Export limit exceeded: 37187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (37187 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-3136 | 1 Linuxfoundation | 1 Pytorch | 2025-05-28 | 3.3 Low |
| A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-4250 | 1 Fabian | 1 Nero Social Networking Site | 2025-05-28 | 7.3 High |
| A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument fname/lname/login/password2/cpassword/address/cnumber/email/gender/propic/month leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-4114 | 1 Netgear | 2 Jwnr2000, Jwnr2000 Firmware | 2025-05-28 | 8.8 High |
| A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-4543 | 1 Lylme | 1 Lylme Spage | 2025-05-28 | 7.3 High |
| A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_link.php. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-12679 | 1 Prisna | 1 Google Website Translator | 2025-05-28 | 4.8 Medium |
| The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-12680 | 1 Prisna | 1 Google Website Translator | 2025-05-28 | 4.8 Medium |
| The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13482 | 1 Icegram | 1 Icegram Engage | 2025-05-28 | 4.8 Medium |
| The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13486 | 1 Icegram | 1 Icegram Engage | 2025-05-28 | 4.8 Medium |
| The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8673 | 1 Urbanbase | 1 Z-downloads | 2025-05-28 | 9.1 Critical |
| The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. | ||||
| CVE-2024-8699 | 1 Urbanbase | 1 Z-downloads | 2025-05-28 | 7.2 High |
| The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) | ||||
| CVE-2024-8703 | 1 Urbanbase | 1 Z-downloads | 2025-05-28 | 6.1 Medium |
| The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs. | ||||
| CVE-2024-9709 | 1 Lukashuser | 1 Ekc Tournament Manager | 2025-05-28 | 5.4 Medium |
| The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-9711 | 1 Lukashuser | 1 Ekc Tournament Manager | 2025-05-28 | 5.4 Medium |
| The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-9765 | 1 Lukashuser | 1 Ekc Tournament Manager | 2025-05-28 | 6.5 Medium |
| The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory | ||||
| CVE-2025-0687 | 1 Mynamedia | 1 Spiritual Gifts Survey \(and Optional S.h.a.p.e Survey\) | 2025-05-28 | 6.1 Medium |
| The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. | ||||
| CVE-2025-0688 | 1 Mynamedia | 1 Spiritual Gifts Survey \(and Optional S.h.a.p.e Survey\) | 2025-05-28 | 6.1 Medium |
| The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. | ||||
| CVE-2022-2872 | 1 Octoprint | 1 Octoprint | 2025-05-28 | 5.4 Medium |
| Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. | ||||
| CVE-2022-2888 | 1 Octoprint | 1 Octoprint | 2025-05-28 | 4.4 Medium |
| If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. | ||||
| CVE-2025-4745 | 1 Fabian | 1 Employee Record System | 2025-05-28 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_employees.php. The manipulation of the argument employeed_id/first_name/middle_name/last_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2022-3068 | 1 Octoprint | 1 Octoprint | 2025-05-28 | 8.8 High |
| Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. | ||||