VYPR

CVEs

131,116 total · page 1124 of 2,623

AllCriticalHighKEV
  • CVE-2024-46603HigJan 7, 2025
    Elspec Engineering
    G5 Digital Fault Recorder Firmware
    risk 0.49cvss 7.5epss 0.01

    An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.

  • CVE-2024-46602HigJan 7, 2025
    Elspec
    G5 digital fault recorder
    risk 0.49cvss 7.5epss 0.01

    An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to cause a Denial of Service (DoS) via a crafted XML payload.

  • CVE-2024-46601HigJan 7, 2025
    Elspec Engineering
    G5 Digital Fault Recorder Firmware
    risk 0.49cvss 7.5epss 0.01

    Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow.

  • CVE-2024-46242HigJan 7, 2025
    CTFd
    CTFd
    risk 0.49cvss 7.5epss 0.01

    An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.

  • CVE-2024-40702HigJan 7, 2025
    IBM
    Cognos Controller
    risk 0.53cvss 8.2epss 0.00

    IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation.

  • CVE-2025-22364HigJan 7, 2025
    WordPress
    Ach Invoice App
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach Invoice App ach-invoice-app allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through <= 1.0.1.

  • CVE-2025-22359HigJan 7, 2025
    WordPress
    Syncfields
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issue affects SyncFields: from n/a through <= 2.1.

  • CVE-2025-22358HigJan 7, 2025
    WordPress
    Advertising Management
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.

  • CVE-2025-22357HigJan 7, 2025
    WordPress
    Target Notifications
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever Target Notifications target-notifications allows Reflected XSS.This issue affects Target Notifications: from n/a through <= 1.1.1.

  • CVE-2025-22355HigJan 7, 2025
    WordPress
    Kikx Simple Post Author Filter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asokaaso2 Kikx Simple Post Author Filter sa-post-author-filter allows Reflected XSS.This issue affects Kikx Simple Post Author Filter: from n/a through <= 1.0.

  • CVE-2025-22353HigJan 7, 2025
    WordPress
    Bvd Easy Gallery Manager
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bvads BVD Easy Gallery Manager bvd-easy-gallery-manager allows Reflected XSS.This issue affects BVD Easy Gallery Manager: from n/a through <= 1.0.6.

  • CVE-2025-22352HigJan 7, 2025
    WordPress
    ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This…

  • CVE-2025-22351HigJan 7, 2025
    WordPress
    Database for Contact Form 7
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.

  • CVE-2025-22349HigJan 7, 2025
    WordPress
    WP Marka WordPress Auction Plugin
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.

  • CVE-2025-22348HigJan 7, 2025
    WordPress
    Dynamictags
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtowebsites DynamicTags dynamictags allows Blind SQL Injection.This issue affects DynamicTags: from n/a through <= 1.4.0.

  • CVE-2025-22347HigJan 7, 2025
    WordPress
    BSK Forms Blacklist
    risk 0.53cvss 8.2epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.

  • CVE-2025-22343HigJan 7, 2025
    WordPress
    Wpsol
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.

  • CVE-2025-22342HigJan 7, 2025
    WordPress
    Wp Simple Sitemap
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through <= 0.2.

  • CVE-2025-22336HigJan 7, 2025
    WordPress
    Wizhi Multi Filters by Wenprise
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through <= 1.8.6.

  • CVE-2025-22328HigJan 7, 2025
    WordPress
    Elevio
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Elevio by Dixa Elevio elevio allows Stored XSS.This issue affects Elevio: from n/a through <= 4.4.1.

  • CVE-2025-22326HigJan 7, 2025
    5centsCDN
    5centsCDN
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5centsCDN 5centsCDN 5centscdn allows Reflected XSS.This issue affects 5centsCDN: from n/a through <= 25.4.15.

  • CVE-2025-22325HigJan 7, 2025
    WordPress
    Autocompleter
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in nchankov Autocompleter autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through <= 1.3.5.2.

  • CVE-2025-22324HigJan 7, 2025
    WordPress
    Oz Canonical
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andon Ivanov OZ Canonical oz-canonical allows Reflected XSS.This issue affects OZ Canonical: from n/a through <= 0.5.

  • CVE-2025-22320HigJan 7, 2025
    ProductDyno
    ProductDyno
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProductDyno ProductDyno productdyno allows Reflected XSS.This issue affects ProductDyno: from n/a through <= 1.0.24.

  • CVE-2024-56300HigJan 7, 2025
    WordPress
    Post/Page Copying Tool
    risk 0.49cvss 7.5epss 0.01

    Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.0.

  • CVE-2024-56299HigJan 7, 2025
    Odcms
    Notify Odoo
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo notify-odoo allows Stored XSS.This issue affects Notify Odoo: from n/a through <= 1.0.0.

  • CVE-2024-56296HigJan 7, 2025
    WordPress
    Mang Board WP
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through <= 1.8.4.

  • CVE-2024-56291HigJan 7, 2025
    WordPress
    Z Inventory Manager
    risk 0.53cvss 8.1epss 0.00

    Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.

  • CVE-2024-56289HigJan 7, 2025
    WordPress
    Groundhogg
    risk 0.46cvss 7.1epss 0.01

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through <= 3.7.3.3.

  • CVE-2024-56286HigJan 7, 2025
    WordPress
    Classic Addons Wpbakery Page Builder Addons
    risk 0.49cvss 7.5epss 0.01

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows PHP Local File Inclusion.This issue affects Classic Addons – WPBakery Page…

  • CVE-2024-56283HigJan 7, 2025
    WordPress
    Locatoraid Store Locator
    risk 0.53cvss 8.1epss 0.00

    Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.

  • CVE-2024-56282HigJan 7, 2025
    WordPress
    Wpmozo Addons Lite For Elementor
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows PHP Local File Inclusion.This issue affects WPMozo Addons Lite for Elementor:…

  • CVE-2024-56281HigJan 7, 2025
    WordPress
    Pgall For Woocommerce
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows PHP Local File Inclusion.This issue affects 워드프레스 결제 심플페이:…

  • CVE-2024-56280HigJan 7, 2025
    AmentoTech
    WPGuppy Lite
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/a through <= 1.1.0.

  • CVE-2024-51715HigJan 7, 2025
    Flowdee
    Clickwhale
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.

  • CVE-2024-51700HigJan 7, 2025
    WordPress
    Naver Analytics
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS.This issue affects NAVER Analytics: from n/a through <= 0.9.

  • CVE-2024-49644HigJan 7, 2025
    WordPress
    Accessibility by AllAccessible
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.

  • CVE-2024-49633HigJan 7, 2025
    Designinvento
    Directorypress
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflected XSS.This issue affects DirectoryPress: from n/a through <= 3.6.19.

  • CVE-2024-49249HigJan 7, 2025
    WordPress
    SMSA Shipping
    risk 0.56cvss 8.6epss 0.01

    Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.

  • CVE-2024-12152HigJan 7, 2025
    WordPress
    Mipl Wc Multisite Sync
    risk 0.49cvss 7.5epss 0.01

    The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the…

  • CVE-2024-47398HigJan 7, 2025
    OpenHarmony
    Openharmony
    risk 0.57cvss 8.8epss 0.00

    in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write.

  • CVE-2024-12202HigJan 7, 2025
    WordPress
    Croma Music
    risk 0.57cvss 8.8epss 0.01

    The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusic_ajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated…

  • CVE-2024-11626HigJan 7, 2025
    Progress (organisation)
    Sitefinity
    risk 0.55cvss 8.4epss 0.00

    Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300…

  • CVE-2024-11625HigJan 7, 2025
    Progress (organisation)
    Sitefinity
    risk 0.50cvss 7.7epss 0.00

    Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

  • CVE-2024-11725HigJan 7, 2025
    WordPress
    SMS Alert Order Notifications – WooCommerce
    risk 0.50cvss 8.8epss 0.01

    The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including,…

  • CVE-2024-12849HigJan 7, 2025
    WordPress
    Error Log Viewer By WP Guru
    risk 0.53cvss 7.5epss 0.48

    The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary…

  • CVE-2024-12633HigJan 7, 2025
    WordPress
    JoomSport
    risk 0.39cvss 7.1epss 0.00

    The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes…

  • CVE-2024-12535HigJan 7, 2025
    WordPress
    Host PHP Info
    risk 0.56cvss 8.6epss 0.01

    The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration…

  • CVE-2024-12471HigJan 7, 2025
    WordPress
    Post Saint
    risk 0.57cvss 8.8epss 0.02

    The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all…

  • CVE-2024-12322HigJan 7, 2025
    WordPress
    Theperfectweddingnl Widget
    risk 0.50cvss 8.8epss 0.00

    The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to missing or incorrect nonce validation on the 'update_option' function. This makes it possible for unauthenticated attackers…