VYPR

CVEs

131,116 total · page 1123 of 2,623

AllCriticalHighKEV
  • CVE-2024-56444HigJan 8, 2025
    Huawei
    UIExtension
    risk 0.49cvss 7.5epss 0.00

    Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  • CVE-2024-56439HigJan 8, 2025
    Huawei
    identity authentication module
    risk 0.49cvss 7.5epss 0.00

    Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  • CVE-2025-22132HigJan 7, 2025
    Wegia
    Wegia
    risk 0.00cvss 8.3epss 0.00

    WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an…

  • CVE-2024-53522HigJan 7, 2025
    Bangkok Medical Software
    HOSxP XE
    risk 0.49cvss 7.5epss 0.01

    Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information.

  • CVE-2022-45186HigJan 7, 2025
    Suitecrm
    Suitecrm
    risk 0.53cvss 8.1epss 0.01

    An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database.

  • CVE-2022-45185HigJan 7, 2025
    Suitecrm
    Suitecrm
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve code execution.

  • CVE-2024-40427HigJan 7, 2025
    Px4
    Px4 Autopilot
    risk 0.44cvss 7.9epss 0.00

    Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to execute

  • CVE-2024-55413HigJan 7, 2025
    SUNIX
    Parallel Driver x64
    risk 0.51cvss 7.8epss 0.00

    A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high…

  • CVE-2024-55412HigJan 7, 2025
    SUNIX
    Serial Driver x64
    risk 0.51cvss 7.8epss 0.00

    A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges,…

  • CVE-2024-55411HigJan 7, 2025
    SUNIX
    Multi I/O Card
    risk 0.57cvss 8.8epss 0.00

    An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOCTL requests.

  • CVE-2024-54007HigJan 7, 2025
    HPE
    501 Wireless Client Bridge
    risk 0.47cvss 7.2epss 0.02

    Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands…

  • CVE-2024-54006HigJan 7, 2025
    HPE
    501 Wireless Client Bridge
    risk 0.47cvss 7.2epss 0.02

    Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands…

  • CVE-2025-22350HigJan 7, 2025
    WordPress
    Ultimate Learning Pro
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.

  • CVE-2024-8361HigJan 7, 2025
    SiWx91x
    SiWx91x
    risk 0.49cvss 7.5epss 0.00

    In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after watch dog expires. If…

  • CVE-2024-55555HigJan 7, 2025
    Invoiceninja
    Invoiceninja
    risk 0.54cvss 8.8epss 0.07

    Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. The route/{hash} route defined in the…

  • CVE-2024-40749HigJan 7, 2025
    Joomla
    Joomla!
    risk 0.42cvss 7.5epss 0.00

    Improper Access Controls allows access to protected views.

  • CVE-2024-40748HigJan 7, 2025
    Joomla
    Joomla!
    risk 0.42cvss 7.5epss 0.00

    Lack of output escaping in the id attribute of menu lists.

  • CVE-2024-12430HigJan 7, 2025
    Abb
    AC500 V3
    risk 0.46cvss 7.0epss 0.00

    An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. After successfully exploiting CVE-2024-12429 (directory traversal), a successfully authenticated attacker can inject…

  • CVE-2025-22593HigJan 7, 2025
    WordPress
    Laika Pedigree Tree
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.

  • CVE-2025-22592HigJan 7, 2025
    8blocks
    1003 Mortgage Application
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.

  • CVE-2025-22590HigJan 7, 2025
    WordPress
    Prayer Times Anywhere
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.

  • CVE-2025-22589HigJan 7, 2025
    WordPress
    Quote Tweet
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.

  • CVE-2025-22582HigJan 7, 2025
    WordPress
    Uptime Robot
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.

  • CVE-2025-22571HigJan 7, 2025
    WordPress
    Instabot
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.

  • CVE-2025-22559HigJan 7, 2025
    WordPress
    Tubepressnet
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.

  • CVE-2025-22557HigJan 7, 2025
    WordPress
    News Publisher Autopilot
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.

  • CVE-2025-22556HigJan 7, 2025
    WordPress
    Norse Rune Oracle Plugin
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.2.

  • CVE-2025-22555HigJan 7, 2025
    WordPress
    Smoothness Slider Shortcode
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.

  • CVE-2025-22552HigJan 7, 2025
    WordPress
    Affiliate Disclosure Statement
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.

  • CVE-2025-22548HigJan 7, 2025
    Frankkoenen
    ldap_login_password_and_role_manager
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in frankkoenen ldap_login_password_and_role_manager ldap-login-password-and-role-manager allows Stored XSS.This issue affects ldap_login_password_and_role_manager: from n/a through…

  • CVE-2025-22547HigJan 7, 2025
    WordPress
    Jk HTML To PDF
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.

  • CVE-2025-22538HigJan 7, 2025
    WordPress
    Virtual Bot
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through <= 1.0.0.

  • CVE-2025-22536HigJan 7, 2025
    WordPress
    Wp Music Player
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through <= 1.3.

  • CVE-2025-22533HigJan 7, 2025
    WordPress
    Wooexim
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

  • CVE-2025-22522HigJan 7, 2025
    WordPress
    Singsong
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roya khosravi SingSong singsong allows Stored XSS.This issue affects SingSong: from n/a through <= 1.2.

  • CVE-2025-22520HigJan 7, 2025
    WordPress
    Tock Widget
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through <= 1.1.

  • CVE-2025-22519HigJan 7, 2025
    WordPress
    Edoc Easy Tables
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows SQL Injection.This issue affects eDoc Easy Tables: from n/a through <= 1.29.

  • CVE-2025-22507HigJan 7, 2025
    WordPress
    Wpmu Prefill Post
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in iDo8p WPMU Prefill Post wpmu-prefill-post allows SQL Injection.This issue affects WPMU Prefill Post: from n/a through <= 1.02.

  • CVE-2025-22502HigJan 7, 2025
    Mindvalley
    MindValley Super PageMash
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.

  • CVE-2025-22338HigJan 7, 2025
    WordPress
    Tagmaker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through <= 0.2.2.

  • CVE-2025-22335HigJan 7, 2025
    WordPress
    Opencart Product In Wp
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through <= 1.0.1.

  • CVE-2025-22294HigJan 7, 2025
    WordPress
    Custom Field For Wp Job Manager
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.3.

  • CVE-2025-21623HigJan 7, 2025
    Oxygenz
    Clipbucket
    risk 0.00cvss 7.5epss 0.01

    ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.

  • CVE-2025-21622HigJan 7, 2025
    Oxygenz
    Clipbucket
    risk 0.00cvss 7.5epss 0.01

    ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL…

  • CVE-2025-0241HigJan 7, 2025
    Mozilla Corporation
    Firefox
    risk 0.50cvss 7.7epss 0.01

    When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

  • CVE-2024-56056HigJan 7, 2025
    Kmfoysal06
    Simplecharm
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.This issue affects SimpleCharm: from n/a through <= 1.4.3.

  • CVE-2024-55008HigJan 7, 2025
    JATOS
    Jatos
    risk 0.49cvss 7.5epss 0.01

    JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrect login attempts…

  • CVE-2024-53800HigJan 7, 2025
    WordPress
    Rezgo
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo allows PHP Local File Inclusion.This issue affects Rezgo: from n/a through <= 4.17.

  • CVE-2024-53345HigJan 7, 2025
    Hospital Management System
    Hospital Management System
    risk 0.57cvss 8.8epss 0.01

    An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file.

  • CVE-2024-48245HigJan 7, 2025
    Janobe
    Vehicle Management System
    risk 0.47cvss 7.2epss 0.01

    Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment…