Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-26570 | 1 Idattend | 1 Idweb | 2024-11-21 | 7.5 High |
| Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. | ||||
| CVE-2023-26569 | 1 Idattend | 1 Idweb | 2024-11-21 | 9.8 Critical |
| Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. | ||||
| CVE-2023-26568 | 1 Idattend | 1 Idweb | 2024-11-21 | 9.8 Critical |
| Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. | ||||
| CVE-2023-26564 | 1 Syncfusion | 1 Ej2 Aspcore File Provider | 2024-11-21 | 9.8 Critical |
| The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server. | ||||
| CVE-2023-26563 | 1 Syncfusion | 1 Nodejs File System Provider | 2024-11-21 | 9.8 Critical |
| The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read any file, delete any file, upload any file to any directory accessible by the web server. - On Linux, read any file, download any directory, delete any file, upload any file to any directory accessible by the web server. | ||||
| CVE-2023-26562 | 1 Zimbra | 1 Collaboration | 2024-11-21 | 6.5 Medium |
| In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp. | ||||
| CVE-2023-26543 | 1 Wp-meteor | 1 Wp Meteor | 2024-11-21 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions. | ||||
| CVE-2023-26541 | 1 Asmember Project | 1 Asmember | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Suess asMember plugin <= 1.5.4 versions. | ||||
| CVE-2023-26539 | 1 Advanced Text Widget Project | 1 Advanced Text Widget | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions. | ||||
| CVE-2023-26538 | 1 Chat Bee Project | 1 Chat Bee | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kamyabsoft Chat Bee plugin <= 1.1.0 versions. | ||||
| CVE-2023-26532 | 1 Accesspressthemes | 1 Social Auto Poster | 2024-11-21 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions. | ||||
| CVE-2023-26531 | 1 Wbolt | 1 All-in-one Search Automatic Push Management | 2024-11-21 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 allows Cross Site Request Forgery.This issue affects 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: from n/a through 4.2.7. | ||||
| CVE-2023-26530 | 1 Updraftplus | 1 Updraft | 2024-11-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paul Kehrer Updraft plugin <= 0.6.1 versions. | ||||
| CVE-2023-26528 | 1 Shipyaari | 1 Shipping Management | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jinit9906 Shipyaari Shipping Management plugin <= 1.0 versions. | ||||
| CVE-2023-26527 | 1 Wpindeed | 1 Debug Assistant | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions. | ||||
| CVE-2023-26523 | 1 Codepeople | 1 Calculated Fields Form | 2024-11-21 | 4.3 Medium |
| Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a through 1.1.120. | ||||
| CVE-2023-26518 | 1 Accesspressthemes | 1 Wp Tfeed | 2024-11-21 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions. | ||||
| CVE-2023-26516 | 1 Wpindeed | 1 Debug Assistant | 2024-11-21 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions. | ||||
| CVE-2023-26515 | 1 Simple Slug Translate Project | 1 Simple Slug Translate | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ko Takagi Simple Slug Translate plugin <= 2.7.2 versions. | ||||
| CVE-2023-26469 | 1 Jorani | 1 Jorani | 2024-11-21 | 9.8 Critical |
| In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. | ||||