VYPR

CVEs

116,949 total · page 653 of 2,339

AllCriticalHighKEV
  • CVE-2025-40776HigJul 16, 2025
    Isc
    Bind
    risk 0.56cvss 8.6epss 0.00

    A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.

  • CVE-2025-40923HigJul 16, 2025
    Plack Project
    Plack Middleware Session
    risk 0.40cvss 7.3epss 0.00

    Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time…

  • CVE-2025-53757HigJul 16, 2025
    Digisol
    DG-GR6821AC
    risk 0.57cvss —epss 0.00

    This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an…

  • CVE-2025-53756HigJul 16, 2025
    Digisol
    DG-GR6821AC
    risk 0.57cvss —epss 0.00

    This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could exploit this vulnerability by intercepting the network traffic and capturing cleartext credentials. Successful…

  • CVE-2025-52819HigJul 16, 2025
    WordPress
    Pakke Envíos
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2.

  • CVE-2025-52804HigJul 16, 2025
    WordPress
    Nuss
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a through <= 1.3.7.1.

  • CVE-2025-52803HigJul 16, 2025
    WordPress
    Sala
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in uxper Sala allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sala: from n/a through 1.1.3.

  • CVE-2025-52787HigJul 16, 2025
    WordPress
    Tennis Court Bookings
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings allows Reflected XSS.This issue affects Tennis Court Bookings: from n/a through <= 1.2.7.

  • CVE-2025-52786HigJul 16, 2025
    WordPress
    Media Folder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.

  • CVE-2025-52779HigJul 16, 2025
    WordPress
    Dot Htmlphpxml Etc Pages
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.

  • CVE-2025-52777HigJul 16, 2025
    WordPress
    Pay With Contact Form 7
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Reflected XSS.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.

  • CVE-2025-49888HigJul 16, 2025
    WordPress
    Pw Woocommerce On Sale
    risk 0.46cvss 7.1epss 0.00

    Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PW WooCommerce On Sale!: from n/a through <= 1.39.

  • CVE-2025-49876HigJul 16, 2025
    WordPress
    Profilegrid
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.

  • CVE-2025-49034HigJul 16, 2025
    WordPress
    Funnel Builder by FunnelKit
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.

  • CVE-2025-49031HigJul 16, 2025
    WordPress
    SMu Manual DoFollow
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through <= 1.8.1.

  • CVE-2025-48345HigJul 16, 2025
    WordPress
    Contact Form 7 Select Box Editor Button
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button allows Reflected XSS.This issue affects Contact Form 7 Editor Button: from n/a through <= 1.0.0.

  • CVE-2025-48291HigJul 16, 2025
    WordPress
    Contest Gallery
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.

  • CVE-2025-47652HigJul 16, 2025
    Infility
    Infility Global
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.

  • CVE-2025-47645HigJul 16, 2025
    WordPress
    ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue…

  • CVE-2025-47554HigJul 16, 2025
    WordPress
    CSS3 Compare Pricing Tables for WordPress
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a…

  • CVE-2025-46500HigJul 16, 2025
    WordPress
    Wordpress Auto Spinner
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.

  • CVE-2025-32574HigJul 16, 2025
    WordPress
    WPGYM
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows SQL Injection. This issue affects WPGYM: from n/a through 65.0.

  • CVE-2025-31427HigJul 16, 2025
    WordPress
    Invico - WordPress Consulting Business Theme
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.

  • CVE-2025-31422HigJul 16, 2025
    WordPress
    Visual Art | Gallery WordPress Theme
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through <= 2.4.

  • CVE-2025-31072HigJul 16, 2025
    WordPress
    Ofiz - WordPress Business Consulting Theme
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through <= 2.0.

  • CVE-2025-31070HigJul 16, 2025
    WordPress
    HTML5 Radio Player - WPBakery Page Builder Addon
    risk 0.49cvss 7.5epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a…

  • CVE-2025-31055HigJul 16, 2025
    WordPress
    Electrician - Electrical Service
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 1.0.

  • CVE-2025-30955HigJul 16, 2025
    WordPress
    Listingeasy
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes ListingEasy listingeasy allows Reflected XSS.This issue affects ListingEasy: from n/a through <= 1.9.2.

  • CVE-2025-29000HigJul 16, 2025
    August Infotech
    Multi-language Responsive Contact Form
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Multi-language Responsive Contact Form: from n/a through <= 2.8.

  • CVE-2025-28965HigJul 16, 2025
    Md Yeasin Ul Haider
    URL Shortener
    risk 0.56cvss 8.6epss 0.00

    Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects URL Shortener: from n/a through <= 3.0.7.

  • CVE-2025-28955HigJul 16, 2025
    WordPress
    Easy Video Player
    risk 0.49cvss 7.5epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allows Path Traversal.This issue affects Easy Video Player Wordpress & WooCommerce: from n/a through <= 10.0.

  • CVE-2025-24779HigJul 16, 2025
    WordPress
    Yogi
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3.

  • CVE-2025-24777HigJul 16, 2025
    WordPress
    Hillter
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7.

  • CVE-2025-54043HigJul 16, 2025
    WordPress
    SMTP for Amazon SES
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQL Injection.This issue affects SMTP for Amazon SES: from n/a through <= 1.9.

  • CVE-2025-54026HigJul 16, 2025
    WordPress
    GymBase Theme Classes
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuanticaLabs GymBase Theme Classes gymbase_classes allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through <= 1.4.

  • CVE-2025-53990HigJul 16, 2025
    WordPress
    Jetformbuilder
    risk 0.47cvss 7.2epss 0.00

    Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.

  • CVE-2025-48301HigJul 16, 2025
    Yaycommerce
    SMTP for SendGrid – YaySMTP
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid allows SQL Injection.This issue affects SMTP for SendGrid – YaySMTP: from n/a through <= 1.5.

  • CVE-2025-48299HigJul 16, 2025
    Yaycommerce
    YayExtra
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

  • CVE-2025-48161HigJul 16, 2025
    WordPress
    Yaysmtp
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection.This issue affects YaySMTP: from n/a through <= 1.3.

  • CVE-2025-48153HigJul 16, 2025
    Atakan
    Import CDN-Remote Images
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.

  • CVE-2025-7699HigJul 16, 2025
    Asustor
    Adm
    risk 0.46cvss —epss 0.00

    An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on the file parameter…

  • CVE-2025-6993HigJul 16, 2025
    WordPress
    Ultimate Wp Mail
    risk 0.49cvss 7.5epss 0.00

    The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the corresponding email log post…

  • CVE-2025-40985HigJul 16, 2025
    SCATI Labs
    SCATI Vision Web
    risk 0.54cvss —epss 0.00

    SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.

  • CVE-2025-7359HigJul 16, 2025
    WordPress
    Counter Visitor For Woocommerce
    risk 0.46cvss 8.2epss 0.00

    The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers…

  • CVE-2025-6043HigJul 16, 2025
    WordPress
    Malcure Malware Scanner
    risk 0.53cvss 8.1epss 0.01

    The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmr_delete_file() function in all versions up to, and including, 17.0. This makes it possible for…

  • CVE-2025-52690HigJul 16, 2025
    risk 0.53cvss 8.1epss 0.11

    Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.

  • CVE-2025-2800HigJul 16, 2025
    WordPress
    Wp Event Manager
    risk 0.40cvss 7.2epss 0.00

    The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and…

  • CVE-2025-53028HigJul 15, 2025
    Oracle Corporation
    VM Virtualbox
    risk 0.53cvss 8.2epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes…

  • CVE-2025-53027HigJul 15, 2025
    Oracle Corporation
    VM Virtualbox
    risk 0.53cvss 8.2epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes…

  • CVE-2025-53024HigJul 15, 2025
    Oracle Corporation
    VM Virtualbox
    risk 0.53cvss 8.2epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes…