Export limit exceeded: 341244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (341244 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-24698 | 1 G5plus | 1 Essential Real Estate | 2025-06-09 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in G5Theme Essential Real Estate allows Cross Site Request Forgery. This issue affects Essential Real Estate: from n/a through 5.1.8. | ||||
| CVE-2023-7168 | 1 Antonpug | 1 Better Flow Button For Jetpack | 2025-06-09 | 4.8 Medium |
| The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-45997 | 1 Senior-walter | 1 Web-based Pharmacy Product Management System | 2025-06-09 | 8.6 High |
| Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg. | ||||
| CVE-2025-24650 | 1 Themefic | 1 Tourfic | 2025-06-09 | 9.1 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic allows Upload a Web Shell to a Web Server. This issue affects Tourfic: from n/a through 2.15.3. | ||||
| CVE-2024-11189 | 1 Reputeinfosystems | 1 Social Share And Social Locker | 2025-06-09 | 4.8 Medium |
| The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-11372 | 1 Floriansimunek | 1 Connexion Logs | 2025-06-09 | 7.2 High |
| The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks | ||||
| CVE-2024-11373 | 1 Floriansimunek | 1 Connexion Logs | 2025-06-09 | 4.3 Medium |
| The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2025-5252 | 1 Phpgurukul | 1 News Portal Project | 2025-06-09 | 7.3 High |
| A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-48744 | 1 Sigb | 1 Pmb | 2025-06-09 | 6.4 Medium |
| In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. | ||||
| CVE-2025-48743 | 1 Sigb | 1 Pmb | 2025-06-09 | 5.3 Medium |
| SIGB PMB before 8.0.1.2 allows SQL injection. | ||||
| CVE-2024-11502 | 1 Wpchurchteam | 1 Planning Center Online Giving | 2025-06-09 | 5.4 Medium |
| The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2025-5220 | 1 Freefloat | 1 Ftp Server | 2025-06-09 | 7.3 High |
| A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-5219 | 1 Freefloat | 1 Ftp Server | 2025-06-09 | 7.3 High |
| A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component ASCII Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-50253 | 1 Laf | 1 Laf | 2025-06-09 | 9.7 Critical |
| Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist. | ||||
| CVE-2024-11718 | 1 Couleurcitron | 1 Tarteaucitron-wp | 2025-06-09 | 5.4 Medium |
| The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2024-22402 | 1 Nextcloud | 1 Guests | 2025-06-09 | 5.4 Medium |
| Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-11719 | 1 Couleurcitron | 1 Tarteaucitron-wp | 2025-06-09 | 6.1 Medium |
| The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | ||||
| CVE-2024-11843 | 1 Projectpanorama | 1 Panorama | 2025-06-09 | 4.8 Medium |
| The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-23327 | 1 Envoyproxy | 1 Envoy | 2025-06-09 | 7.5 High |
| Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-12301 | 1 Joomlaserviceprovider | 1 Jsp Store Locator | 2025-06-09 | 6.5 Medium |
| The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. | ||||