VYPR

CVEs

115,853 total · page 779 of 2,318

AllCriticalHighKEV
  • CVE-2025-1338HigFeb 16, 2025
    Nuuo
    Camera
    risk 0.52cvss 7.3epss 0.51

    A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /handle_config.php. The manipulation of the argument log leads to command injection. The attack can be initiated remotely.…

  • CVE-2024-13488HigFeb 15, 2025
    WordPress
    Estes Edition
    risk 0.49cvss 7.5epss 0.01

    The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient…

  • CVE-2025-0997HigFeb 15, 2025
    Google
    Chrome
    risk 0.53cvss 8.1epss 0.00

    Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

  • CVE-2025-0995HigFeb 15, 2025
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.00

    Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  • CVE-2025-26819HigFeb 15, 2025
    Getmonero
    Monero
    risk 0.00cvss 8.6epss 0.01

    Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.

  • CVE-2024-5462HigFeb 15, 2025
    Brocade
    Fabric OS
    risk 0.49cvss 7.5epss 0.00

    If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsave capture if…

  • CVE-2024-5461HigFeb 15, 2025
    Brocade
    6547 (FC5022) embedded switch blade
    risk 0.52cvss 8.0epss 0.00

    Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP…

  • CVE-2025-0593HigFeb 14, 2025
    risk 0.57cvss 8.8epss 0.01

    The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.

  • CVE-2025-0592HigFeb 14, 2025
    SICK AG
    CYBERSECURITY BY SICK
    risk 0.57cvss 8.8epss 0.00

    The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.

  • CVE-2022-26083HigFeb 14, 2025
    Intel
    IPP Cryptography software library
    risk 0.49cvss 7.5epss 0.00

    Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access.

  • CVE-2025-25297HigFeb 14, 2025
    Humansignal
    Label Studio
    risk 0.49cvss 8.6epss 0.01

    Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows…

  • CVE-2025-26156HigFeb 14, 2025
    Phpgurukul
    Online Shopping Portal
    risk 0.57cvss 8.8epss 0.01

    A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.

  • CVE-2025-25997HigFeb 14, 2025
    Feminer
    wms
    risk 0.49cvss 7.5epss 0.01

    Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component.

  • CVE-2025-25994HigFeb 14, 2025
    Feminer
    wms
    risk 0.49cvss 7.5epss 0.00

    SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.

  • CVE-2025-25295HigFeb 14, 2025
    Humansignal
    Label Studio SDK
    risk 0.50cvss —epss 0.01

    Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These…

  • CVE-2025-25206HigFeb 14, 2025
    Elabftw
    Elabftw
    risk 0.54cvss 8.3epss 0.00

    eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to…

  • CVE-2024-8893HigFeb 14, 2025
    GoodWe Technologies Co., Ltd.
    GW1500-XS
    risk 0.47cvss 7.3epss 0.00

    Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1.

  • CVE-2025-25745HigFeb 14, 2025
    Dlink
    DIR-853
    risk 0.57cvss 8.8epss 0.01

    D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.

  • CVE-2024-57778HigFeb 14, 2025
    Orbe
    ONetView Roeador Onet-1200
    risk 0.57cvss 8.8epss 0.01

    An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.

  • CVE-2024-12651HigFeb 14, 2025
    PTT Inc.
    HGS Mobile App
    risk 0.55cvss 8.5epss 0.00

    Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0.

  • CVE-2025-24700HigFeb 14, 2025
    Xylusthemes
    Wp Event Aggregator
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.

  • CVE-2025-24699HigFeb 14, 2025
    WordPress
    Wp Coder
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.

  • CVE-2025-24692HigFeb 14, 2025
    WordPress
    Bulk Menu Edit
    risk 0.46cvss 7.1epss 0.00

    Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Menu Edit: from n/a through <= 1.3.

  • CVE-2025-24688HigFeb 14, 2025
    WordPress
    Wp Mailster
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.20.0.

  • CVE-2025-24641HigFeb 14, 2025
    WordPress
    Better WishList API
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.

  • CVE-2025-24617HigFeb 14, 2025
    WordPress
    AcyMailing SMTP Newsletter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.1.

  • CVE-2025-24616HigFeb 14, 2025
    WordPress
    Uix Page Builder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through <= 1.7.3.

  • CVE-2025-24615HigFeb 14, 2025
    WordPress
    Analytics Cat
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.

  • CVE-2025-24614HigFeb 14, 2025
    WordPress
    Post Timeline
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Post Timeline post-timeline allows Reflected XSS.This issue affects Post Timeline: from n/a through <= 2.3.9.

  • CVE-2025-24592HigFeb 14, 2025
    WordPress
    Customize My Account For Woocommerce
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce allows Reflected XSS.This issue affects Customize My Account for WooCommerce: from n/a…

  • CVE-2025-24566HigFeb 14, 2025
    DeepPresentation
    Intro Tour Tutorial DeepPresentation
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-intro-tours allows Reflected XSS.This issue affects Intro Tour Tutorial DeepPresentation: from n/a through <= 6.5.2.

  • CVE-2025-24565HigFeb 14, 2025
    WordPress
    Wp2leads
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.3.3.

  • CVE-2025-24564HigFeb 14, 2025
    WordPress
    Contact Form With Shortcode
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through <= 4.2.5.

  • CVE-2025-24558HigFeb 14, 2025
    WordPress
    CRM Perks support-x
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.5.

  • CVE-2025-24554HigFeb 14, 2025
    WordPress
    Awcode Toolkit
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.

  • CVE-2025-23905HigFeb 14, 2025
    WordPress
    Admin Options Pages
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through <= 0.9.7.

  • CVE-2025-23857HigFeb 14, 2025
    Smartdatasoft
    Essential Wp Real Estate
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-estate allows Reflected XSS.This issue affects Essential WP Real Estate: from n/a through <= 1.1.3.

  • CVE-2025-23853HigFeb 14, 2025
    WordPress
    Nofollow Free
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free nofollow-free allows Reflected XSS.This issue affects NoFollow Free: from n/a through <= 1.6.3.

  • CVE-2025-23851HigFeb 14, 2025
    WordPress
    Coronavirus (COVID-19) Outbreak Data Widgets
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets coronavirus-data-widgets allows Reflected XSS.This issue affects Coronavirus (COVID-19) Outbreak Data Widgets: from…

  • CVE-2025-23790HigFeb 14, 2025
    WordPress
    Easy Code Placement
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.

  • CVE-2025-23789HigFeb 14, 2025
    WordPress
    Broken Link Checker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion…

  • CVE-2025-23788HigFeb 14, 2025
    WordPress
    Easy Filter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roni Saha Easy Filter easy-filter allows Reflected XSS.This issue affects Easy Filter: from n/a through <= 1.10.

  • CVE-2025-23787HigFeb 14, 2025
    WordPress
    Easy Bet
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Easy Bet easy-bet allows Reflected XSS.This issue affects Easy Bet: from n/a through <= 1.0.7.

  • CVE-2025-23786HigFeb 14, 2025
    WordPress
    Email To Download
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through <= 3.1.0.

  • CVE-2025-23751HigFeb 14, 2025
    WordPress
    Data Dash
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Reflected XSS.This issue affects Data Dash: from n/a through <= 1.2.3.

  • CVE-2025-23750HigFeb 14, 2025
    WordPress
    Custom Widget Creator
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator custom-widget-creator allows Reflected XSS.This issue affects Custom Widget Creator: from n/a through <= 1.0.5.

  • CVE-2025-23748HigFeb 14, 2025
    WordPress
    Awesome Gallery
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Singsys Singsys -Awesome Gallery awesome-gallery-singsys allows Reflected XSS.This issue affects Singsys -Awesome Gallery: from n/a through <= 1.0.

  • CVE-2025-23742HigFeb 14, 2025
    WordPress
    Podamibe Twilio Private Call
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a through <= 1.0.1.

  • CVE-2025-23658HigFeb 14, 2025
    Tauhidul Alam
    Advanced Angular Contact Form
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.

  • CVE-2025-23657HigFeb 14, 2025
    RusAlex
    WordPress-to-candidate for Salesforce CRM
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a…