VYPR

CVEs

9,103 total · page 74 of 183

AllCriticalHighKEV
  • CVE-2025-41438CriMay 30, 2025
    Consilium Safety
    CS5000 Fire Panel
    risk 0.64cvss 9.8epss 0.01

    The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions…

  • CVE-2025-1907CriMay 30, 2025
    Instantel
    Micromate
    risk 0.64cvss 9.8epss 0.01

    Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected.

  • CVE-2025-30466CriMay 29, 2025
    Apple Inc.
    macOS
    risk 0.64cvss 9.8epss 0.00

    This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

  • CVE-2025-48336CriMay 29, 2025
    Thimpress
    Course Builder
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.

  • CVE-2025-48047CriMay 29, 2025
    MICi
    NetFax Server
    risk 0.61cvss —epss 0.11

    An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

  • CVE-2025-3755CriMay 29, 2025
    Mitsubishielectric
    MELSEC iQ-R Series
    risk 0.59cvss 9.1epss 0.01

    Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to read information in the product, to cause a Denial-of-Service (DoS) condition in…

  • CVE-2025-5277CriMay 28, 2025
    Alexei Led
    AWS Mcp Server
    risk 0.55cvss 9.6epss 0.01

    aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system.

  • CVE-2025-4009CriMay 28, 2025
    Evertz
    SDVN 3080ipx-10G
    risk 0.61cvss —epss 0.75

    The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and…

  • CVE-2025-41652CriMay 27, 2025
    risk 0.64cvss 9.8epss 0.00

    The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge…

  • CVE-2025-41651CriMay 27, 2025
    risk 0.64cvss 9.8epss 0.01

    Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.

  • CVE-2025-2407CriMay 27, 2025
    Mobatime
    AMX MTAPI
    risk 0.60cvss —epss 0.00

    Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

  • CVE-2025-23394CriMay 26, 2025
    OpenSUSE
    cyrus-imapd
    risk 0.64cvss 9.8epss 0.00

    A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

  • CVE-2025-40671CriMay 26, 2025
    AES Multimedia
    Gestnet
    risk 0.60cvss —epss 0.00

    SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.

  • CVE-2025-5058CriMay 24, 2025
    Emagicone
    Emagicone Store Manager For Woocommerce
    risk 0.57cvss 9.8epss 0.01

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload…

  • CVE-2025-4603CriMay 24, 2025
    Emagicone
    Emagicone Store Manager For Woocommerce
    risk 0.52cvss 9.1epss 0.01

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to…

  • CVE-2025-48289CriMay 23, 2025
    Ancorathemes
    Kids Planet
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.

  • CVE-2025-48287CriMay 23, 2025
    Pagaleve
    wc-pagaleve
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.

  • CVE-2025-48283CriMay 23, 2025
    WordPress
    Majestic Support
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.

  • CVE-2025-47687CriMay 23, 2025
    WordPress
    Storekeeper For Woocommerce
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

  • CVE-2025-47663CriMay 23, 2025
    Dasinfomedia
    Hospital Management System
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affects Hospital Management System: from 47.0(20 through 11.

  • CVE-2025-47658CriMay 23, 2025
    ELEX
    ELEX WordPress HelpDesk & Customer Ticketing System
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer…

  • CVE-2025-47646CriMay 23, 2025
    Gilblas Ngunte Possi
    PSW Front-end Login & Registration
    risk 0.64cvss 9.8epss 0.22

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.

  • CVE-2025-47642CriMay 23, 2025
    Ajar Productions
    Ajar in5 Embed
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.5.

  • CVE-2025-47641CriMay 23, 2025
    WordPress
    Printcart Integration
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a…

  • CVE-2025-47640CriMay 23, 2025
    WordPress
    Printcart Integration
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for…

  • CVE-2025-47637CriMay 23, 2025
    WordPress
    Staggs
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in STAGGS STAGGS staggs allows Upload a Web Shell to a Web Server.This issue affects STAGGS: from n/a through <= 2.11.0.

  • CVE-2025-47599CriMay 23, 2025
    WordPress
    Facturante
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturante Facturante facturante allows SQL Injection.This issue affects Facturante: from n/a through <= 1.11.

  • CVE-2025-47568CriMay 23, 2025
    Digitalzoomstudio
    Zoomsounds
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.

  • CVE-2025-47539CriMay 23, 2025
    Themewinter
    Eventin
    risk 0.66cvss 9.8epss 0.30

    Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.

  • CVE-2025-47532CriMay 23, 2025
    WordPress
    Coinpayments Payment Gateway For Woocommerce
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.

  • CVE-2025-47530CriMay 23, 2025
    Getwpfunnels
    Wpfunnels
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.

  • CVE-2025-46539CriMay 23, 2025
    WordPress
    Fable Extra
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFable Fable Extra fable-extra allows Blind SQL Injection.This issue affects Fable Extra: from n/a through <= 1.0.6.

  • CVE-2025-46490CriMay 23, 2025
    WordPress
    Crossword Compiler Puzzles
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shell to a Web Server.This issue affects Crossword Compiler Puzzles: from n/a through <= 5.2.

  • CVE-2025-46468CriMay 23, 2025
    WordPress
    Fable Extra
    risk 0.64cvss 9.8epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows PHP Local File Inclusion.This issue affects Fable Extra: from n/a through <= 1.0.6.

  • CVE-2025-46460CriMay 23, 2025
    WordPress
    Wp Easy Guide
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through <= 1.0.0.

  • CVE-2025-46455CriMay 23, 2025
    IndigoThemes
    WP HRM LITE
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through <= 1.1.

  • CVE-2025-39504CriMay 23, 2025
    Goodlayers
    Goodlayers Hostel
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  • CVE-2025-39503CriMay 23, 2025
    Goodlayers
    Goodlayers Hostel
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  • CVE-2025-39501CriMay 23, 2025
    Goodlayers
    Goodlayers Hostel
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.4.

  • CVE-2025-39500CriMay 23, 2025
    Goodlayers
    Goodlayers Hostel
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

  • CVE-2025-39499CriMay 23, 2025
    Bold Themes
    Medicare
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.

  • CVE-2025-39495CriMay 23, 2025
    Bold Themes
    Avantage
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.

  • CVE-2025-39489CriMay 23, 2025
    pebas
    CouponXL
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.

  • CVE-2025-39485CriMay 23, 2025
    Themegoods
    Grand Tour
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

  • CVE-2025-39480CriMay 23, 2025
    ThemeMakers
    Car Dealer
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.

  • CVE-2025-32292CriMay 23, 2025
    Ancorathemes
    Jarvis
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.

  • CVE-2025-31927CriMay 23, 2025
    WordPress
    Acerola
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.

  • CVE-2025-31918CriMay 23, 2025
    WordPress
    Simple Business Directory Pro
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.

  • CVE-2025-31916CriMay 23, 2025
    WordPress
    Jp Students Result System Premium
    risk 0.59cvss 9.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.

  • CVE-2025-31914CriMay 23, 2025
    kamleshyadav
    Pixel WordPress Form BuilderPlugin & Autoresponder
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin &…