| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11200 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field. | ||
| CVE-2019-4565 | Hig | 0.49 | 7.5 | 0.01 | Sep 20, 2019 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166626. | ||
| CVE-2019-4505 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364. | ||
| CVE-2019-16644 | Cri | 0.64 | 9.8 | 0.01 | Sep 20, 2019 | App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. | ||
| CVE-2019-16643 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area. | ||
| CVE-2019-16534 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product. | ||
| CVE-2019-16533 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product. | ||
| CVE-2015-9408 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. | ||
| CVE-2015-9407 | Med | 0.40 | 6.1 | 0.02 | Sep 20, 2019 | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. | ||
| CVE-2015-9405 | Med | 0.33 | 6.1 | 0.01 | Sep 20, 2019 | The wp-piwik plugin before 1.0.5 for WordPress has XSS. | ||
| CVE-2015-9404 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | ||
| CVE-2015-9403 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | ||
| CVE-2015-9402 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. | ||
| CVE-2015-9401 | Med | 0.31 | 4.8 | 0.01 | Sep 20, 2019 | The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. | ||
| CVE-2015-9400 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. | ||
| CVE-2015-9399 | Hig | 0.47 | 7.2 | 0.02 | Sep 20, 2019 | The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. | ||
| CVE-2015-9398 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. | ||
| CVE-2015-9397 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. | ||
| CVE-2015-9396 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. | ||
| CVE-2015-9395 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. | ||
| CVE-2015-9394 | Hig | 0.57 | 8.8 | 0.01 | Sep 20, 2019 | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. | ||
| CVE-2015-9393 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. | ||
| CVE-2015-9392 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. | ||
| CVE-2019-16642 | Cri | 0.64 | 9.8 | 0.02 | Sep 20, 2019 | App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring. | ||
| CVE-2016-11013 | Med | 0.33 | 6.1 | 0.01 | Sep 20, 2019 | The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS. | ||
| CVE-2016-11012 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. | ||
| CVE-2016-11011 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. | ||
| CVE-2016-11010 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. | ||
| CVE-2016-11009 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. | ||
| CVE-2016-11008 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. | ||
| CVE-2016-11007 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. | ||
| CVE-2016-11006 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. | ||
| CVE-2016-11005 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. | ||
| CVE-2016-11004 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. | ||
| CVE-2016-11003 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. | ||
| CVE-2016-11002 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. | ||
| CVE-2016-11001 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. | ||
| CVE-2016-11000 | Cri | 0.64 | 9.8 | 0.02 | Sep 20, 2019 | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | ||
| CVE-2016-10999 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. | ||
| CVE-2016-10998 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. | ||
| CVE-2016-10997 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. | ||
| CVE-2016-10996 | Med | 0.35 | 5.3 | 0.01 | Sep 20, 2019 | The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. | ||
| CVE-2015-9391 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. | ||
| CVE-2015-9390 | Med | 0.28 | 4.3 | 0.01 | Sep 20, 2019 | The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. | ||
| CVE-2015-9389 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. | ||
| CVE-2015-9388 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. | ||
| CVE-2015-9387 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. | ||
| CVE-2015-9386 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. | ||
| CVE-2015-9385 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | ||
| CVE-2015-9384 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The relevant plugin before 1.0.8 for WordPress has XSS. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- risk 0.49cvss 7.5epss 0.01
IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166626.
- risk 0.35cvss 5.3epss 0.02
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364.
- risk 0.64cvss 9.8epss 0.01
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.
- risk 0.40cvss 6.1epss 0.01
On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.
- risk 0.40cvss 6.1epss 0.01
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.
- risk 0.42cvss 6.5epss 0.01
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
- risk 0.40cvss 6.1epss 0.02
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
- risk 0.33cvss 6.1epss 0.01
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
- risk 0.57cvss 8.8epss 0.02
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
- risk 0.31cvss 4.8epss 0.01
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
- risk 0.57cvss 8.8epss 0.02
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
- risk 0.47cvss 7.2epss 0.02
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
- risk 0.57cvss 8.8epss 0.02
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
- risk 0.35cvss 5.4epss 0.01
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
- risk 0.40cvss 6.1epss 0.01
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
- risk 0.57cvss 8.8epss 0.02
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
- risk 0.57cvss 8.8epss 0.01
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
- risk 0.35cvss 5.4epss 0.01
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
- risk 0.35cvss 5.4epss 0.01
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
- risk 0.64cvss 9.8epss 0.02
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.
- risk 0.33cvss 6.1epss 0.01
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
- risk 0.35cvss 5.4epss 0.01
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
- risk 0.42cvss 6.5epss 0.01
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
- risk 0.40cvss 6.1epss 0.01
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
- risk 0.57cvss 8.8epss 0.02
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
- risk 0.57cvss 8.8epss 0.02
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
- risk 0.57cvss 8.8epss 0.02
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
- risk 0.40cvss 6.1epss 0.01
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
- risk 0.64cvss 9.8epss 0.02
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
- risk 0.40cvss 6.1epss 0.01
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.01
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
- risk 0.42cvss 6.5epss 0.01
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
- risk 0.35cvss 5.3epss 0.01
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
- risk 0.40cvss 6.1epss 0.01
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
- risk 0.28cvss 4.3epss 0.01
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
- risk 0.35cvss 5.4epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
- risk 0.42cvss 6.5epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
- risk 0.42cvss 6.5epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
- risk 0.40cvss 6.1epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
- risk 0.40cvss 6.1epss 0.01
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The relevant plugin before 1.0.8 for WordPress has XSS.