Cross-Site Scripting
• CVE-2023-4151: Store Locator WordPress < 1.4.13 - Cross-Site Scripting
• CVE-2023-41538: PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting
• CVE-2023-41597: EyouCms v1.6.2 - Cross-Site Scripting
• CVE-2023-41599: JFinalCMS v5.0.0 - Directory Traversal
• CVE-2023-41621: Emlog Pro v2.1.14 - Cross-Site Scripting
• CVE-2023-4169: Ruijie RG-EW1200G Router - Password Reset
• CVE-2023-4173: mooSocial 3.1.8 - Reflected XSS
• CVE-2023-4174: mooSocial 3.1.6 - Reflected Cross Site Scripting
• CVE-2023-41892: CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution
• CVE-2023-42343: OpenCMS - Cross-Site Scripting
• CVE-2023-4284: WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting
• CVE-2023-43208: NextGen Healthcare Mirth Connect - Remote Code Execution
• CVE-2023-43261: Milesight Routers - Information Disclosure
• CVE-2023-43325: MooSocial 3.1.8 - Cross-Site Scripting
• CVE-2023-43326: MooSocial 3.1.8 - Cross-Site Scripting
• CVE-2023-43373: Hoteldruid v3.0.5 - SQL Injection
• CVE-2023-43374: Hoteldruid v3.0.5 - SQL Injection
• CVE-2023-43662: ShokoServer System - Local File Inclusion (LFI)
• CVE-2023-4382: Hyip Rio 2.1 - Arbitrary File Upload
• CVE-2023-44012: mojoPortal v.2.7.0.0 - Cross-Site Scripting
• CVE-2023-4415: Ruijie RG-EW1200G Router Background - Login Bypass
• CVE-2023-44352: Adobe Coldfusion - Cross-Site Scripting
• CVE-2023-44353: Adobe ColdFusion WDDX Deserialization Gadgets
• CVE-2023-44393: Piwigo - Cross-Site Scripting
• CVE-2023-4451: Cockpit - Cross-Site Scripting
• CVE-2023-44812: mooSocial v.3.1.8 - Cross-Site Scripting
• CVE-2023-4490: WordPress Job Portal < 2.0.6 - SQL Injection
• CVE-2023-44982: WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
• CVE-2023-45136: XWiki < 14.10.14 - Cross-Site Scripting
• CVE-2023-45375: PrestaShop PireosPay - SQL Injection
• CVE-2023-4547: SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting
• CVE-2023-45542: MooSocial 3.1.8 - Cross-Site Scripting
• CVE-2023-45671: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
• CVE-2023-45826: Leantime < 2.4 - Authenticated SQL Injection
• CVE-2023-45852: Viessmann Vitogate 300 - Remote Code Execution
• CVE-2023-46020: Blood Bank v1.0 - Stored Cross Site Scripting (XSS)
• CVE-2023-46022: Blood Bank 1.0 - 'bid' SQLi
• CVE-2023-46347: PrestaShop Step by Step products Pack - SQL Injection
• CVE-2023-46359: cPH2 Charging Station v1.87.0 - OS Command Injection
• CVE-2023-46391: WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS)
• CVE-2023-46574: TOTOLINK A3700R - Command Injection
• CVE-2023-46732: XWiki < 14.10.14 - Cross-Site Scripting
• CVE-2023-46747: F5 BIG-IP - Unauthenticated RCE via AJP Smuggling
• CVE-2023-47105: Chaosblade < 1.7.4 - Remote Code Execution
• CVE-2023-47218: QNAP QTS and QuTS Hero - OS Command Injection
• CVE-2023-47246: SysAid Server - Remote Code Execution
• CVE-2023-47684: Essential Grid <= 3.1.0 - Cross-Site Scripting
• CVE-2023-47873: WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload
• CVE-2023-48022: Anyscale Ray - Remote Code Execution
• CVE-2023-48084: Nagios XI < 5.11.3 - SQL Injection
• CVE-2023-48241: XWiki < 4.10.15 - Information Disclosure
• CVE-2023-48728: WWBN AVideo 11.6 - Cross-Site Scripting
• CVE-2023-48777: WordPress Elementor 3.18.1 - File Upload/Remote Code Execution
• CVE-2023-49230: Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload
• CVE-2023-49293: Vite dev server - Cross-Site Scripting
• CVE-2023-49489: KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)
• CVE-2023-49494: DedeCMS v5.7.111 - Cross-Site Scripting
• CVE-2023-4973: Academy LMS 6.2 - Cross-Site Scripting
• CVE-2023-4974: Academy LMS 6.2 - SQL Injection
• CVE-2023-50094: reNgine 2.2.0 - Command Injection
• CVE-2023-50839: JS Help Desk <= 2.8.1 - SQL Injection
• CVE-2023-50917: MajorDoMo thumb.php - OS Command Injection
• CVE-2023-5203: WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection
• CVE-2023-5204: WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection
• CVE-2023-52163: Digiever DS-2105 Pro - Command Injection
• CVE-2023-5244: Microweber < V.2.0 - Cross-Site Scripting
• CVE-2023-5558: LearnPress < 4.2.5.5 - Cross-Site Scripting
• CVE-2023-5652: WP Hotel Booking <= 2.0.7 - SQL Injection
• CVE-2023-5815: News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion
• CVE-2023-5863: phpMyFAQ < 3.2.0 - Cross-site Scripting
• CVE-2023-5991: Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion
• CVE-2023-6020: Ray Static File - Local File Inclusion
• CVE-2023-6023: VertaAI ModelDB - Path Traversal
• CVE-2023-6030: LogDash Activity Log <= 1.1.3 - SQL Injection
• CVE-2023-6038: H2O ImportFiles - Local File Inclusion
• CVE-2023-6063: WP Fastest Cache 1.2.2 - Unauthenticated SQL Injection
• CVE-2023-6275: TOTVS Fluig Platform - Cross-Site Scripting
• CVE-2023-6360: WordPress My Calendar <3.4.22 - SQL Injection
• CVE-2023-6379: OpenCMS 14 & 15 - Cross Site Scripting
• CVE-2023-6567: LearnPress <= 4.2.5.7 - SQL Injection
• CVE-2023-6568: Mlflow - Cross-Site Scripting
• CVE-2023-6623: Essential Blocks < 4.4.3 - Local File Inclusion
• CVE-2023-6655: Hongjing e-HR 2020 - SQL Injection
• CVE-2023-6697: WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting
• CVE-2023-6750: WordPress WP Clone <= 2.4.2 - Database Backup Exposure
• CVE-2023-6825: WordPress File Manager <= 7.2.1 - Directory Traversal
• CVE-2023-6831: mlflow - Path Traversal
• CVE-2023-6909: Mlflow <2.9.2 - Path Traversal
• CVE-2023-6977: Mlflow <2.8.0 - Local File Inclusion
• CVE-2023-6989: Shield Security WP Plugin <= 18.5.9 - Local File Inclusion
• CVE-2023-7116: WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection
• CVE-2023-7137: Client Details System 1.0 - SQL Injection
• CVE-2023-7246: System Dashboard < 2.8.10 - Cross-Site Scripting
• CVE-2023-7327: Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read
• CVE-2024-0195: SpiderFlow Crawler Platform - Remote Code Execution
• CVE-2024-0250: Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect
• CVE-2024-0705: Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
• CVE-2024-0986: Issabel Authenticated - Remote Code Execution
• CVE-2024-10081: CodeChecker <= 6.24.1 - Authentication Bypass
• CVE-2024-10146: Simple File List < 6.1.13 - Reflected Cross-Site Scripting
• CVE-2024-10152: Simple Certain Time to Show Content - Cross-Site Scripting
• CVE-2024-10571: Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion
• CVE-2024-1061: WordPress HTML5 Video Player - SQL Injection
• CVE-2024-10708: System Dashboard < 2.8.15 - Admin+ Path Traversal
• CVE-2024-10758: NEWS-BUZZ News Management System 1.0 - SQL Injection
• CVE-2024-10763: WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion
• CVE-2024-10914: D-Link NAS - Command Injection via Name Parameter
• CVE-2024-10915: D-Link NAS - Command Injection via Group Parameter
• CVE-2024-11303: Korenix JetPort 5601v3 - Path Traversal
• CVE-2024-11305: Altenergy Power Control Software - SQL Injection
• CVE-2024-11587: idcCMS V1.60 - Cross-Site Scripting
• CVE-2024-11740: Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
• CVE-2024-11921: Give WP Plugin < 3.19.0 - Cross-Site Scripting
• CVE-2024-12008: W3 Total Cache < 2.8.2 - Log File Exposure
• CVE-2024-12025: WordPress Collapsing Categories <= 3.0.8 - SQL Injection
• CVE-2024-12209: WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion
• CVE-2024-12585: PropertyHive < 2.1.1 - Cross-Site Scripting
• CVE-2024-12638: Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting
• CVE-2024-12732: AffiliateImporterEb <= 1.0.6 - Reflected XSS
• CVE-2024-12734: Advance Post Prefix WordPress plugin - Reflected XSS
• CVE-2024-12737: WP BASE Booking - Reflected XSS
• CVE-2024-12749: WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting
• CVE-2024-12849: Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read
• CVE-2024-12873: Custom Field Manager WordPress - Cross-Site Scripting
• CVE-2024-12878: Lazy Blocks <= 3.8.2 - Cross-Site Scripting
• CVE-2024-12987: DrayTek Vigor - Command Injection
• CVE-2024-13055: Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting
• CVE-2024-13094: WP Triggers Lite - Cross-Site Scripting
• CVE-2024-13097: WP Finance Plugin <= 1.3.6 - Cross-Site Scripting
• CVE-2024-13098: WordPress Email Newsletter - Reflected XSS
• CVE-2024-13099: Widget4Call WordPress - Cross-Site Scripting
• CVE-2024-13112: WP MediaTagger <= 4.1.1 - Cross-Site Scripting
• CVE-2024-13114: WP Projects Portfolio <= 3.0 - Cross-Site Scripting
• CVE-2024-13219: Privacy Policy Genius - Cross-Site Scripting
• CVE-2024-13220: WordPress Google Map Professional - Cross-Site Scripting
• CVE-2024-13221: Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting
• CVE-2024-13224: SlideDeck 1 Lite Content Slider - Cross-Site Scripting
• CVE-2024-13225: ECT Home Page Products - Reflected XSS
• CVE-2024-13226: A5 Custom Login Page - Reflected XSS
• CVE-2024-13322: Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection
• CVE-2024-13325: Glossy WordPress - Reflected XSS
• CVE-2024-13326: iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting
• CVE-2024-13327: Musicbox WordPress - Reflected XSS
• CVE-2024-13330: JustRows WordPress - Cross-Site Scripting
• CVE-2024-13331: WP Dream Carousel < 1.0.1b - Cross-Site Scripting
• CVE-2024-13492: Guten Free Options - Cross Site Scripting
• CVE-2024-13543: Zarinpal Paid Download - Reflected XSS
• CVE-2024-13569: WordPress Front End Users - Reflected XSS
• CVE-2024-13570: WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting
• CVE-2024-13609: WordPress 1 Click Migration Plugin < 2.3 - Information Exposure
• CVE-2024-13619: LifterLMS < 8.0.1 - Cross-Site Scripting
• CVE-2024-13624: WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting
• CVE-2024-13627: OWL Carousel Slider - Cross-Site Scripting
• CVE-2024-13628: WP Pricing Table - Reflected XSS
• CVE-2024-13630: NewsTicker <= 1.0 - Reflected Cross-Site Scripting
• CVE-2024-13634: Post Sync Plugin <= 1.1 - Cross-Site Scripting
• CVE-2024-13726: Themes Coder Ecommerce <= 1.3.4 - SQL Injection
• CVE-2024-13727: MemberSpace WordPress - Cross-Site Scripting
• CVE-2024-13853: WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting
• CVE-2024-14015: Studiocart <= 2.9.0 - Cross-Site Scripting
• CVE-2024-1483: Mlflow < 2.9.2 - Path Traversal
• CVE-2024-1512: MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection
• CVE-2024-1561: Gradio 4.3-4.12 - Local File Read
• CVE-2024-1698: NotificationX <= 2.8.2 - SQL Injection
• CVE-2024-1728: Gradio > 4.19.1 UploadButton - Path Traversal
• CVE-2024-20404: Cisco Finesse - Server-Side Request Forgery (SSRF)
• CVE-2024-20440: Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials
• CVE-2024-21136: Oracle Retail Xstore Suite - Pre-authenticated Path Traversal
• CVE-2024-21485: Dash Framework - Cross-site Scripting
• CVE-2024-21650: XWiki < 4.10.20 - Remote code execution
• CVE-2024-21893: Ivanti SAML - Server Side Request Forgery (SSRF)
• CVE-2024-22024: Ivanti Connect Secure - XXE
• CVE-2024-22476: Intel Neural Compressor <2.5.0 - SQL Injection
• CVE-2024-22729: Netis MW5360 V1.0.1.3031 - Command Injection
• CVE-2024-23167: GestSup - Cross-Site Scripting
• CVE-2024-2330: NS-ASG Application Security Gateway 6.3 - Sql Injection
• CVE-2024-23334: aiohttp - Directory Traversal
• CVE-2024-23692: Rejetto HTTP File Server - Template injection
• CVE-2024-2389: Progress Kemp Flowmon - Command Injection
• CVE-2024-24050: Workout Journal App 1.0 - Stored XSS
• CVE-2024-24112: Exrick XMall - SQL Injection
• CVE-2024-24131: SuperWebMailer 9.31.0.01799 - Cross-Site Scripting
• CVE-2024-24328: TotoLink Router setMacFilterRules - Command Injection
• CVE-2024-24329: TotoLink Router setPortForwardRules - Command Injection
• CVE-2024-24494: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
• CVE-2024-24495: Daily Habit Tracker 1.0 - SQL Injection
• CVE-2024-24497: Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login)
• CVE-2024-24565: CrateDB Database - Arbitrary File Read
• CVE-2024-2473: WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
• CVE-2024-24919: Check Point Quantum Gateway - Information Disclosure
• CVE-2024-25669: CaseAware a360inc - Cross-Site Scripting
• CVE-2024-2621: Fujian Kelixin Communication - Command Injection
• CVE-2024-26291: Avid NEXIS Agent - Arbitrary File Read
• CVE-2024-2667: InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
• CVE-2024-27292: Docassemble - Local File Inclusion
• CVE-2024-27564: ChatGPT个人专用版 - Server Side Request Forgery
• CVE-2024-27954: WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF
• CVE-2024-27956: WordPress Automatic Plugin <= 3.92.0 - SQL Injection
• CVE-2024-28397: pyload-ng js2py - Remote Code Execution
• CVE-2024-28734: Coda v.2024Q1 - Cross-Site Scripting
• CVE-2024-2876: Wordpress Email Subscribers by Icegram Express - SQL Injection
• CVE-2024-2879: WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
• CVE-2024-28995: SolarWinds Serv-U - Directory Traversal
• CVE-2024-29138: WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
• CVE-2024-2928: MLflow < 2.11.3 - Path Traversal
• CVE-2024-29792: Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
• CVE-2024-29824: Ivanti EPM - Remote Code Execution
• CVE-2024-29931: WP Go Maps <= 9.0.29 - Cross-Site Scripting
• CVE-2024-30163: IPS Community Suite - Unauthenticated SQL Injection
• CVE-2024-30188: Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write
• CVE-2024-30194: Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting
• CVE-2024-3032: WordPress Themify Builder < 7.5.8 - Open Redirect
• CVE-2024-30464: WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization
• CVE-2024-30490: ProfileGrid <= 5.7.8 - SQL Injection
• CVE-2024-30498: CRM Perks Forms <= 1.1.4 - SQL Injection
• CVE-2024-31750: F-logic DataCube3 - SQL Injection
• CVE-2024-31848: CData API Server < 23.4.8844 - Path Traversal
• CVE-2024-31849: CData Connect < 23.4.8846 - Path Traversal
• CVE-2024-31850: CData Arc < 23.4.8839 - Path Traversal
• CVE-2024-31851: CData Sync < 23.4.8843 - Path Traversal
• CVE-2024-32128: WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection
• CVE-2024-32231: Stash < 0.26.0 - SQL Injection
• CVE-2024-3231: Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
• CVE-2024-32709: WP-Recall <= 16.26.5 - SQL Injection
• CVE-2024-32736: CyberPower < v2.8.3 - SQL Injection
• CVE-2024-32737: CyberPower - SQL Injection
• CVE-2024-32738: CyberPower - SQL Injection
• CVE-2024-32739: CyberPower < v2.8.3 - SQL Injection
• CVE-2024-33113: D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure
• CVE-2024-33288: Prison Management System - SQL Injection Authentication Bypass
• CVE-2024-33326: LumisXP - Cross-site Scripting
• CVE-2024-33724: SOPlanning 1.52.00 Cross Site Scripting
• CVE-2024-34061: Changedetection.io <=v0.45.21 - Cross-Site Scripting
• CVE-2024-34257: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection
• CVE-2024-34470: HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion
• CVE-2024-3469: GP Premium <= 2.4.0 - Cross-Site Scripting
• CVE-2024-35219: OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete
• CVE-2024-3552: Web Directory Free < 1.7.0 - SQL Injection
• CVE-2024-35584: openSIS < 9.1 - SQL Injection
• CVE-2024-35693: WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting
• CVE-2024-35694: Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting
• CVE-2024-3605: WP Hotel Booking <= 2.1.0 - SQL Injection
• CVE-2024-36412: SuiteCRM - SQL Injection
• CVE-2024-36420: Flowise 1.4.3 - Arbitrary File Read
• CVE-2024-36527: Puppeteer Renderer - Directory Traversal
• CVE-2024-36597: AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability.
• CVE-2024-36683: PrestaShop productsalert - SQL Injection
• CVE-2024-3673: Web Directory Free < 1.7.3 - Local File Inclusion
• CVE-2024-36837: CRMEB v.5.2.2 - SQL Injection
• CVE-2024-36991: Splunk Enterprise - Local File Inclusion
• CVE-2024-37259: WP Extended < 3.0.0 - Stored Cross-Site Scripting
• CVE-2024-37261: WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting
• CVE-2024-37393: SecurEnvoy Two Factor Authentication - LDAP Injection
• CVE-2024-3753: Hostel < 1.1.5.3 - Cross-Site Scripting
• CVE-2024-37843: Craft CMS <=v3.7.31 - SQL Injection
• CVE-2024-38289: TurboMeeting - Boolean-based SQL Injection
• CVE-2024-38473: Apache HTTP Server - ACL Bypass
• CVE-2024-3848: Mlflow < 2.11.0 - Path Traversal
• CVE-2024-38773: FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection
• CVE-2024-38816: WebMvc.fn/WebFlux.fn - Path Traversal
• CVE-2024-38819: Spring Framework Path Traversal in Functional Web Frameworks
• CVE-2024-3922: Dokan Pro <= 3.10.3 - SQL Injection
• CVE-2024-39646: WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS
• CVE-2024-39907: 1Panel SQL Injection - Authenticated
• CVE-2024-39914: FOG Project < 1.5.10.34 - Remote Command Execution
• CVE-2024-40348: Bazarr < 1.4.3 - Arbitrary File Read
• CVE-2024-4040: CrushFTP VFS - Sandbox Escape LFR
• CVE-2024-40422: Devika v1 - Path Traversal
• CVE-2024-41357: phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)
• CVE-2024-41628: Cluster Control CMON API - Directory Traversal
• CVE-2024-41667: OpenAM<=15.0.3 FreeMarker - Template Injection
• CVE-2024-41810: Twisted - Open Redirect & XSS
• CVE-2024-4257: BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection
• CVE-2024-43360: ZoneMinder - SQL Injection
• CVE-2024-4348: osCommerce v4.0 - Cross-site Scripting
• CVE-2024-43687: Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)
• CVE-2024-43971: Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting
• CVE-2024-44000: LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure
• CVE-2024-4439: WordPress Core <6.5.2 - Cross-Site Scripting
• CVE-2024-4443: Business Directory Plugin <= 6.4.2 - SQL Injection
• CVE-2024-4455: YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting
• CVE-2024-45241: CentralSquare CryWolf - Path Traversal
• CVE-2024-45293: TablePress < 2.4.3 - XXE Injection
• CVE-2024-45388: Hoverfly < 1.10.3 - Arbitrary File Read
• CVE-2024-45507: Apache OFBiz - Remote Code Execution
• CVE-2024-45622: ASIS - SQL Injection Authentication Bypass
• CVE-2024-4577: PHP CGI - Argument Injection
• CVE-2024-4620: ArForms < 6.6 - Remote Code Execution
• CVE-2024-46507: Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE
• CVE-2024-46938: Sitecore Experience Platform <= 10.4 - Arbitrary File Read
• CVE-2024-47374: LiteSpeed Cache <= 6.5.0.2 - Stored XSS
• CVE-2024-48120: X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
• CVE-2024-48248: NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
• CVE-2024-48259: Cloudlog - SQL Injection
• CVE-2024-48307: JeecgBoot v3.7.1 - SQL Injection
• CVE-2024-4841: LoLLMS WebUI - Subfolder Prediction via Path Traversal
• CVE-2024-48766: NetAlert X - Arbitary File Read
• CVE-2024-4879: ServiceNow UI Macros - Template Injection
• CVE-2024-4956: Sonatype Nexus Repository Manager 3 - Local File Inclusion
• CVE-2024-50498: WP Query Console <= 1.0 - Remote Code Execution
• CVE-2024-5057: WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
• CVE-2024-50603: Aviatrix Controller - Remote Code Execution
• CVE-2024-51211: openSIS Classic v9.1 - SQL Injection
• CVE-2024-51482: ZoneMinder v1.37.* <= 1.37.64 - SQL Injection
• CVE-2024-51483: Changedetection.io <= 0.47.4 - Path Traversal
• CVE-2024-51977: Brother MFC-L9570CDW - Information Disclosure
• CVE-2024-51978: Brother Printers – Authentication Bypass via Default Admin Password
• CVE-2024-5217: ServiceNow - Incomplete Input Validation
• CVE-2024-5276: Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection
• CVE-2024-52762: Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting
• CVE-2024-52763: Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting
• CVE-2024-52875: Kerio Control v9.2.5 - CRLF Injection
• CVE-2024-5334: Devika - Local File Inclusion
• CVE-2024-53537: OpenPanel 0.3.4 - Directory Traversal
• CVE-2024-53584: OpenPanel 0.3.4 - OS Command Injection
• CVE-2024-53586: WebFileSys 2.31.0 - Directory Path Traversal
• CVE-2024-53900: Mongoose < 8.8.3 - Remote Code Execution
• CVE-2024-5420: SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting
• CVE-2024-55218: IceWarp Server 10.2.1 - Cross-Site Scripting
• CVE-2024-5522: WordPress HTML5 Video Player < 2.5.27 - SQL Injection
• CVE-2024-55457: MasterSAM Star Gate v11 - Local File Inclusion
• CVE-2024-5765: WpStickyBar <= 2.1.0 - SQL Injection
• CVE-2024-5827: Vanna - SQL injection
• CVE-2024-5975: CZ Loan Management <= 1.1 - SQL Injection
• CVE-2024-6049: Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal
• CVE-2024-6095: LocalAI - Partial Local File Read
• CVE-2024-6159: Push Notification for Post and BuddyPress <= 1.93 - SQL Injection
• CVE-2024-6205: PayPlus Payment Gateway < 6.6.9 - SQL Injection
• CVE-2024-6250: LOLLMS WebUI - Absolute Path Traversal
• CVE-2024-6265: UsersWP <= 1.2.10 - Unauthenticated SQL Injection
• CVE-2024-6460: WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion
• CVE-2024-6587: LiteLLM - Server-Side Request Forgery
• CVE-2024-6651: WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting
• CVE-2024-6670: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass
• CVE-2024-6671: WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass
• CVE-2024-6753: Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting
• CVE-2024-6892: Journyx 11.5.4 - Reflected Cross Site Scripting
• CVE-2024-6893: Journyx - XML External Entities Injection (XXE)
• CVE-2024-6911: PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion
• CVE-2024-6924: TrueBooker <= 1.0.2 - SQL Injection
• CVE-2024-6926: Viral Signup <= 2.1 - SQL Injection
• CVE-2024-6928: Opti Marketing <= 2.0.9 - SQL Injection
• CVE-2024-7029: AVTECH IP Camera - Command Injection
• CVE-2024-7120: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
• CVE-2024-7188: Bylancer Quicklancer 2.4 G - SQL Injection
• CVE-2024-7313: Shield Security Plugin < 20.0.6 - Cross-Site Scripting
• CVE-2024-7332: TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability
• CVE-2024-7339: TVT DVR Sensitive Device - Information Disclosure
• CVE-2024-7340: W&B Weave Server - Remote Arbitrary File Leak
• CVE-2024-7354: Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting
• CVE-2024-7593: Ivanti vTM - Authentication Bypass
• CVE-2024-7801: Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection
• CVE-2024-7854: Woo Inquiry <= 0.1 - SQL Injection
• CVE-2024-7928: FastAdmin < V1.3.4.20220530 - Path Traversal
• CVE-2024-7954: SPIP Porte Plume Plugin - Remote Code Execution
• CVE-2024-8252: WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
• CVE-2024-8484: REST API TO MiniProgram <= 4.7.1 - SQL Injection
• CVE-2024-8522: LearnPress < 4.2.7.1 - SQL Injection
• CVE-2024-8529: LearnPress < 4.2.7.1 - SQL Injection
• CVE-2024-8673: Z-Downloads < 1.11.7 - Cross-Site Scripting
• CVE-2024-8752: WebIQ 2.15.9 - Directory Traversal
• CVE-2024-8852: All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure
• CVE-2024-8877: Riello Netman 204 - SQL Injection
• CVE-2024-8911: LatePoint <= 5.0.11 - SQL Injection
• CVE-2024-9007: 123Solar 1.8.4.5 - Cross-Site Scripting
• CVE-2024-9047: WordPress File Upload <= 4.24.11 - Arbitrary File Read
• CVE-2024-9054: Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection
• CVE-2024-9166: TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution
• CVE-2024-9186: Automation By Autonami < 3.3.0 - SQL Injection
• CVE-2024-9193: WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update
• CVE-2024-9234: GutenKit <= 2.1.0 - Arbitrary File Upload
• CVE-2024-9264: Grafana Post-Auth DuckDB - SQL Injection To File Read
• CVE-2024-9362: Polyaxon - Unauthenticated Directory Traversal
• CVE-2024-9463: PaloAlto Networks Expedition - Remote Code Execution
• CVE-2024-9474: PAN-OS Management Web Interface - Command Injection
• CVE-2024-9765: EKC Tournament Manager WordPress plugin - Path Traversal
• CVE-2024-9935: PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download
• CVE-2025-0133: PAN-OS - Reflected Cross-Site Scripting
• CVE-2025-10090: Jinher OA - SQL Injection
• CVE-2025-10162: WordPress OrderConvo < 14 - Path Traversal
• CVE-2025-10210: ChanCMS <= 3.3.0 - SQL Injection
• CVE-2025-1023: ChurchCRM - SQL Injection
• CVE-2025-1035: KLog Server - Path Traversal
• CVE-2025-10493: Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
• CVE-2025-10897: WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read
• CVE-2025-11368: LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure
• CVE-2025-11371: Gladinet CentreStack & TrioFox - Local File Inclusion
• CVE-2025-11833: Post SMTP <= 3.6.0 - Email Log Disclosure
• CVE-2025-12055: MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal
• CVE-2025-1302: JSONPath Plus < 10.3.0 - Remote Code Execution
• CVE-2025-1303: Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting
• CVE-2025-13138: WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection
• CVE-2025-13339: Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
• CVE-2025-13418: Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
• CVE-2025-13486: Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution
• CVE-2025-13652: WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
• CVE-2025-13801: Yoco Payments <= 3.8.8 - Path Traversal
• CVE-2025-14340: Payara Server - Cross-Site Scripting
• CVE-2025-14437: WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
• CVE-2025-14528: D-Link DIR-803 - Authentication Bypass
• CVE-2025-1562: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
• CVE-2025-1661: HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
• CVE-2025-1743: Pichome 2.1.0 - Arbitrary File Read
• CVE-2025-2011: Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection
• CVE-2025-20281: Cisco ISE - Remote Code Execution
• CVE-2025-2075: Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• CVE-2025-2127: JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS
• CVE-2025-22214: Landray EIS SQL注入漏洞
• CVE-2025-22785: Course Booking System <= 6.0.6 - SQL Injection
• CVE-2025-2294: Kubio AI Page Builder <= 2.5.1 - Local File Inclusion
• CVE-2025-2473: Company Visitor Management System 1.0 - SQL Injection
• CVE-2025-24799: GLPI < 10.0.17 - Pre-Auth SQL Injection
• CVE-2025-24813: Apache Tomcat Path Equivalence - Remote Code Execution
• CVE-2025-24893: XWiki Platform - Remote Code Execution
• CVE-2025-24963: Vitest Browser Mode - Local File Read
• CVE-2025-25034: SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
• CVE-2025-25231: Omnissa Workspace ONE UEM - Path Traversal
• CVE-2025-25257: Fortinet FortiWeb - SQL Injection
• CVE-2025-25296: Label Studio < 1.16.0 - Cross-Site Scripting
• CVE-2025-2558: WordPress The Wound Theme <= 0.0.1 - Local File Inclusion
• CVE-2025-2609: MagnusBilling Login Logs - Cross-Site Scripting
• CVE-2025-2636: InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion
• CVE-2025-2709: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
• CVE-2025-2710: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
• CVE-2025-2711: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
• CVE-2025-2712: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
• CVE-2025-27222: TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
• CVE-2025-27506: NocoDB < 0.258.0 - Reflected XSS in Password Reset
• CVE-2025-27817: Apache Kafka Client - Arbitrary File Read
• CVE-2025-28367: mojoPortal <=2.9.0.1 - Directory Traversal
• CVE-2025-28906: Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CVE-2025-29085: Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component
• CVE-2025-29306: FoxCMS v.1.2.5 - Remote Code Execution
• CVE-2025-29635: D-Link DIR-823X set_prohibiting - Command Injection
• CVE-2025-30208: Vite - Arbitrary File Read
• CVE-2025-30567: WordPress WP01 - Path Traversal
• CVE-2025-31125: Vite Development Server - Path Traversal
• CVE-2025-31131: Yeswiki < 4.5.2 - Unauthenticated Path Traversal
• CVE-2025-31324: SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
• CVE-2025-31486: Vite server.fs.deny Bypass - Local File Inclusion
• CVE-2025-32101: UNA CMS <= 14.0.0-RC4 - PHP Object Injection
• CVE-2025-32257: 1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure
• CVE-2025-32430: XWiki Platform - Cross-Site Scripting
• CVE-2025-3248: Langflow AI - Unauthenticated Remote Code Execution
• CVE-2025-32614: EventON Lite <= 2.4 - Authenticated Local File Inclusion
• CVE-2025-32778: Web-Check < 2.0.1 Screenshot API - OS Command Injection
• CVE-2025-32813: Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request
• CVE-2025-32814: NetMRI Unauthenticated SQL Injection via skipjackUsername
• CVE-2025-32815: NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials
• CVE-2025-32969: XWiki REST API Query - SQL Injection
• CVE-2025-32970: XWiki WYSIWYG API - Open Redirect
• CVE-2025-34023: Karel IP Phone IP1211 Web Management Panel - Local File Inclusion
• CVE-2025-34030: sar2html <=3.2.2 Plot Parameter - Remote Code Execution
• CVE-2025-34031: Moodle Jmol Filter 6.1 - Local File Inclusion
• CVE-2025-34032: Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting
• CVE-2025-34035: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
• CVE-2025-34040: Zhiyuan OA - arbitrary file upload leading
• CVE-2025-34045: WeiPHP 5.0 - Path Traversal
• CVE-2025-34073: Maltrail <=0.54 Username Parameter - Remote Command Execution
• CVE-2025-34085: WordPress Simple File List <=4.2.2 - Remote Code Execution
• CVE-2025-34141: ETQ Reliance - Reflected XSS via SQLConverterServlet
• CVE-2025-34152: Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
• CVE-2025-4008: MeteoBridge <= 6.1 - Remote Code Execution
• CVE-2025-40552: SolarWinds Web Help Desk - Authentication Bypass
• CVE-2025-4078: Wangshen SecGate 3600 Path Traversal Vulnerability
• CVE-2025-41228: VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
• CVE-2025-41242: Spring Framework - Path Traversal
• CVE-2025-41393: Ricoh Web Image Monitor - Reflected XSS
• CVE-2025-4388: Liferay Portal - Cross-Site Scripting
• CVE-2025-4396: Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection
• CVE-2025-44136: MapTiler Tileserver-php v2.0 - Unauthenticated XSS
• CVE-2025-44137: MapTiler Tileserver-php v2.0 - Unauthenticated File Read
• CVE-2025-44148: MailEnable Mail Service < v10 - Cross-Site Scripting
• CVE-2025-44177: White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)
• CVE-2025-4427: Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
• CVE-2025-4524: WordPress Madara - Local File Inclusion
• CVE-2025-4576: Liferay Portal & DXP - Cross-Site Scripting
• CVE-2025-45854: JEHC-BPM - Remote Code Execute
• CVE-2025-45985: Blink Router - Command Injection
• CVE-2025-46349: YesWiki Reflected XSS via File Upload
• CVE-2025-4652: Broadstreet WordPress plugin - Reflected XSS
• CVE-2025-46549: YesWiki <= 4.5.1 - Cross-Site Scripting
• CVE-2025-46550: YesWiki < 4.5.4 - Cross-Site Scripting
• CVE-2025-46565: Vite Dev Server - Information Exposure
• CVE-2025-46822: Java-springboot-codebase 1.1 - Arbitrary File Read
• CVE-2025-47204: Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
• CVE-2025-47423: Personal Weather Station Dashboard 12 - Directory Traversal
• CVE-2025-47445: WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download
• CVE-2025-47783: Label Studio < 1.18.0 - Reflected XSS
• CVE-2025-47812: Wing FTP Server <= 7.4.3 - Remote Code Execution
• CVE-2025-48157: WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
• CVE-2025-48281: MyStyle Custom Product Designer <= 3.21.1 - SQL Injection
• CVE-2025-48828: vBulletin replaceAdTemplate - Remote Code Execution
• CVE-2025-48954: Discourse OAuth Social Login - Cross-site Scripting
• CVE-2025-49002: DataEase - Remote Code Execution
• CVE-2025-49029: WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
• CVE-2025-49132: Pterodactyl Panel - Remote Code Execution
• CVE-2025-5086: Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization
• CVE-2025-52472: XWiki - HQL Injection
• CVE-2025-5287: Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
• CVE-2025-52970: Fortinet FortiWeb - Authentication Bypass to Admin Privilege
• CVE-2025-5298: Campcodes Online Hospital Management System 1.0 - SQL Injection
• CVE-2025-5301: ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting
• CVE-2025-53533: Pi-hole Reflected XSS in 404-Error Page
• CVE-2025-53770: Microsoft SharePoint Server - Remote Code Execution (ToolShell)
• CVE-2025-53771: Microsoft SharePoint Server - Authentication Bypass (ToolShell)
• CVE-2025-53833: LaRecipe < 2.8.1 Remote Code Execution via SSTI
• CVE-2025-54249: Adobe Experience Manager ≤ 6.5.23.0 – SSRF
• CVE-2025-54589: Copyparty <=1.18.6 - Cross-Site Scripting
• CVE-2025-54597: Heimdall Application Dashboard < 2.7.3 - Reflected XSS
• CVE-2025-54726: WordPress JS Archive List <= 6.1.5 - SQL Injection
• CVE-2025-54782: NestJS DevTools Integration - Remote Code Execution
• CVE-2025-55169: WeGIA - Directory Traversal
• CVE-2025-55182: React Server Components - Remote Code Execution
• CVE-2025-55523: Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download
• CVE-2025-5569: IdeaCMS <= 1.7 - SQL Injection
• CVE-2025-55748: XWiki Platform - Path Traversal
• CVE-2025-55911: ClipBucket 5.5.2 Build
• CVE-2025-57819: FreePBX - Remote Code Execution
• CVE-2025-59049: Mockoon < 9.2.0 - Path Traversal
• CVE-2025-59341: esm.sh <= v136 - Local File Inclusion
• CVE-2025-59342: esm.sh <= v136 - Arbitrary File Write via Path Traversal
• CVE-2025-59528: Flowise - Remote Code Execution
• CVE-2025-5961: WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
• CVE-2025-6058: WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
• CVE-2025-61224: DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting
• CVE-2025-61666: Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion
• CVE-2025-6174: WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)
• CVE-2025-61884: Oracle E-Business Suite - Server-Side Request Forgery
• CVE-2025-62613: VDO.Ninja - DOM-Based Cross-Site Scripting
• CVE-2025-6403: Code-Projects School Fees Payment System 1.0 - SQL Injection
• CVE-2025-66744: Yonyou YonBIP - Path Traversal
• CVE-2025-69411: ionCube Tester Plus <= 1.3 - Local File Inclusion
• CVE-2025-6970: WordPress Events Manager <= 7.0.3 - SQL Injection
• CVE-2025-7160: Zoo Management System 1.0 - SQL Injection
• CVE-2025-8266: ChanCMS <= 3.1. - Remote Code Execution
• CVE-2025-9744: Loan Management System 1.0 - SQL Injection
• CVE-2025-9985: Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
• CVE-2026-0560: LolLMS < 2.2.0 - Server-Side Request Forgery
• CVE-2026-11111: CVE-2026-11111 Research Note
• CVE-2026-1207: Django RasterField - SQL Injection
• CVE-2026-1296: Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect
• CVE-2026-15094: WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
• CVE-2026-1557: WP Responsive Images <= 1.0 - Arbitrary File Read
• CVE-2026-1581: wpForo Forum <= 2.4.14 - SQL Injection
• CVE-2026-22557: UniFi Network Application - Path Traversal
• CVE-2026-23482: Blinko < 1.8.4 - Path Traversal
• CVE-2026-23483: Blinko <= 1.8.3 - Path Traversal via /plugins
• CVE-2026-24128: XWiki Platform Distribution Flavor Main - Cross-Site Scripting
• CVE-2026-2413: Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection
• CVE-2026-2416: Geo Mashup <= 1.13.17 - SQL Injection
• CVE-2026-25616: Blesta <= 5.13.1 - Cross-Site Scripting
• CVE-2026-27174: MajorDoMo - Unauthenticated RCE
• CVE-2026-27176: MajorDoMo - Cross-Site Scripting
• CVE-2026-27760: OpenCATS - Command Injection
• CVE-2026-28414: Gradio - Absolute Path Traversal
• CVE-2026-28496: FOSSBilling - Server-Side Template Injection
• CVE-2026-29014: MetInfo CMS <= 8.1 - Remote Code Execution
• CVE-2026-29059: Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal
• CVE-2026-29066: TinaCMS - Path Traversal
• CVE-2026-29183: SiYuan Note - Cross-Site Scripting
• CVE-2026-3018: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection
• CVE-2026-30958: OneUptime < 10.0.21 - Path Traversal
• CVE-2026-31831: Tautulli <= 2.16.1 - Path Traversal
• CVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection
• CVE-2026-3326: XStore Theme < 9.7.3 - SQL Injection
• CVE-2026-33497: Langflow < 1.7.0 - Path Traversal
• CVE-2026-3396: WCAPF WooCommerce Ajax Product Filter - SQL Injection
• CVE-2026-34885: WordPress Media Library Assistant <= 3.34 - SQL Injection
• CVE-2026-35029: LiteLLM - Arbitrary File Read
• CVE-2026-35273: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
• CVE-2026-35616: FortiClient EMS - Authentication Bypass
• CVE-2026-39364: Vite Dev Server - Directory Traversal
• CVE-2026-39808: Fortinet FortiSandbox - Command Injection
• CVE-2026-40105: XWiki - Cross-Site Scripting
• CVE-2026-40887: Vendure Core - SQL Injection
• CVE-2026-41179: RClone RC - Command Injection
• CVE-2026-41940: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
• CVE-2026-42796: Arelle < 2.39.10 - Remote Code Execution
• CVE-2026-46442: Flowise < 3.1.2 - node-custom-function Unauthorized RCE
• CVE-2026-4810: Google ADK-Python - Unauthenticated Builder Endpoint
• CVE-2026-48907: Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
• CVE-2026-50229: Apache Tomcat - Cross-Site Scripting
• CVE-2026-50230: Lyrion Music Server <= 9.2.0 - Cross-Site Scripting
• CVE-2026-52774: YesWiki Bazar Widget - Reflected XSS via 'id' Parameter
• CVE-2026-54157: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
• CVE-2026-54836: YMC Filter - SQL Injection
• CVE-2026-55592: Dashy <= 4.3.6 - Reflected XSS via Workspace
• CVE-2026-58455: Dockwatch <= 0.6.567 - OS Command Injection
• CVE-2026-60137: WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
• CVE-2026-63030: WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
• CVE-2026-6433: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution
• CVE-2026-6875: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
• CVE-2026-8037: Progress ADC LoadMaster - Command Injection
• CVE-2026-8054: dotCMS Core Publish Audit API - Unauthenticated SQL Injection
• CVE-2026-8385: WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure
• CVE-2026-9082: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
• CVE-2026-9282: W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read