Export limit exceeded: 424070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (110565 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-7269 | 1 Artplacer | 1 Artplacer Widget | 2025-05-16 | 7.5 High |
| The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | ||||
| CVE-2022-32149 | 2 Golang, Redhat | 10 Text, Acm, Container Native Virtualization and 7 more | 2025-05-15 | 7.5 High |
| An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||||
| CVE-2024-25839 | 1 Webbax | 1 Super Newsletter | 2025-05-15 | 7.5 High |
| An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information. | ||||
| CVE-2024-24307 | 2 Prestalife, Prestashopmodules | 2 Product Designer, Productdesigner | 2025-05-15 | 7.5 High |
| Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to escalate privileges and obtain sensitive information via the ajaxProcessCropImage() method. | ||||
| CVE-2024-13624 | 1 Caercam | 1 Wpmovielibrary | 2025-05-15 | 7.1 High |
| The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-13571 | 1 Agilelogix | 1 Post Timeline | 2025-05-15 | 7.1 High |
| The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-12878 | 1 Thedevoice | 1 Lazy Blocks | 2025-05-15 | 7.1 High |
| The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-10483 | 1 Simplepress | 1 Simplepress | 2025-05-15 | 7.1 High |
| The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. | ||||
| CVE-2024-10152 | 1 Elementengage | 1 Simple Certain Time To Show Content | 2025-05-15 | 7.1 High |
| The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2025-4058 | 1 Projectworlds | 1 Online Examination System | 2025-05-15 | 7.3 High |
| A vulnerability classified as critical has been found in Projectworlds Online Examination System 1.0. This affects an unknown part of the file /Bloodgroop_process.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-1964 | 1 Projectworlds | 1 Online Hotel Booking | 2025-05-15 | 7.3 High |
| A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been rated as critical. This issue affects some unknown processing of the file /booknow.php?roomname=Duplex. The manipulation of the argument checkin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||
| CVE-2024-25447 | 1 Enlightenment | 1 Imlib2 | 2025-05-15 | 8.8 High |
| An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image. | ||||
| CVE-2024-25419 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php. | ||||
| CVE-2024-25418 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php. | ||||
| CVE-2024-25305 | 1 Code-projects | 1 Simple School Management System | 2025-05-15 | 8.8 High |
| Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php. | ||||
| CVE-2024-25304 | 1 Code-projects | 1 Simple School Management System | 2025-05-15 | 8.8 High |
| Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php." | ||||
| CVE-2024-25004 | 1 9bis | 1 Kitty | 2025-05-15 | 7.8 High |
| KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution. | ||||
| CVE-2024-24468 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. | ||||
| CVE-2024-24113 | 1 Xuxueli | 1 Xxl-job | 2025-05-15 | 8.8 High |
| xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. | ||||
| CVE-2024-23756 | 1 Plone | 1 Plone | 2025-05-15 | 7.5 High |
| The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them. | ||||