VYPR

CVEs

408,769 total · page 1901 of 8,176

AllCriticalHighKEV
  • CVE-2025-69022MedDec 30, 2025
    WordPress
    Hr Management Lite
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

  • CVE-2025-69021MedDec 30, 2025
    Ays Pro
    Popup Box
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

  • CVE-2025-69020MedDec 30, 2025
    Tribulant
    Newsletters
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.

  • CVE-2025-69019MedDec 30, 2025
    FlippingBook
    flippingbook
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.

  • CVE-2025-69018MedDec 30, 2025
    Shamalli
    Web Directory Free
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

  • CVE-2025-69017MedDec 30, 2025
    WordPress
    Restropress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.

  • CVE-2025-69016MedDec 30, 2025
    WordPress
    Shortcodes And Extra Features For Phlox
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

  • CVE-2025-69015LowDec 30, 2025
    WordPress
    Crowdsignal Forms
    risk 0.25cvss 3.8epss 0.00

    Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

  • CVE-2025-69014MedDec 30, 2025
    WordPress
    Youzify
    risk 0.32cvss 4.9epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.

  • CVE-2025-69013MedDec 30, 2025
    WordPress
    Stratum
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

  • CVE-2025-69012MedDec 30, 2025
    WordPress
    Event Organiser
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

  • CVE-2025-69010MedDec 30, 2025
    WordPress
    Themebeez Toolkit
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

  • CVE-2025-69009MedDec 30, 2025
    WordPress
    Medicalequipment
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

  • CVE-2025-69008MedDec 30, 2025
    WordPress
    Inboxify Sign Up Form
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.

  • CVE-2025-69007MedDec 30, 2025
    WordPress
    Popping Sidebars And Widgets Light
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.

  • CVE-2025-69006MedDec 30, 2025
    WordPress
    Am Events
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.

  • CVE-2025-68998MedDec 30, 2025
    WordPress
    Heateor Login
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

  • CVE-2025-68997MedDec 30, 2025
    WordPress
    Wpdiscuz
    risk 0.34cvss 5.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

  • CVE-2025-68996HigDec 30, 2025
    WordPress
    Responsive Posts Carousel Pro
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro:…

  • CVE-2025-68995MedDec 30, 2025
    WordPress
    Mystickyelements
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

  • CVE-2025-68994MedDec 30, 2025
    WordPress
    Product Loops for WooCommerce
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

  • CVE-2025-68993MedDec 30, 2025
    WordPress
    Share, Print and PDF Products for WooCommerce
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCommerce: from n/a…

  • CVE-2025-68992MedDec 30, 2025
    WordPress
    BWL Knowledge Base Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.

  • CVE-2025-68991MedDec 30, 2025
    WordPress
    Bwl Pro Voting Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

  • CVE-2025-68990HigDec 30, 2025
    WordPress
    Bwl Pro Voting Manager
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

  • CVE-2025-68989MedDec 30, 2025
    WordPress
    Contact Form 7 Mailchimp Extension
    risk 0.28cvss 4.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.

  • CVE-2025-68988MedDec 30, 2025
    WordPress
    Einvoiceapp Malaysia
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.

  • CVE-2025-68987HigDec 30, 2025
    Edge-Themes
    Cinerama
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.

  • CVE-2025-68985HigDec 30, 2025
    WordPress
    Aora
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.

  • CVE-2025-68984HigDec 30, 2025
    WordPress
    Puca
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through <= 2.6.39.

  • CVE-2025-68983HigDec 30, 2025
    WordPress
    Greenmart
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through <= 4.2.11.

  • CVE-2025-68982MedDec 30, 2025
    WordPress
    Designthemes Lms Addon
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

  • CVE-2025-68981MedDec 30, 2025
    WordPress
    HomeFix Elementor Portfolio
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

  • CVE-2025-68980MedDec 30, 2025
    WordPress
    WeDesignTech Portfolio
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

  • CVE-2025-68979MedDec 30, 2025
    WordPress
    Google Calendar Events
    risk 0.34cvss 5.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through <= 3.5.9.

  • CVE-2025-68978MedDec 30, 2025
    WordPress
    Designthemes Core
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

  • CVE-2025-68977MedDec 30, 2025
    WordPress
    Designthemes Portfolio Addon
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.

  • CVE-2025-68976MedDec 30, 2025
    WordPress
    Eagle Booking
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

  • CVE-2025-68975MedDec 30, 2025
    WordPress
    Eagle Booking
    risk 0.28cvss 4.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

  • CVE-2025-68974MedDec 30, 2025
    WordPress
    WordPress Social Login and Register
    risk 0.43cvss 6.6epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register:…

  • CVE-2025-15245LowDec 30, 2025
    Dlink
    DCS-850L
    risk 0.23cvss 3.5epss 0.01

    A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been…

  • CVE-2025-15244LowDec 30, 2025
    Phpems
    Phpems
    risk 0.24cvss 3.7epss 0.00

    A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The…

  • CVE-2025-15359CriDec 30, 2025
    Deltaww
    Dvp 12se11t Firmware
    risk 0.59cvss 9.1epss 0.00

    DVP-12SE11T - Out-of-bound memory write Vulnerability

  • CVE-2025-15243HigDec 30, 2025
    Carmelo
    Simple Stock System
    risk 0.47cvss 7.3epss 0.00

    A flaw has been found in code-projects Simple Stock System 1.0. This affects an unknown function of the file /market/login.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been published and…

  • CVE-2025-15242LowDec 30, 2025
    Phpems
    Phpems
    risk 0.20cvss 3.1epss 0.00

    A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The…

  • CVE-2025-15358HigDec 30, 2025
    Deltaww
    Dvp 12se11t Firmware
    risk 0.49cvss 7.5epss 0.00

    DVP-12SE11T - Denial of Service Vulnerability

  • CVE-2025-15241LowDec 30, 2025
    Cloudpanel Io
    Cloudpanel Ce
    risk 0.16cvss 3.5epss 0.00

    A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to…

  • CVE-2025-15234HigDec 30, 2025
    Tenda
    M3
    risk 0.57cvss 8.8epss 0.03

    A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This manipulation of the argument portIp/portMask/portGateWay/portDns/portSecDns causes heap-based buffer overflow. It is…

  • CVE-2025-15103HigDec 30, 2025
    Deltaww
    Dvp 12se11t Firmware
    risk 0.53cvss 8.1epss 0.00

    DVP-12SE11T - Authentication Bypass via Partial Password Disclosure

  • CVE-2025-15102CriDec 30, 2025
    Deltaww
    Dvp 12se11t Firmware
    risk 0.59cvss 9.1epss 0.00

    DVP-12SE11T - Password Protection Bypass