VYPR

CVEs

131,109 total · page 1112 of 2,623

AllCriticalHighKEV
  • CVE-2025-23537HigJan 16, 2025
    WordPress
    Add Custom Google Tag Manager
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue affects add custom google tag manager: from n/a through <= 1.0.3.

  • CVE-2025-23533HigJan 16, 2025
    WordPress
    Wplyrics
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through <= 0.4.1.

  • CVE-2025-23532HigJan 16, 2025
    WordPress
    Myanime Widget
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.

  • CVE-2025-23530HigJan 16, 2025
    WordPress
    Custom Post Type Lockdown
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Lockdown custom-post-type-lockdown allows Privilege Escalation.This issue affects Custom Post Type Lockdown: from n/a through <= 1.11.

  • CVE-2025-23528HigJan 16, 2025
    WordPress
    Dd Roles
    risk 0.57cvss 8.8epss 0.01

    Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1.

  • CVE-2025-23513HigJan 16, 2025
    WordPress
    Bible Embed
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4.

  • CVE-2025-23511HigJan 16, 2025
    WordPress
    Wp Blackcheck
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.

  • CVE-2025-23510HigJan 16, 2025
    WordPress
    Wordpress Logging Service
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Jan Štětina WordPress Logging Service wordpress-logging-service allows Stored XSS.This issue affects WordPress Logging Service: from n/a through <= 1.5.4.

  • CVE-2025-23508HigJan 16, 2025
    WordPress
    Extra Options Favicons
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in OrigoThemes Extra Options – Favicons extra-options-favicons allows Stored XSS.This issue affects Extra Options – Favicons: from n/a through <= 1.1.0.

  • CVE-2025-23501HigJan 16, 2025
    WordPress
    Cookie Consent & Autoblock for GDPR/CCPA
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue affects Cookie Consent & Autoblock for GDPR/CCPA: from n/a through <= 1.0.1.

  • CVE-2025-23499HigJan 16, 2025
    WordPress
    Board Election
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through <= 1.0.1.

  • CVE-2025-23497HigJan 16, 2025
    WordPress
    Simple Project Manager
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in albdesign Simple Project Manager simple-project-managment allows Stored XSS.This issue affects Simple Project Manager: from n/a through <= 1.2.2.

  • CVE-2025-23483HigJan 16, 2025
    WordPress
    Universal Analytics Injector
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through <= 1.0.3.

  • CVE-2025-23476HigJan 16, 2025
    WordPress
    My Related Posts
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a through <= 1.1.

  • CVE-2025-23471HigJan 16, 2025
    WordPress
    Ect Add To Cart Button
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Add to Cart Button ect-add-to-cart-button allows Stored XSS.This issue affects ECT Add to Cart Button: from n/a through <= 1.4.

  • CVE-2025-23470HigJan 16, 2025
    WordPress
    Visit Site Link Enhanced
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.

  • CVE-2025-23467HigJan 16, 2025
    WordPress
    Rss News Scroller
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: from n/a through <= 2.0.0.

  • CVE-2025-23463HigJan 16, 2025
    WordPress
    Md Custom Content
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Mukesh Dak MD Custom content after or before of post md-custom-content allows Stored XSS.This issue affects MD Custom content after or before of post: from n/a through <= 1.0.

  • CVE-2025-23456HigJan 16, 2025
    Oddthinking
    emailshroud
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <= 2.2.1.

  • CVE-2025-23455HigJan 16, 2025
    WordPress
    WP VTiger Synchronization
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger Synchronization: from n/a through <= 1.1.1.

  • CVE-2025-23453HigJan 16, 2025
    WordPress
    Stars SMTP Mailer
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.

  • CVE-2025-23452HigJan 16, 2025
    WordPress
    Editionguard For Woocommerce Ebook Sales With Drm
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for…

  • CVE-2025-23445HigJan 16, 2025
    WordPress
    Easy Tynt
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a through <= 0.2.5.1.

  • CVE-2025-23442HigJan 16, 2025
    WordPress
    Shockingly Big Ie6 Warning
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockingly Big IE6 Warning: from n/a through <= 1.6.3.

  • CVE-2025-23438HigJan 16, 2025
    WordPress
    Wp Ptviewer
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Reflected XSS.This issue affects WP PT-Viewer: from n/a through <= 2.0.2.

  • CVE-2025-23436HigJan 16, 2025
    WordPress
    Wp Scribd List
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <= 1.2.

  • CVE-2025-23435HigJan 16, 2025
    WordPress
    Password Protect Plugin For Wordpress
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.

  • CVE-2025-23432HigJan 16, 2025
    AlTi5
    AlT Report
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This issue affects AlT Report: from n/a through <= 1.12.0.

  • CVE-2025-23430HigJan 16, 2025
    WordPress
    Mass Custom Fields Manager
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Mass Custom Fields Manager: from n/a through <= 1.5.

  • CVE-2025-23429HigJan 16, 2025
    WordPress
    Altima Lookbook Free For Woocommerce
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in altima-interactive Altima Lookbook Free for WooCommerce altima-lookbook-free-for-woocommerce allows Reflected XSS.This issue affects Altima Lookbook Free for WooCommerce: from…

  • CVE-2025-23426HigJan 16, 2025
    WordPress
    Go Social
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0.

  • CVE-2025-23424HigJan 16, 2025
    WordPress
    Marquee Style Rss News Ticker
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through <= 3.2.0.

  • CVE-2024-55954HigJan 16, 2025
    Openobserve
    Openobserve
    risk 0.50cvss 8.7epss 0.01

    OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root…

  • CVE-2024-57775HigJan 16, 2025
    Jfinal
    Jfinal
    risk 0.57cvss 8.8epss 0.01

    JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.

  • CVE-2024-57770HigJan 16, 2025
    Jfinal
    Jfinal
    risk 0.57cvss 8.8epss 0.01

    JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.

  • CVE-2024-57769HigJan 16, 2025
    Jfinal
    Jfinal
    risk 0.57cvss 8.8epss 0.01

    JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.

  • CVE-2024-41746HigJan 16, 2025
    IBM
    Cics Tx
    risk 0.47cvss 7.2epss 0.00

    IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…

  • CVE-2024-57162HigJan 16, 2025
    Campcodes
    Cybercafe Management System
    risk 0.47cvss 7.2epss 0.00

    Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php.

  • CVE-2025-0472HigJan 16, 2025
    PMB
    PMB platform
    risk 0.49cvss 7.5epss 0.01

    Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and enumerate the internal files of a machine by looking at the request response.

  • CVE-2018-25108HigJan 16, 2025
    risk 0.49cvss 7.5epss 0.01

    An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.

  • CVE-2024-50563HigJan 16, 2025
    Fortinet
    Fortianalyzer
    risk 0.47cvss 7.3epss 0.01

    A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through…

  • CVE-2024-12614HigJan 16, 2025
    WordPress
    Passwords Manager
    risk 0.49cvss 7.5epss 0.00

    The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all versions up to, and including, 1.4.8. This makes it possible for authenticated…

  • CVE-2024-12613HigJan 16, 2025
    WordPress
    Passwords Manager
    risk 0.49cvss 7.5epss 0.01

    The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

  • CVE-2024-45331HigJan 16, 2025
    Fortinet
    Fortianalyzer
    risk 0.47cvss 7.3epss 0.00

    A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1 through 7.2.6,…

  • CVE-2025-0457HigJan 16, 2025
    NetVision Information
    airPASS
    risk 0.57cvss 8.8epss 0.01

    The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.

  • CVE-2025-22976HigJan 15, 2025
    Dingfanzu
    Dingfanzu CMS
    risk 0.46cvss 7.1epss 0.00

    SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder.php" shopId module.

  • CVE-2025-22964HigJan 15, 2025
    Ddsn
    cm3 Acora CMS
    risk 0.53cvss 8.1epss 0.01

    DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly…

  • CVE-2024-57728HigKEVJan 15, 2025
    Simple Help
    Simplehelp
    risk 0.65cvss 7.2epss 0.64

    SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

  • CVE-2024-57727HigKEVJan 15, 2025
    Simple Help
    Simplehelp
    risk 0.77cvss 7.5epss 0.97

    SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration…

  • CVE-2025-0492HigJan 15, 2025
    Dlink
    DIR-823x
    risk 0.49cvss 7.5epss 0.02

    A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the…