VYPR

CVEs

112,927 total · page 1056 of 2,259

AllCriticalHighKEV
  • CVE-2023-49826HigDec 21, 2023
    Pencidesign
    Soledad
    risk 0.53cvss 8.1epss 0.01

    Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.

  • CVE-2023-5594HigDec 21, 2023
    Eset
    Nod32 Antivirus
    risk 0.49cvss 7.5epss 0.00

    Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted.

  • CVE-2023-50481HigDec 21, 2023
    Blinksocks
    Blinksocks
    risk 0.49cvss 7.5epss 0.00

    An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /presets/ssr-auth-chain.js.

  • CVE-2023-7025HigDec 21, 2023
    Kylinsoft
    hedron-domain-hook
    risk 0.51cvss 7.8epss 0.00

    A vulnerability was found in KylinSoft hedron-domain-hook up to 3.8.0.12-0k0.5. It has been declared as critical. This vulnerability affects the function init_kcm of the component DBus Handler. The manipulation leads to improper access controls. Attacking locally is a…

  • CVE-2023-23970HigDec 20, 2023
    Woorockets
    Corsa
    risk 0.57cvss 8.8epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.

  • CVE-2023-47784HigDec 20, 2023
    Themepunch
    Slider Revolution
    risk 0.55cvss 8.4epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.

  • CVE-2023-49166HigDec 20, 2023
    Magiclogix
    Msync
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.

  • CVE-2023-49161HigDec 20, 2023
    Guelbetech
    Bravo Translate
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.

  • CVE-2023-29432HigDec 20, 2023
    Favethemes
    Houzez
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

  • CVE-2023-29096HigDec 20, 2023
    Bestwebsoft
    Contact Form To Db
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For…

  • CVE-2023-28788HigDec 20, 2023
    WordPress
    Advanced Page Visit Counter
    risk 0.46cvss 7.1epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for…

  • CVE-2023-26525HigDec 20, 2023
    Dokan
    Dokan
    risk 0.39cvss 7.1epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace…

  • CVE-2023-7018HigDec 20, 2023
    Huggingface
    Transformers
    risk 0.44cvss 7.8epss 0.01

    Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

  • CVE-2023-47118HigDec 20, 2023
    Clickhouse
    Clickhouse
    risk 0.46cvss 7.0epss 0.00

    ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface…

  • CVE-2023-30872HigDec 20, 2023
    Bannersky
    Bsk Forms Blacklist
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.

  • CVE-2023-30750HigDec 20, 2023
    WordPress
    CM Popup Plugin
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.

  • CVE-2023-30495HigDec 20, 2023
    Themefic
    Ultimate Addons For Contact Form 7
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.

  • CVE-2023-5011HigDec 20, 2023
    Student Information System
    Student Information System
    risk 0.57cvss 8.8epss 0.01

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

  • CVE-2023-5010HigDec 20, 2023
    Student Information System
    Student Information System
    risk 0.57cvss 8.8epss 0.01

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

  • CVE-2023-5007HigDec 20, 2023
    Kashipara
    Student Information System
    risk 0.57cvss 8.8epss 0.01

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

  • CVE-2023-49825HigDec 20, 2023
    Pencidesign
    Soledad
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme:…

  • CVE-2023-35916HigDec 20, 2023
    Automattic
    Woopayments
    risk 0.49cvss 7.5epss 0.01

    Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.

  • CVE-2023-35915HigDec 20, 2023
    Automattic
    Woopayments
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a…

  • CVE-2023-35914HigDec 20, 2023
    WordPress
    Woo Subscriptions
    risk 0.49cvss 7.5epss 0.01

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.

  • CVE-2023-33330HigDec 20, 2023
    WooCommerce
    Automatewoo
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.

  • CVE-2023-33209HigDec 20, 2023
    Crawlspider
    Seo Change Monitor
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.

  • CVE-2023-32743HigDec 20, 2023
    WooCommerce
    Automatewoo
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.

  • CVE-2023-47852HigDec 20, 2023
    Linkwhisper
    Link Whisper
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.

  • CVE-2023-35876HigDec 20, 2023
    Automattic
    Woocommerce Square
    risk 0.53cvss 8.1epss 0.01

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.

  • CVE-2023-28782HigDec 20, 2023
    Rocketgenius Inc.
    Gravity Forms
    risk 0.54cvss 8.3epss 0.01

    Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.

  • CVE-2023-50249HigDec 20, 2023
    Getsentry
    Astro
    risk 0.42cvss 7.5epss 0.01

    Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive computation times on…

  • CVE-2023-47507HigDec 20, 2023
    Averta
    Master Slider Pro
    risk 0.46cvss 7.1epss 0.00

    Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.

  • CVE-2023-47236HigDec 20, 2023
    WordPress
    iPages Flipbook For WordPress
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects iPages Flipbook For WordPress: from n/a through 1.4.8.

  • CVE-2023-46147HigDec 20, 2023
    Themify
    Ultra
    risk 0.48cvss 7.4epss 0.00

    Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

  • CVE-2023-40555HigDec 20, 2023
    Uxthemes
    Flatsome
    risk 0.54cvss 8.3epss 0.00

    Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.

  • CVE-2023-38519HigDec 20, 2023
    Mainwp
    Mainwp Dashboard
    risk 0.42cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from…

  • CVE-2023-37871HigDec 20, 2023
    Automattic
    Woocommerce Gocardless
    risk 0.53cvss 8.2epss 0.01

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.

  • CVE-2023-6562HigDec 20, 2023
    Kakadusoftware
    Kakadu SDK
    risk 0.49cvss 7.5epss 0.01

    JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.

  • CVE-2023-6912HigDec 20, 2023
    M Files Corporation"
    M-Files Server
    risk 0.49cvss 7.5epss 0.01

    Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

  • CVE-2023-37544HigDec 20, 2023
    Apache
    Pulsar
    risk 0.42cvss 7.5epss 0.01

    Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through…

  • CVE-2023-0011HigDec 20, 2023
    u-blox
    TOBY-L2
    risk 0.49cvss 7.6epss 0.00

    A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which…

  • CVE-2023-6977HigDec 20, 2023
    Mlflow
    Mlflow
    risk 0.42cvss 7.5epss 0.04

    This vulnerability enables malicious users to read sensitive files on the server.

  • CVE-2023-6976HigDec 20, 2023
    Mlflow
    Mlflow
    risk 0.50cvss 8.8epss 0.01

    This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

  • CVE-2023-6689HigDec 20, 2023
    Efacec
    Bcu 500 Firmware
    risk 0.53cvss 8.2epss 0.00

    A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.

  • CVE-2023-6929HigDec 19, 2023
    Eurotel
    Etl3100
    risk 0.49cvss 7.5epss 0.01

    EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the…

  • CVE-2023-49147HigDec 19, 2023
    Geek Software GmbH
    PDF24 Creator
    risk 0.51cvss 7.8epss 0.00

    An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on…

  • CVE-2023-38126HigDec 19, 2023
    Softx
    edgeAggregator
    risk 0.52cvss 7.2epss 0.71

    Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this…

  • CVE-2023-50466HigDec 19, 2023
    Weintek
    easyweb Web Version
    risk 0.57cvss 8.8epss 0.02

    An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter.

  • CVE-2023-49764HigDec 19, 2023
    Sigmaplugin
    Advanced Database Cleaner
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.

  • CVE-2023-48764HigDec 19, 2023
    Guardgiant
    Guardgiant
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks:…