VYPR

CVEs

411,135 total · page 2136 of 8,223

AllCriticalHighKEV
  • CVE-2025-49922MedOct 22, 2025
    Etruel
    Wpematico Rss Feed Fetcher
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.

  • CVE-2025-49921HigOct 22, 2025
    WordPress
    JetReviews
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.

  • CVE-2025-49920MedOct 22, 2025
    WordPress
    Web Accessibility by accessiBe
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.

  • CVE-2025-49917MedOct 22, 2025
    Icegram
    Icegram Express
    risk 0.29cvss 4.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through <= 5.9.5.

  • CVE-2025-49916HigOct 22, 2025
    Multivendorx
    dc-woocommerce-multi-vendor
    risk 0.56cvss 8.6epss 0.00

    Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.

  • CVE-2025-49915CriOct 22, 2025
    WordPress
    SMS Alert Order Notifications
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.5.

  • CVE-2025-49913MedOct 22, 2025
    Coschedule
    coschedule-by-todaymade
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.

  • CVE-2025-49912MedOct 22, 2025
    WordPress
    Email Subscription Popup
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26.

  • CVE-2025-49911HigOct 22, 2025
    WordPress
    WooCommerce Vehicle Parts Finder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.

  • CVE-2025-49910HigOct 22, 2025
    AmentoTech
    WPGuppy Lite
    risk 0.53cvss 8.2epss 0.00

    Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.

  • CVE-2025-49908MedOct 22, 2025
    WordPress
    WPC Countdown Timer for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.

  • CVE-2025-49907MedOct 22, 2025
    WordPress
    MDTF
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.

  • CVE-2025-49906MedOct 22, 2025
    WordPress
    Wpcomplete
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.

  • CVE-2025-49903MedOct 22, 2025
    WordPress
    Zoloblocks
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.

  • CVE-2025-49901CriOct 22, 2025
    Quantumcloud
    qc-simple-link-directory
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.

  • CVE-2025-49899MedOct 22, 2025
    WordPress
    Whydonate
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.

  • CVE-2025-49380CriOct 22, 2025
    WordPress
    WooCommerce Vehicle Parts Finder
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.

  • CVE-2025-49378HigOct 22, 2025
    WordPress
    Hydra Booking
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.

  • CVE-2025-49377MedOct 22, 2025
    WordPress
    Hydra Booking
    risk 0.41cvss 6.3epss 0.00

    Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.

  • CVE-2025-49376MedOct 22, 2025
    WordPress
    Delucks Seo
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.

  • CVE-2025-49374MedOct 22, 2025
    WordPress
    Captcha Eu
    risk 0.35cvss 5.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61.

  • CVE-2025-49373MedOct 22, 2025
    WordPress
    Evergreen Content Poster
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Cross Site Request Forgery.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5.

  • CVE-2025-49060CriOct 22, 2025
    WordPress
    Wastia
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3.

  • CVE-2025-48338HigOct 22, 2025
    Kevon Adonis
    wp-abstracts-manuscripts-manager
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through <= 2.7.4.

  • CVE-2025-48106CriOct 22, 2025
    WordPress
    Clanora
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1.

  • CVE-2025-48099MedOct 22, 2025
    WordPress
    Search Filter
    risk 0.31cvss 4.7epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17.

  • CVE-2025-48098HigOct 22, 2025
    WordPress
    Survey Maker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.

  • CVE-2025-48097HigOct 22, 2025
    Shiva
    wsanalytics-google-analytics-and-dashboards
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.

  • CVE-2025-48096MedOct 22, 2025
    WordPress
    My Custom CSS
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.

  • CVE-2025-48095MedOct 22, 2025
    WordPress
    Survey Maker
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.

  • CVE-2025-48093HigOct 22, 2025
    WordPress
    Password Only Login
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.

  • CVE-2025-48092HigOct 22, 2025
    WordPress
    Fix Multiple Redirects
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3.

  • CVE-2025-48091HigOct 22, 2025
    WordPress
    Anycomment
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6.

  • CVE-2025-48082HigOct 22, 2025
    Progress (organisation)
    Progress
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Planner: from n/a through <= 1.8.0.

  • CVE-2025-39534HigOct 22, 2025
    WordPress
    Terms Dictionary
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.

  • CVE-2025-32657HigOct 22, 2025
    WordPress
    Testimonial Slider And Showcase
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And…

  • CVE-2025-32283HigOct 22, 2025
    WordPress
    Solar Energy
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.

  • CVE-2025-31634HigOct 22, 2025
    WordPress
    Insurance
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.

  • CVE-2025-30944HigOct 22, 2025
    WordPress
    Tablesome Premium
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23.

  • CVE-2025-11966MedOct 22, 2025
    Eclipse
    Vert.x
    risk 0.42cvss 6.4epss 0.00

    In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or…

  • CVE-2025-11965HigOct 22, 2025
    Eclipse
    Vert.x
    risk 0.49cvss 7.5epss 0.01

    In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').

  • CVE-2016-15048CriOct 22, 2025
    Amtt
    Hibos
    risk 0.64cvss 9.8epss 0.07

    AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper…

  • CVE-2025-8848MedOct 22, 2025
    Librechat
    Librechat
    risk 0.35cvss 5.4epss 0.00

    A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response.…

  • CVE-2025-61035HigOct 22, 2025
    Pypi
    Seffaflik
    risk 0.50cvss 7.7epss 0.00

    The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file, which is created with mode 0777 and 0775 respectively, exposing secrets to other local users. Additionally, the .kimlik file is written…

  • CVE-2025-56447CriOct 22, 2025
    RT-Systems
    TM2 Monitoring
    risk 0.64cvss 9.8epss 0.00

    TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.

  • CVE-2025-11844MedOct 22, 2025
    Huggingface
    Smolagents
    risk 0.28cvss 5.4epss 0.00

    Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression…

  • CVE-2025-11750MedOct 22, 2025
    Langgenius
    Dify
    risk 0.35cvss 5.3epss 0.01

    In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or…

  • CVE-2023-53732Oct 22, 2025
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL dereference in ni_write_inode. When creating a new inode, if allocation fails in mi_init function (called in mi_format_new function),…

  • CVE-2023-53731Oct 22, 2025
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for…

  • CVE-2023-53730Oct 22, 2025
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled when unlock. DEADLOCK might happen if we have held other locks and…