VYPR

CVEs

8,985 total · page 111 of 180

AllCriticalHighKEV
  • CVE-2023-4669CriSep 14, 2023
    Exagate
    SYSGuard 6001
    risk 0.64cvss 9.8epss 0.00

    Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before 3.2.20.0.

  • CVE-2023-4832CriSep 14, 2023
    Aceka
    Company Management
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .

  • CVE-2023-4634CriSep 6, 2023
    WordPress
    Media Library Assistant
    risk 0.74cvss 9.8epss 0.92

    The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the…

  • CVE-2023-4531CriSep 5, 2023
    Mestav Software
    E Commerce Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .

  • CVE-2023-4178CriSep 5, 2023
    Neutron
    Neutron Smart VMS
    risk 0.64cvss 9.8epss 0.00

    Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.

  • CVE-2023-4034CriSep 5, 2023
    Digita Information Technology
    Smartrise Document Management System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.

  • CVE-2023-3616CriSep 5, 2023
    Topsky979
    Hotel Management System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.

  • CVE-2023-35072CriSep 5, 2023
    Coyav Travel
    Proagent
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection.This issue affects Proagent: before 20230904 .

  • CVE-2023-35068CriSep 5, 2023
    BMA
    Personnel Tracking System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection.This issue affects Personnel Tracking System: before 20230904.

  • CVE-2023-35065CriSep 5, 2023
    Osoft
    Paint Production Management
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection.This issue affects Paint Production Management: before 2.1.

  • CVE-2023-3374CriSep 5, 2023
    Unisign
    Bookreen
    risk 0.64cvss 9.8epss 0.00

    Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.

  • CVE-2023-3162CriAug 31, 2023
    Webtoffee
    Stripe Payment Plugin For Woocommerce
    risk 0.57cvss 9.8epss 0.00

    The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows…

  • CVE-2023-4596CriAug 30, 2023
    WordPress
    Forminator
    risk 0.64cvss 9.8epss 0.91

    The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated…

  • CVE-2023-4404CriAug 23, 2023
    WordPress
    Charitable
    risk 0.64cvss 9.8epss 0.00

    The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user…

  • CVE-2023-3452CriAug 12, 2023
    Canto
    Canto
    risk 0.64cvss 9.8epss 0.87

    The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is…

  • CVE-2023-3632CriAug 9, 2023
    Sifir Bes Education and Informatics
    Kunduz
    risk 0.64cvss 9.8epss 0.00

    Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authentication Bypass. This issue affects Kunduz - Homework Helper App: before 6.2.3.

  • CVE-2023-3522CriAug 8, 2023
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48.

  • CVE-2023-3386CriAug 8, 2023
    A2
    Camera Trap Tracking System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905.

  • CVE-2023-3651CriAug 8, 2023
    Yaztek Software Technologies And Computer Systems
    E Commerce Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.

  • CVE-2023-3716CriAug 8, 2023
    Oduyo
    Online Collection Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1.

  • CVE-2023-3717CriAug 8, 2023
    Farmakom
    Remote Administration Console
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02.

  • CVE-2023-3898CriAug 8, 2023
    Yaztek Software Technologies And Computer Systems
    E Commerce Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.

  • CVE-2023-3956CriJul 27, 2023
    Instawp
    Instawp Connect
    risk 0.57cvss 9.8epss 0.01

    The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated…

  • CVE-2023-35066CriJul 25, 2023
    Infodrom Software
    E-Invoice Approval System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection.This issue affects E-Invoice Approval System: before v.20230701.

  • CVE-2023-3046CriJul 25, 2023
    Biltay Technology
    Scienta
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection.This issue affects Scienta: before 20230630.1953.

  • CVE-2023-2958CriJul 17, 2023
    Origin Software
    ATS Pro
    risk 0.64cvss 9.8epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass. This issue affects ATS Pro: before 20230714.

  • CVE-2023-3376CriJul 17, 2023
    Digital Strategy
    Zekiweb
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection.This issue affects Zekiweb: before 2.

  • CVE-2023-2963CriJul 17, 2023
    Oliva Expertise
    Oliva Expertise EKS
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection.This issue affects Oliva Expertise EKS: before 1.2.

  • CVE-2023-35070CriJul 13, 2023
    VegaGroup
    Web Collection
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197.

  • CVE-2023-2957CriJul 13, 2023
    Lisa Software
    Florist Site
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection. This issue affects Florist Site: before 3.0.

  • CVE-2023-1547CriJul 13, 2023
    Elra
    Parkmatik
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection. This issue affects Parkmatik: before 02.01-a51.

  • CVE-2023-3342CriJul 13, 2023
    WordPress
    User Registration
    risk 0.58cvss 9.9epss 0.07

    The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated…

  • CVE-2023-33150CriJul 11, 2023
    Microsoft
    Office
    risk 0.62cvss 9.6epss 0.00

    Microsoft Office Security Feature Bypass Vulnerability

  • CVE-2023-3045CriJul 10, 2023
    Tise Technology
    Parking Web Report
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tise Technology Parking Web Report allows SQL Injection.This issue affects Parking Web Report: before 2.1.

  • CVE-2023-2852CriJul 10, 2023
    Softmed
    SelfPatron
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injection. This issue affects SelfPatron : before 2.0.

  • CVE-2023-2046CriJul 10, 2023
    Yontem Informatics
    Vehicle Tracking System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yontem Informatics Vehicle Tracking System allows SQL Injection. This issue affects Vehicle Tracking System: before 8.

  • CVE-2023-3249CriJun 30, 2023
    WordPress
    Web3
    risk 0.64cvss 9.8epss 0.00

    The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated…

  • CVE-2023-2834CriJun 30, 2023
    WordPress
    Bookit
    risk 0.57cvss 9.8epss 0.01

    The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated…

  • CVE-2023-2982CriJun 29, 2023
    WordPress
    Miniorange Login Openid
    risk 0.62cvss 9.8epss 0.70

    The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through…

  • CVE-2023-3197CriJun 24, 2023
    WordPress
    Mstore API
    risk 0.59cvss 9.8epss 0.30

    The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This…

  • CVE-2023-2907CriJun 19, 2023
    Marksoft
    Marksoft
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection. This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605.

  • CVE-2023-35064CriJun 13, 2023
    Satos
    Satos Mobile
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607.

  • CVE-2023-3050CriJun 13, 2023
    TMT
    Lockcell
    risk 0.64cvss 9.8epss 0.00

    Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15.

  • CVE-2023-3049CriJun 13, 2023
    TMT
    Lockcell
    risk 0.64cvss 9.8epss 0.02

    Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15.

  • CVE-2023-3048CriJun 13, 2023
    TMT
    Lockcell
    risk 0.64cvss 9.8epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15.

  • CVE-2023-3047CriJun 13, 2023
    TMT
    Lockcell
    risk 0.64cvss 9.8epss 0.09

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15.

  • CVE-2023-2278CriJun 13, 2023
    WordPress
    Wp Directory Kit
    risk 0.57cvss 9.8epss 0.01

    The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any…

  • CVE-2023-2986CriJun 8, 2023
    Tychesoftwares
    Abandoned Cart Lite For Woocommerce
    risk 0.71cvss 9.8epss 0.92

    The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows…

  • CVE-2021-4380CriJun 7, 2023
    WordPress
    Wp Pinterest Automatic
    risk 0.71cvss 9.8epss 0.87

    The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for…

  • CVE-2020-36705CriJun 7, 2023
    Tunasite
    Adning Advertising
    risk 0.71cvss 9.8epss 0.91

    The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on…