VYPR

CVEs

130,801 total · page 891 of 2,617

AllCriticalHighKEV
  • CVE-2025-53230HigAug 28, 2025
    WordPress
    Page Manager For Elementor
    risk 0.49cvss 7.6epss 0.00

    Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.

  • CVE-2025-53227HigAug 28, 2025
    WordPress
    Magazine Saga
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Saga magazine-saga allows PHP Local File Inclusion.This issue affects Magazine Saga: from n/a through <= 1.2.7.

  • CVE-2025-53225HigAug 28, 2025
    WordPress
    E Boekhoudennl Connector
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allows Reflected XSS.This issue affects e-Boekhouden.nl: from n/a through <= 1.9.3.

  • CVE-2025-53224HigAug 28, 2025
    WordPress
    NextGEN Gallery Search
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search-galleries allows Reflected XSS.This issue affects NextGEN Gallery Search: from n/a through <= 2.12.

  • CVE-2025-53223HigAug 28, 2025
    WordPress
    Theme Switcher Reloaded
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded allows Reflected XSS.This issue affects Theme Switcher Reloaded: from n/a through <= 1.1.

  • CVE-2025-53220HigAug 28, 2025
    WordPress
    Xmasb Quotes
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This issue affects XmasB Quotes: from n/a through <= 1.6.1.

  • CVE-2025-53216HigAug 28, 2025
    WordPress
    glamer
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeuniver Glamer glamer allows PHP Local File Inclusion.This issue affects Glamer: from n/a through <= 1.0.2.

  • CVE-2025-53215HigAug 28, 2025
    WordPress
    Yahoo Media Player
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflected XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.

  • CVE-2025-49407HigAug 28, 2025
    WordPress
    Houzez
    risk 0.57cvss 8.8epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

  • CVE-2025-49404HigAug 28, 2025
    WordPress
    Listeo Core
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.This issue affects Listeo Core: from n/a through < 2.0.7.

  • CVE-2025-49402HigAug 28, 2025
    Scriptsbundle
    Exertio Framework
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exertio-framework allows Blind SQL Injection.This issue affects Exertio Framework: from n/a through <= 1.3.3.

  • CVE-2025-49383HigAug 28, 2025
    WordPress
    neresa-wp
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa neresa-wp allows PHP Local File Inclusion.This issue affects Neresa: from n/a through <= 1.3.

  • CVE-2025-48359HigAug 28, 2025
    WordPress
    ATT YouTube Widget
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through <= 1.0.

  • CVE-2025-48353HigAug 28, 2025
    WordPress
    Clickbank WordPress Plugin (Storefront)
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through <= 1.3.5.

  • CVE-2025-48351HigAug 28, 2025
    WordPress
    Kento Splash Screen
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Screen: from n/a through <= 1.4.

  • CVE-2025-48343HigAug 28, 2025
    WordPress
    WPMU Ldap Authentication
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through <= 5.0.1.

  • CVE-2025-48325HigAug 28, 2025
    WordPress
    Wp Admin Theme
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a through <= 1.0.

  • CVE-2025-48321HigAug 28, 2025
    WordPress
    Ultimate Twitter Profile Widget
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through <= 1.0.

  • CVE-2025-48320HigAug 28, 2025
    WordPress
    Baidushare Wp
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6.

  • CVE-2025-48311HigAug 28, 2025
    WordPress
    Invisible Optin
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through <= 1.0.

  • CVE-2025-48309HigAug 28, 2025
    WordPress
    Betpress
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite.

  • CVE-2025-48308HigAug 28, 2025
    WordPress
    Newsletter subscription optin module
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.

  • CVE-2025-48307HigAug 28, 2025
    WordPress
    SEO For Images
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through <= 1.0.0.

  • CVE-2025-48306HigAug 28, 2025
    WordPress
    Savyour Affiliate Partner
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through <= 2.1.4.

  • CVE-2025-48304HigAug 28, 2025
    WordPress
    Google XML News Sitemap
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML News Sitemap plugin: from n/a through <= 0.02.

  • CVE-2025-48109HigAug 28, 2025
    WordPress
    Xm Backup
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1.

  • CVE-2025-48963HigAug 28, 2025
    Acronis
    Acronis Cyber Protect Cloud Agent
    risk 0.47cvss 7.3epss 0.00

    Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.

  • CVE-2025-58081HigAug 28, 2025
    risk 0.49cvss 7.5epss 0.00

    Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to view arbitrary files with root privileges.

  • CVE-2025-58072HigAug 28, 2025
    risk 0.49cvss 7.5epss 0.01

    Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, arbitrary files may be viewed by a remote unauthenticated attacker.

  • CVE-2025-53396HigAug 28, 2025
    risk 0.46cvss 7.0epss 0.00

    Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users who can log in to a client terminal to obtain root privileges.

  • CVE-2025-46409HigAug 28, 2025
    Dos Osaka
    Ss1
    risk 0.49cvss 7.5epss 0.00

    Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a function that requires authentication may be accessed by a remote unauthenticated attacker.

  • CVE-2025-58322HigAug 28, 2025
    Naver
    Mybox
    risk 0.51cvss 7.8epss 0.00

    NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks.

  • CVE-2024-13807HigAug 28, 2025
    WordPress
    Xagio Seo
    risk 0.42cvss 7.5epss 0.00

    The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality due to weak filename structure and lack of protection in the directory. This makes it possible for unauthenticated…

  • CVE-2025-7812HigAug 28, 2025
    WordPress
    Video Share Vod
    risk 0.50cvss 8.8epss 0.00

    The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for…

  • CVE-2025-36003HigAug 28, 2025
    IBM
    Security Verify Governance
    risk 0.49cvss 7.5epss 0.00

    IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.

  • CVE-2024-13982HigAug 27, 2025
    SPON Communications
    IP Network Broadcast System
    risk 0.57cvss —epss 0.01

    SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which…

  • CVE-2023-7308HigAug 27, 2025
    NSFOCUS
    SecGate3600
    risk 0.49cvss 7.5epss 0.08

    SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet.cgi endpoint. The affected component fails to enforce authentication checks on POST requests to retrieve user data. An…

  • CVE-2023-7307HigAug 27, 2025
    Sangfor
    Behavior Management System
    risk 0.57cvss —epss 0.01

    Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data…

  • CVE-2025-40779HigAug 27, 2025
    Isc
    Kea
    risk 0.49cvss 7.5epss 0.01

    If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not…

  • CVE-2025-55618HigAug 27, 2025
    Hyundai
    Navigation
    risk 0.47cvss 7.3epss 0.00

    In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered.

  • CVE-2024-37777HigAug 27, 2025
    O2oa
    O2oa
    risk 0.57cvss 8.8epss 0.01

    O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.

  • CVE-2025-58218HigAug 27, 2025
    WordPress
    Small Package Quotes Wwe Edition
    risk 0.40cvss 7.2epss 0.00

    Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Injection.This issue affects Small Package Quotes – USPS Edition: from n/a through <= 1.3.9.

  • CVE-2025-58217HigAug 27, 2025
    WordPress
    Instant Breaking News
    risk 0.46cvss 7.1epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in GeroNikolov Instant Breaking News instant-breaking-news allows Stored XSS.This issue affects Instant Breaking News: from n/a through <= 1.0.

  • CVE-2025-55422HigAug 27, 2025
    Foxcms
    Foxcms
    risk 0.57cvss 8.8epss 0.00

    In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.

  • CVE-2025-51667HigAug 27, 2025
    simple-admin-core
    simple-admin-core
    risk 0.39cvss 7.0epss 0.00

    An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations.

  • CVE-2025-50979HigAug 27, 2025
    NodeBB
    Nodebb
    risk 0.57cvss 8.6epss 0.11

    NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.

  • CVE-2025-34161HigAug 27, 2025
    Coolify
    Coolify
    risk 0.57cvss 8.8epss 0.03

    Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field…

  • CVE-2025-34159HigAug 27, 2025
    Coolify
    Coolify
    risk 0.57cvss 8.8epss 0.01

    Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project…

  • CVE-2025-20317HigAug 27, 2025
    Cisco Systems, Inc.
    Ucs Manager
    risk 0.46cvss 7.1epss 0.00

    A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification…

  • CVE-2025-20241HigAug 27, 2025
    Cisco Systems, Inc.
    NX-OS Software
    risk 0.48cvss 7.4epss 0.00

    A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS…