Export limit exceeded: 363669 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (363669 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2022-48334 | 1 Widevine | 1 Trusted Application | 2024-11-27 | 9.8 Critical |
| Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys total_len+file_name_len integer overflow and resultant buffer overflow. | ||||
| CVE-2023-2178 | 1 Aajoda | 1 Aajoda Testimonials | 2024-11-27 | 4.8 Medium |
| The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2023-2482 | 1 Wpwox | 1 Responsive Css Editor | 2024-11-27 | 7.2 High |
| The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin. | ||||
| CVE-2023-2032 | 1 Kunalnagar | 1 Custom 404 Pro | 2024-11-27 | 9.8 Critical |
| The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities. | ||||
| CVE-2022-4115 | 1 Editorial Calendar Project | 1 Editorial Calendar | 2024-11-27 | 5.4 Medium |
| The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users. | ||||
| CVE-2023-0873 | 1 Kanbanwp | 1 Kanban Boards For Wordpress | 2024-11-27 | 4.8 Medium |
| The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-1891 | 1 Helpiewp | 1 Accordion \& Faq | 2024-11-27 | 6.1 Medium |
| The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting | ||||
| CVE-2024-8924 | 1 Servicenow | 1 Servicenow | 2024-11-27 | 7.5 High |
| ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. | ||||
| CVE-2024-8923 | 1 Servicenow | 1 Servicenow | 2024-11-27 | 9.8 Critical |
| ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. | ||||
| CVE-2023-2842 | 1 Wpinventory | 1 Wp Inventory Manager | 2024-11-27 | 8.1 High |
| The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack | ||||
| CVE-2023-2711 | 1 Etoilewebdesign | 1 Ultimate Product Catalog | 2024-11-27 | 4.8 Medium |
| The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-2592 | 1 Ncrafts | 1 Formcraft | 2024-11-27 | 7.2 High |
| The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | ||||
| CVE-2023-2623 | 1 Iqonic | 1 Kivicare | 2024-11-27 | 6.5 Medium |
| The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users | ||||
| CVE-2023-37303 | 1 Mediawiki | 1 Mediawiki | 2024-11-27 | 9.8 Critical |
| An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message. | ||||
| CVE-2023-37301 | 1 Mediawiki | 1 Mediawiki | 2024-11-27 | 5.3 Medium |
| An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur. | ||||
| CVE-2023-37300 | 1 Mediawiki | 1 Mediawiki | 2024-11-27 | 5.3 Medium |
| An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users. | ||||
| CVE-2023-1166 | 1 Ultimatelysocial | 1 Usm Premium | 2024-11-27 | 4.8 Medium |
| The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). | ||||
| CVE-2023-2628 | 1 Iqonic | 1 Kivicare | 2024-11-27 | 8.8 High |
| The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc) | ||||
| CVE-2023-2326 | 1 Gsheetconnector | 1 Gravity Forms Google Sheets Connector | 2024-11-27 | 6.5 Medium |
| The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack | ||||