VYPR

CVEs

38,061 total · page 230 of 762

AllCriticalHighKEV
  • CVE-2025-48289CriMay 23, 2025
    WordPress
    Kids Planet
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.

  • CVE-2025-48287CriMay 23, 2025
    WordPress
    Pix 4x sem juros - Pagaleve
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.

  • CVE-2025-48283CriMay 23, 2025
    WordPress
    Majestic Support
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.

  • CVE-2025-47687CriMay 23, 2025
    WordPress
    Storekeeper For Woocommerce
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

  • CVE-2025-47663CriMay 23, 2025
    WordPress
    Hospital Management System
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affects Hospital Management System: from 47.0(20 through 11.

  • CVE-2025-47658CriMay 23, 2025
    WordPress
    ELEX WordPress HelpDesk & Customer Ticketing System
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer…

  • CVE-2025-47646CriMay 23, 2025
    WordPress
    PSW Front-end Login & Registration
    risk 0.65cvss 9.8epss 0.25

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.

  • CVE-2025-47642CriMay 23, 2025
    Ajar Productions
    Ajar in5 Embed
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.5.

  • CVE-2025-47641CriMay 23, 2025
    WordPress
    Printcart Web to Print Product Designer for WooCommerce
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a…

  • CVE-2025-47640CriMay 23, 2025
    WordPress
    Printcart Web to Print Product Designer for WooCommerce
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for…

  • CVE-2025-47637CriMay 23, 2025
    STAGGS
    STAGGS
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in STAGGS STAGGS staggs allows Upload a Web Shell to a Web Server.This issue affects STAGGS: from n/a through <= 2.11.0.

  • CVE-2025-47599CriMay 23, 2025
    WordPress
    Facturante
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturante Facturante facturante allows SQL Injection.This issue affects Facturante: from n/a through <= 1.11.

  • CVE-2025-47568CriMay 23, 2025
    Digitalzoomstudio
    Zoomsounds
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.

  • CVE-2025-47539CriMay 23, 2025
    Themewinter
    Eventin
    risk 0.66cvss 9.8epss 0.28

    Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.

  • CVE-2025-47532CriMay 23, 2025
    WordPress
    Coinpayments Payment Gateway For Woocommerce
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.

  • CVE-2025-47530CriMay 23, 2025
    WordPress
    Wpfunnels
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

  • CVE-2025-46539CriMay 23, 2025
    WordPress
    Fable Extra
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFable Fable Extra fable-extra allows Blind SQL Injection.This issue affects Fable Extra: from n/a through <= 1.0.6.

  • CVE-2025-46490CriMay 23, 2025
    Wordwebsoftware
    Crossword Compiler Puzzles
    risk 0.64cvss 9.9epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shell to a Web Server.This issue affects Crossword Compiler Puzzles: from n/a through <= 5.2.

  • CVE-2025-46468CriMay 23, 2025
    WordPress
    Fable Extra
    risk 0.64cvss 9.8epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows PHP Local File Inclusion.This issue affects Fable Extra: from n/a through <= 1.0.6.

  • CVE-2025-46460CriMay 23, 2025
    WordPress
    Wp Easy Guide
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through <= 1.0.0.

  • CVE-2025-46455CriMay 23, 2025
    WordPress
    WP HRM LITE
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through <= 1.1.

  • CVE-2025-39504CriMay 23, 2025
    WordPress
    Goodlayers Hotel
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  • CVE-2025-39503CriMay 23, 2025
    WordPress
    Goodlayers Hotel
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  • CVE-2025-39501CriMay 23, 2025
    Goodlayers
    Goodlayers Hostel
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.4.

  • CVE-2025-39500CriMay 23, 2025
    WordPress
    Goodlayers Hostel
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

  • CVE-2025-39499CriMay 23, 2025
    WordPress
    Medicare
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.

  • CVE-2025-39495CriMay 23, 2025
    WordPress
    Avantage
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.

  • CVE-2025-39489CriMay 23, 2025
    WordPress
    CouponXL
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.

  • CVE-2025-39485CriMay 23, 2025
    Themegoods
    Grand Tour
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

  • CVE-2025-39480CriMay 23, 2025
    WordPress
    Cardealer
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.

  • CVE-2025-32292CriMay 23, 2025
    WordPress
    Jarvis
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.

  • CVE-2025-31927CriMay 23, 2025
    WordPress
    Acerola
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.

  • CVE-2025-31918CriMay 23, 2025
    WordPress
    Simple Business Directory Pro
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.

  • CVE-2025-31916CriMay 23, 2025
    WordPress
    Jp Students Result System Premium
    risk 0.59cvss 9.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.

  • CVE-2025-31914CriMay 23, 2025
    WordPress
    Pixel WordPress Form BuilderPlugin & Autoresponder
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin &…

  • CVE-2025-31631CriMay 23, 2025
    WordPress
    Fish House
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.

  • CVE-2025-31430CriMay 23, 2025
    WordPress
    The Business
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.

  • CVE-2025-31423CriMay 23, 2025
    WordPress
    Umberto
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8.

  • CVE-2025-31397CriMay 23, 2025
    WordPress
    Bus Ticket Booking with Seat Reservation for WooCommerce
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Bus Ticket Booking with Seat Reservation for WooCommerce scw-bus-seat-reservation allows SQL Injection.This issue affects Bus Ticket Booking with Seat Reservation for…

  • CVE-2025-31069CriMay 23, 2025
    WordPress
    HotStar – Multi-Purpose Business Theme
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.

  • CVE-2025-31056CriMay 23, 2025
    WordPress
    WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-for-WooCommerce allows SQL Injection.This issue affects…

  • CVE-2025-31049CriMay 23, 2025
    WordPress
    Dash
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.

  • CVE-2025-3895CriMay 23, 2025
    Megabip
    Megabip
    risk 0.59cvss —epss 0.00

    Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these…

  • CVE-2025-5099CriMay 23, 2025
    Dynamixsoftware
    Printershare
    risk 0.64cvss 9.8epss 0.01

    An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.

  • CVE-2025-5098CriMay 23, 2025
    PrinterShare
    PrinterShare
    risk 0.59cvss 9.1epss 0.00

    PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization.

  • CVE-2025-48373CriMay 22, 2025
    Schule
    Schule
    risk 0.00cvss 9.1epss 0.00

    Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels based on their role. Prior to version 1.0.1, this implementation poses a serious security risk because it assumes that the…

  • CVE-2024-6914CriMay 22, 2025
    Wso2
    Wso2 Carbon Identity Management
    risk 0.64cvss 9.8epss 0.01

    An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account…

  • CVE-2024-41198CriMay 22, 2025
    Ocuco
    Innovation
    risk 0.64cvss 9.8epss 0.01

    An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  • CVE-2024-41197CriMay 22, 2025
    Ocuco
    Innovation
    risk 0.64cvss 9.8epss 0.01

    An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  • CVE-2024-41196CriMay 22, 2025
    Ocuco
    Innovation
    risk 0.64cvss 9.8epss 0.01

    An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.