VYPR

CVEs

130,801 total · page 898 of 2,617

AllCriticalHighKEV
  • CVE-2025-54924HigAug 20, 2025
    risk 0.49cvss 7.5epss 0.00

    CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.

  • CVE-2025-54923HigAug 20, 2025
    Schneider Electric
    SEVD-2025-224-01
    risk 0.57cvss —epss 0.01

    CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.

  • CVE-2025-50503HigAug 20, 2025
    Touch Lebanon
    Mobile App
    risk 0.57cvss 8.8epss 0.00

    A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without…

  • CVE-2025-32010HigAug 20, 2025
    Tenda
    AC6
    risk 0.53cvss 8.1epss 0.01

    A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.

  • CVE-2025-31355HigAug 20, 2025
    Tenda
    AC6
    risk 0.47cvss 7.2epss 0.00

    A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

  • CVE-2025-30256HigAug 20, 2025
    Tenda
    AC6
    risk 0.56cvss 8.6epss 0.00

    A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests can lead to a reboot. An attacker can send multiple network packets to trigger this vulnerability.

  • CVE-2025-24496HigAug 20, 2025
    Tenda
    AC6
    risk 0.49cvss 7.5epss 0.00

    An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.

  • CVE-2025-24322HigAug 20, 2025
    Tenda
    AC6
    risk 0.53cvss 8.1epss 0.01

    An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability.

  • CVE-2025-57732HigAug 20, 2025
    Jetbrains
    Teamcity
    risk 0.49cvss 7.5epss 0.00

    In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

  • CVE-2025-57731HigAug 20, 2025
    Jetbrains
    Youtrack
    risk 0.57cvss 8.7epss 0.00

    In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

  • CVE-2025-5261HigAug 20, 2025
    Pik Online Yazılım Çözümleri A.Ş.
    Pik Online
    risk 0.49cvss 7.5epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. This issue affects Pik Online: before 3.1.5.

  • CVE-2025-5260HigAug 20, 2025
    Pik Online Yazılım Çözümleri A.Ş.
    Pik Online
    risk 0.56cvss 8.6epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5.

  • CVE-2025-55715HigAug 20, 2025
    WordPress
    Otter - Gutenberg Block
    risk 0.49cvss 7.5epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.

  • CVE-2025-54750HigAug 20, 2025
    WordPress
    Funnel Builder by FunnelKit
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.11.1.

  • CVE-2025-54735HigAug 20, 2025
    Cubewp
    cubewp-framework
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <= 1.1.24.

  • CVE-2025-54670HigAug 20, 2025
    WordPress
    Oik
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through <= 4.15.2.

  • CVE-2025-54056HigAug 20, 2025
    LambertGroup
    Responsive HTML5 Audio Player PRO With Playlist
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a…

  • CVE-2025-54055HigAug 20, 2025
    Skygroup
    Druco
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affects Druco: from n/a through <= 1.5.2.

  • CVE-2025-54052HigAug 20, 2025
    WordPress
    Realtyna Organic IDX
    risk 0.49cvss 7.5epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.0.0.

  • CVE-2025-54044HigAug 20, 2025
    WordPress
    Elite Video Player
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Reflected XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.

  • CVE-2025-54034HigAug 20, 2025
    Tribulant
    Newsletters
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through <= 4.10.

  • CVE-2025-54032HigAug 20, 2025
    Webcodingplace
    Real Estate Manager
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.7.3.

  • CVE-2025-54031HigAug 20, 2025
    WordPress
    Support Board
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through <= 3.8.0.

  • CVE-2025-54028HigAug 20, 2025
    WordPress
    Cf7 Styler
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PHP Local File Inclusion.This issue affects CF7 WOW Styler: from n/a through <= 1.7.2.

  • CVE-2025-54027HigAug 20, 2025
    Schiocco
    Support Board
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.

  • CVE-2025-54021HigAug 20, 2025
    WordPress
    Simple File List
    risk 0.49cvss 7.5epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.14.

  • CVE-2025-54017HigAug 20, 2025
    WordPress
    Paid Member Subscriptions
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through…

  • CVE-2025-54012HigAug 20, 2025
    WordPress
    Welcart eCommerce
    risk 0.47cvss 7.2epss 0.00

    Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

  • CVE-2025-54007HigAug 20, 2025
    WordPress
    Post Grid and Gutenberg Blocks
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.

  • CVE-2025-53567HigAug 20, 2025
    WordPress
    Ghostkit
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through <= 3.4.1.

  • CVE-2025-53565HigAug 20, 2025
    WordPress
    Widgets For Google Reviews
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp allows PHP Local File Inclusion.This issue affects Widget for Google Reviews: from n/a through <=…

  • CVE-2025-53564HigAug 20, 2025
    WordPress
    HTML5 Radio Player - WPBakery Page Builder Addon
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg_radio_player_addon_visual_composer allows Reflected XSS.This issue affects HTML5 Radio Player - WPBakery Page…

  • CVE-2025-53563HigAug 20, 2025
    WordPress
    Youtube Vimeo Video Player and Slider
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider video_player_youtube_vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider: from n/a through <=…

  • CVE-2025-53562HigAug 20, 2025
    WordPress
    Universal Video Player - Addon for WPBakery Page Builder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg_universal_video_player_addon_visual_composer allows Reflected XSS.This issue affects Universal Video…

  • CVE-2025-53560HigAug 20, 2025
    WordPress
    Noisa
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.

  • CVE-2025-53559HigAug 20, 2025
    LambertGroup
    Universal Video Player - Addon for WPBakery Page Builder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video…

  • CVE-2025-53319HigAug 20, 2025
    WordPress
    Raptive Ads
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through <= 3.8.0.

  • CVE-2025-53226HigAug 20, 2025
    WordPress
    Comments Capcha Box
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through <= 1.1.

  • CVE-2025-53212HigAug 20, 2025
    WordPress
    Revolution Video Player With Bottom Playlist
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player With Bottom Playlist revolution-video-player allows Reflected XSS.This issue affects Revolution Video Player With Bottom Playlist: from n/a…

  • CVE-2025-53210HigAug 20, 2025
    WordPress
    Zoloblocks
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through <= 2.3.2.

  • CVE-2025-53208HigAug 20, 2025
    WordPress
    paymaya-checkout-for-woocommerce
    risk 0.49cvss 7.5epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <= 1.2.0.

  • CVE-2025-53207HigAug 20, 2025
    WordPress
    WP Travel Gutenberg Blocks
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows PHP Local File Inclusion.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.0.

  • CVE-2025-53205HigAug 20, 2025
    WordPress
    Radio Player Shoutcast & Icecast
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through <= 4.4.7.

  • CVE-2025-53204HigAug 20, 2025
    WordPress
    eventlist
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme eventlist eventlist allows PHP Local File Inclusion.This issue affects eventlist: from n/a through <= 1.9.2.

  • CVE-2025-53201HigAug 20, 2025
    WordPress
    Noo Jobmonster
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.

  • CVE-2025-53198HigAug 20, 2025
    WordPress
    Houzez
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

  • CVE-2025-53194HigAug 20, 2025
    WordPress
    Jetengine
    risk 0.55cvss 8.5epss 0.00

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

  • CVE-2025-49894HigAug 20, 2025
    WordPress
    Nuss
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.3.

  • CVE-2025-49893HigAug 20, 2025
    WordPress
    Nuss
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Nuss nuss allows Reflected XSS.This issue affects Nuss: from n/a through <= 1.3.3.

  • CVE-2025-49892HigAug 20, 2025
    WordPress
    Uxper Booking
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Uxper Booking uxper-booking allows PHP Local File Inclusion.This issue affects Uxper Booking: from n/a through <= 1.3.3.