VYPR

CVEs

130,858 total · page 961 of 2,618

AllCriticalHighKEV
  • CVE-2025-47865HigJun 17, 2025
    Trend Micro
    Apex Central
    risk 0.49cvss 7.5epss 0.02

    A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.

  • CVE-2025-33122HigJun 17, 2025
    IBM
    I
    risk 0.49cvss 7.5epss 0.00

    IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege.

  • CVE-2025-49879HigJun 17, 2025
    WordPress
    Litho
    risk 0.56cvss 8.6epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects Litho: from n/a through <= 3.0.

  • CVE-2025-49854HigJun 17, 2025
    WordPress
    Slim Seo
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO slim-seo allows SQL Injection.This issue affects Slim SEO: from n/a through <= 4.5.4.

  • CVE-2025-49508HigJun 17, 2025
    LoftOcean
    CozyStay
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.

  • CVE-2025-49451HigJun 17, 2025
    WordPress
    Aeroscroll Gallery
    risk 0.49cvss 7.5epss 0.01

    Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo…

  • CVE-2025-49415HigJun 17, 2025
    WordPress
    Fw Gallery
    risk 0.56cvss 8.6epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0.

  • CVE-2025-49331HigJun 17, 2025
    WordPress
    Ecommerce Product Catalog
    risk 0.47cvss 7.2epss 0.01

    Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.

  • CVE-2025-49316HigJun 17, 2025
    WordPress
    Wp2leads
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.

  • CVE-2025-49312HigJun 17, 2025
    WordPress
    Echo RSS Feed Post Generator
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for…

  • CVE-2025-49266HigJun 17, 2025
    WordPress
    Ultimate Reviews
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.

  • CVE-2025-49261HigJun 17, 2025
    WordPress
    Diza
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.8.

  • CVE-2025-49260HigJun 17, 2025
    WordPress
    Aora
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.9.

  • CVE-2025-49259HigJun 17, 2025
    WordPress
    Hara
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.10.

  • CVE-2025-49258HigJun 17, 2025
    WordPress
    Maia
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local File Inclusion.This issue affects Maia: from n/a through <= 1.1.15.

  • CVE-2025-49257HigJun 17, 2025
    WordPress
    Zota
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.8.

  • CVE-2025-49256HigJun 17, 2025
    WordPress
    Sapa
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14.

  • CVE-2025-49255HigJun 17, 2025
    WordPress
    Ruza
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through <= 1.0.7.

  • CVE-2025-49254HigJun 17, 2025
    WordPress
    Nika
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.8.

  • CVE-2025-49253HigJun 17, 2025
    WordPress
    Lasa
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through <= 1.1.

  • CVE-2025-49252HigJun 17, 2025
    WordPress
    Besa
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.8.

  • CVE-2025-49251HigJun 17, 2025
    WordPress
    Fana
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.28.

  • CVE-2025-49180HigJun 17, 2025
    Red Hat
    RandR extension
    risk 0.44cvss 7.8epss 0.00

    A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

  • CVE-2025-49179HigJun 17, 2025
    Red Hat
    X Record extension
    risk 0.40cvss 7.3epss 0.00

    A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.

  • CVE-2025-49176HigJun 17, 2025
    Red Hat
    Big Requests extension
    risk 0.40cvss 7.3epss 0.00

    A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

  • CVE-2025-48333HigJun 17, 2025
    WordPress
    eForm
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.

  • CVE-2025-48145HigJun 17, 2025
    WordPress
    Track, Analyze & Optimize by WP Tao
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.

  • CVE-2025-48118HigJun 17, 2025
    WordPress
    Woocommerce Partial Shipment
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through <= 3.2.

  • CVE-2025-47572HigJun 17, 2025
    Mojoomla
    School Management
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0.

  • CVE-2025-39508HigJun 17, 2025
    WordPress
    Nasa Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through <= 6.4.4.

  • CVE-2025-39486HigJun 17, 2025
    WordPress
    Valvepress Rankie
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection.This issue affects Rankie: from n/a through < 1.8.2.

  • CVE-2025-32549HigJun 17, 2025
    Mojoomla
    WPGYM
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0.

  • CVE-2025-30988HigJun 17, 2025
    WordPress
    Elite Video Player
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.

  • CVE-2025-30562HigJun 17, 2025
    WordPress
    Navigation Tree Elementor
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-elementor allows Blind SQL Injection.This issue affects Navigation Tree Elementor: from n/a through <= 1.0.1.

  • CVE-2025-29002HigJun 17, 2025
    WordPress
    Simen
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Local File Inclusion.This issue affects Simen: from n/a through <= 4.6.

  • CVE-2025-28991HigJun 17, 2025
    WordPress
    Evon
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local File Inclusion.This issue affects Evon: from n/a through <= 3.4.

  • CVE-2025-28972HigJun 17, 2025
    WordPress
    WP Employee Attendance System
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through <= 3.5.

  • CVE-2025-24761HigJun 17, 2025
    snstheme
    DSK
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File Inclusion.This issue affects DSK: from n/a through < 2.4.

  • CVE-2025-4879HigJun 17, 2025
    Citrix Systems
    Workspace
    risk 0.51cvss 7.8epss 0.00

    Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows

  • CVE-2025-0320HigJun 17, 2025
    Citrix Systems
    Secure Access Client
    risk 0.51cvss 7.8epss 0.00

    Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows

  • CVE-2025-6020HigJun 17, 2025
    Linux Pam
    pam_namespace
    risk 0.51cvss 7.8epss 0.00

    A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

  • CVE-2025-5777HigKEVJun 17, 2025
    Citrix Systems
    Netscaler
    risk 0.78cvss 7.5epss 1.00

    Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

  • CVE-2025-5349HigJun 17, 2025
    Netscaler
    ADC
    risk 0.58cvss 8.8epss 0.07

    Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway

  • CVE-2025-4365HigJun 17, 2025
    Netscaler
    Console
    risk 0.50cvss 7.5epss 0.10

    Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)

  • CVE-2025-3515HigJun 17, 2025
    WordPress
    Drag And Drop Multiple File Upload Contact Form 7
    risk 0.46cvss 8.1epss 0.06

    The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the…

  • CVE-2025-6165HigJun 17, 2025
    Totolink
    X15
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer…

  • CVE-2025-6164HigJun 17, 2025
    Totolink
    A3002r Firmware
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow.…

  • CVE-2025-6163HigJun 17, 2025
    Totolink
    A3002RU
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to…

  • CVE-2025-6162HigJun 17, 2025
    Totolink
    EX1200T
    risk 0.57cvss 8.8epss 0.01

    A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument…

  • CVE-2025-6161HigJun 17, 2025
    Sourcecodester
    Simple Food Ordering System
    risk 0.48cvss 7.3epss 0.01

    A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack…