Export limit exceeded: 360483 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (360483 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-45052 | 1 Dan009 | 1 Wp Bing Map Pro | 2025-02-19 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin < 5.0 versions. | ||||
| CVE-2023-41131 | 1 Followingmedarling | 1 Spotify Play Button | 2025-02-19 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. | ||||
| CVE-2023-45831 | 1 Pixelative | 1 Google Amp | 2025-02-19 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. | ||||
| CVE-2023-45747 | 1 Syedbalkhi | 1 Wp Lightbox 2 | 2025-02-19 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions. | ||||
| CVE-2023-45769 | 1 Alexraven | 1 Wp Report Post | 2025-02-19 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. | ||||
| CVE-2023-45770 | 1 Fastwpspeed | 1 Fast Wp Speed | 2025-02-19 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <= 1.0.0 versions. | ||||
| CVE-2023-5802 | 1 Wpknowledgebase | 1 Wp Knowledgebase | 2025-02-19 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions. | ||||
| CVE-2023-46088 | 1 Paymentsplugin | 1 Wp Full Stripe Free | 2025-02-19 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions. | ||||
| CVE-2025-0865 | 1 De-baat | 1 Wp Media Category Management | 2025-02-19 | 6.5 Medium |
| The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2023-1637 | 2 Linux, Redhat | 7 Linux Kernel, Enterprise Linux, Rhel Aus and 4 more | 2025-02-19 | 5.5 Medium |
| A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks. | ||||
| CVE-2023-1093 | 1 Miniorange | 1 Oauth Single Sign On | 2025-02-19 | 6.5 Medium |
| The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack | ||||
| CVE-2023-1088 | 1 Hasthemes | 1 Wp Plugin Manager | 2025-02-19 | 4.3 Medium |
| The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2023-0505 | 1 Hasthemes | 1 Ever Compare | 2025-02-19 | 4.3 Medium |
| The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2023-0499 | 1 Hasthemes | 1 Quickswish | 2025-02-19 | 4.3 Medium |
| The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2023-0498 | 1 Hasthemes | 1 Wp Education | 2025-02-19 | 4.3 Medium |
| The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2023-0495 | 1 Hasthemes | 1 Ht Slider For Elementor | 2025-02-19 | 4.3 Medium |
| The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack | ||||
| CVE-2023-0335 | 1 Wpvar | 1 Wp Shamsi | 2025-02-19 | 6.5 Medium |
| The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment. | ||||
| CVE-2022-32199 | 1 Scriptcase | 1 Scriptcase | 2025-02-19 | 6.5 Medium |
| db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. | ||||
| CVE-2018-25048 | 1 Codesys | 15 Control For Beaglebone, Control For Empc-a\/imx6, Control For Iot2000 and 12 more | 2025-02-19 | 8.8 High |
| The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device. | ||||
| CVE-2023-1589 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2025-02-19 | 6.3 Medium |
| A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approve_delete.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223654 is the identifier assigned to this vulnerability. | ||||