Export limit exceeded: 43050 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (43050 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-13270 | 1 Freelinking Project | 1 Freelinking | 2025-08-27 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1. | ||||
| CVE-2024-13271 | 1 Content Entity Clone Project | 1 Content Entity Clone | 2025-08-27 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4. | ||||
| CVE-2024-13272 | 1 Paragraphs Table Project | 1 Paragraphs Table | 2025-08-27 | 6.3 Medium |
| Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2. | ||||
| CVE-2022-34704 | 1 Microsoft | 5 Windows 10, Windows 11, Windows Server 2016 and 2 more | 2025-08-27 | 4.7 Medium |
| Windows Defender Credential Guard Information Disclosure Vulnerability | ||||
| CVE-2022-31674 | 1 Vmware | 1 Vrealize Operations | 2025-08-27 | 4.3 Medium |
| VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure. | ||||
| CVE-2022-31672 | 1 Vmware | 1 Vrealize Operations | 2025-08-27 | 6.4 Medium |
| VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root. | ||||
| CVE-2022-20361 | 1 Google | 1 Android | 2025-08-27 | 6.5 Medium |
| In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-231161832 | ||||
| CVE-2025-7873 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file mcc_login.jsp. The manipulation of the argument workerid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7876 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file download.jsp. The manipulation of the argument p leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7877 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file sendfile.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7878 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/upload2.jsp. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7879 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mobileupload.jsp. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7880 | 1 Metasoft | 1 Metacrm | 2025-08-27 | 6.3 Medium |
| A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /business/common/sms/sendsms.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-6981 | 1 Github | 1 Enterprise Server | 2025-08-27 | 4.3 Medium |
| An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3 | ||||
| CVE-2024-8700 | 1 Total-soft | 1 Event Calendar | 2025-08-27 | 7.5 High |
| The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars. | ||||
| CVE-2024-6846 | 2 Smartsearchwp, Webdigit | 2 Chatbot With Chatgpt Wordpress, Chatbot With Chatgpt | 2025-08-27 | 5.3 Medium |
| The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs | ||||
| CVE-2024-12812 | 1 Wedevs | 1 Wp Erp | 2025-08-27 | 7.5 High |
| The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees. | ||||
| CVE-2024-11638 | 1 Gtbabel | 1 Gtbabel | 2025-08-27 | 8.8 High |
| The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies. | ||||
| CVE-2024-12274 | 1 Codepeople | 1 Appointment Booking Calendar | 2025-08-27 | 7.5 High |
| The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist). | ||||
| CVE-2025-47930 | 1 Zulip | 1 Zulip | 2025-08-27 | 5.3 Medium |
| Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch. | ||||