| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-0522 | Hig | 0.46 | 7.1 | 0.01 | Feb 8, 2022 | Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2. | ||
| CVE-2022-0521 | Hig | 0.46 | 7.1 | 0.01 | Feb 8, 2022 | Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2. | ||
| CVE-2022-0520 | Hig | 0.51 | 7.8 | 0.01 | Feb 8, 2022 | Use After Free in NPM radare2.js prior to 5.6.2. | ||
| CVE-2022-0519 | Hig | 0.46 | 7.1 | 0.01 | Feb 8, 2022 | Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2. | ||
| CVE-2022-0518 | Hig | 0.46 | 7.1 | 0.01 | Feb 8, 2022 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2. | ||
| CVE-2022-21702 | Med | 0.35 | 6.5 | 0.02 | Feb 8, 2022 | Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting… | ||
| CVE-2022-0139 | Cri | 0.64 | 9.8 | 0.01 | Feb 8, 2022 | Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0. | ||
| CVE-2021-45328 | Med | 0.33 | 6.1 | 0.01 | Feb 8, 2022 | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. | ||
| CVE-2022-0510 | Med | 0.28 | 5.4 | 0.01 | Feb 8, 2022 | Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1. | ||
| CVE-2021-45327 | Cri | 0.57 | 9.8 | 0.02 | Feb 8, 2022 | Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code. | ||
| CVE-2021-45326 | Hig | 0.57 | 8.8 | 0.01 | Feb 8, 2022 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. | ||
| CVE-2021-45325 | Hig | 0.49 | 7.5 | 0.01 | Feb 8, 2022 | Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. | ||
| CVE-2021-44957 | Med | 0.42 | 6.5 | 0.01 | Feb 8, 2022 | Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file. | ||
| CVE-2021-44956 | Med | 0.42 | 6.5 | 0.01 | Feb 8, 2022 | Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file. | ||
| CVE-2021-44864 | Med | 0.43 | 6.5 | 0.10 | Feb 8, 2022 | TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash router httpd services via /userRpm/PingIframeRpm.htm request which contains redundant & in parameter. | ||
| CVE-2022-23340 | Cri | 0.57 | 9.8 | 0.02 | Feb 8, 2022 | Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | ||
| CVE-2022-23331 | Hig | 0.57 | 8.8 | 0.01 | Feb 8, 2022 | In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. | ||
| CVE-2022-0509 | Med | 0.28 | 5.4 | 0.01 | Feb 8, 2022 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1. | ||
| CVE-2022-22146 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2022 | Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2022-22142 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2022 | Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2022-21805 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2022 | Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2022-21799 | Med | 0.34 | 5.2 | 0.00 | Feb 8, 2022 | Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors. | ||
| CVE-2022-21241 | Cri | 0.63 | 9.6 | 0.03 | Feb 8, 2022 | Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag. | ||
| CVE-2022-21193 | Hig | 0.49 | 7.5 | 0.02 | Feb 8, 2022 | Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspecified vectors. | ||
| CVE-2022-21173 | Hig | 0.57 | 8.8 | 0.00 | Feb 8, 2022 | Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S… | ||
| CVE-2022-0508 | Med | 0.28 | 5.3 | 0.01 | Feb 8, 2022 | Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832 | ||
| CVE-2021-20877 | Med | 0.31 | 4.8 | 0.01 | Feb 8, 2022 | Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series… | ||
| CVE-2022-0506 | Med | 0.28 | 5.4 | 0.01 | Feb 8, 2022 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. | ||
| CVE-2022-0505 | Med | 0.35 | 6.5 | 0.01 | Feb 8, 2022 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. | ||
| CVE-2022-0504 | Med | 0.35 | 6.5 | 0.01 | Feb 8, 2022 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. | ||
| CVE-2022-24450 | Hig | 0.57 | 8.8 | 0.01 | Feb 8, 2022 | NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. | ||
| CVE-2022-23624 | Hig | 0.46 | 8.1 | 0.01 | Feb 7, 2022 | Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work… | ||
| CVE-2022-23623 | Hig | 0.46 | 8.1 | 0.01 | Feb 7, 2022 | Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and… | ||
| CVE-2022-23613 | Hig | 0.51 | 7.8 | 0.00 | Feb 7, 2022 | xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability… | ||
| CVE-2022-21712 | Hig | 0.42 | 7.5 | 0.01 | Feb 7, 2022 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent`… | ||
| CVE-2021-45281 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2022 | QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this parameter is not properly sanitized. | ||
| CVE-2021-3861 | Hig | 0.53 | 8.2 | 0.00 | Feb 7, 2022 | The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj | ||
| CVE-2021-3835 | Hig | 0.53 | 8.2 | 0.01 | Feb 7, 2022 | Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf | ||
| CVE-2022-21816 | Med | 0.36 | 5.5 | 0.00 | Feb 7, 2022 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service. | ||
| CVE-2022-21815 | Med | 0.36 | 5.5 | 0.00 | Feb 7, 2022 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash. | ||
| CVE-2022-21814 | Med | 0.40 | 6.1 | 0.00 | Feb 7, 2022 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service. | ||
| CVE-2022-21813 | Med | 0.40 | 6.1 | 0.00 | Feb 7, 2022 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service. | ||
| CVE-2022-22931 | Med | 0.28 | 4.3 | 0.02 | Feb 7, 2022 | Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the… | ||
| CVE-2021-42833 | Cri | 0.60 | 9.3 | 0.00 | Feb 7, 2022 | A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings. | ||
| CVE-2022-23263 | Hig | 0.50 | 7.7 | 0.01 | Feb 7, 2022 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2022-23262 | Med | 0.41 | 6.3 | 0.01 | Feb 7, 2022 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2022-23261 | Med | 0.35 | 5.3 | 0.02 | Feb 7, 2022 | Microsoft Edge (Chromium-based) Tampering Vulnerability | ||
| CVE-2022-0149 | Med | 0.33 | 6.1 | 0.02 | Feb 7, 2022 | The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page. | ||
| CVE-2022-0148 | Med | 0.35 | 5.4 | 0.02 | Feb 7, 2022 | The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. | ||
| CVE-2021-25114 | Cri | 0.63 | 9.8 | 0.82 | Feb 7, 2022 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection |
- risk 0.46cvss 7.1epss 0.01
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
- risk 0.46cvss 7.1epss 0.01
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
- risk 0.51cvss 7.8epss 0.01
Use After Free in NPM radare2.js prior to 5.6.2.
- risk 0.46cvss 7.1epss 0.01
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
- risk 0.46cvss 7.1epss 0.01
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
- risk 0.35cvss 6.5epss 0.02
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting…
- risk 0.64cvss 9.8epss 0.01
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
- risk 0.33cvss 6.1epss 0.01
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
- risk 0.57cvss 9.8epss 0.02
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.
- risk 0.57cvss 8.8epss 0.01
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- risk 0.49cvss 7.5epss 0.01
Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.
- risk 0.42cvss 6.5epss 0.01
Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file.
- risk 0.42cvss 6.5epss 0.01
Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file.
- risk 0.43cvss 6.5epss 0.10
TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash router httpd services via /userRpm/PingIframeRpm.htm request which contains redundant & in parameter.
- risk 0.57cvss 9.8epss 0.02
Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.
- risk 0.57cvss 8.8epss 0.01
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- risk 0.34cvss 5.2epss 0.00
Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors.
- risk 0.63cvss 9.6epss 0.03
Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag.
- risk 0.49cvss 7.5epss 0.02
Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspecified vectors.
- risk 0.57cvss 8.8epss 0.00
Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S…
- risk 0.28cvss 5.3epss 0.01
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series…
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
- risk 0.35cvss 6.5epss 0.01
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
- risk 0.35cvss 6.5epss 0.01
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
- risk 0.57cvss 8.8epss 0.01
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
- risk 0.46cvss 8.1epss 0.01
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work…
- risk 0.46cvss 8.1epss 0.01
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and…
- risk 0.51cvss 7.8epss 0.00
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability…
- risk 0.42cvss 7.5epss 0.01
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent`…
- risk 0.40cvss 6.1epss 0.01
QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this parameter is not properly sanitized.
- risk 0.53cvss 8.2epss 0.00
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
- risk 0.53cvss 8.2epss 0.01
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
- risk 0.36cvss 5.5epss 0.00
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.
- risk 0.36cvss 5.5epss 0.00
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.
- risk 0.40cvss 6.1epss 0.00
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
- risk 0.40cvss 6.1epss 0.00
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
- risk 0.28cvss 4.3epss 0.02
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the…
- risk 0.60cvss 9.3epss 0.00
A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.
- risk 0.50cvss 7.7epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.35cvss 5.3epss 0.02
Microsoft Edge (Chromium-based) Tampering Vulnerability
- risk 0.33cvss 6.1epss 0.02
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
- risk 0.35cvss 5.4epss 0.02
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
- risk 0.63cvss 9.8epss 0.82
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection