KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated…
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary…
OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password.
The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during…
The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes…
The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_role'…
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround,…
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to…
A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection.…
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An…
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without…
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement,…
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The…
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or…
MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote…
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the license name and license code fields. Attackers can craft a malicious payload of 6000 bytes to trigger a…
An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving…
Wstrzyknięcie SQL w systemie zarządzania użytkownikami umożliwia nieautoryzowany dostęp do danych.
Brak uwierzytelnienia w CodeAstro umożliwia usuwanie rekordów członków przez nieautoryzowanych atakujących.
Wstrzyknięcie SQL w CodeAstro Membership Management System umożliwia nieautoryzowany dostęp do danych.
Nieprawidłowa kontrola dostępu w SourceCodester Customer Support System umożliwia nieautoryzowane operacje.
Brak uwierzytelnienia w skryptach administracyjnych ProjectWorlds Online Time Table Generator umożliwia nieautoryzowane operacje.
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to…
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script.
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-1405 The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up… |
Wysoki priorytet |
CVSS 9,8EPSS 3,47 % | ||
| CVE-2026-0926 The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it… |
Wysoki priorytet |
CVSS 9,8EPSS 9,3 % | ||
| CVE-2025-15586 OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge… |
Wysoki priorytet |
CVSS 10,0EPSS 0,54 % | ||
| CVE-2025-13851 The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due… |
Wysoki priorytet |
CVSS 9,8EPSS 0,36 % | ||
| CVE-2025-13563 The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end'… |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2025-12882 The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new… |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-24126 Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument… |
Wysoki priorytet |
CVSS 9,1EPSS 0,52 % | ||
| CVE-2026-2684 A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file… |
Wysoki priorytet |
CVSS 9,8EPSS 0,55 % | ||
| CVE-2026-2682 A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file… |
Wysoki priorytet |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2026-25548 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,86 % | ||
| CVE-2026-27180 MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,3EPSS 1,2 % | ||
| CVE-2026-27174 MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,3EPSS 6,85 % | ||
| CVE-2026-27175 MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,2EPSS 6,9 % | ||
| CVE-2026-27179 MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2019-25364 MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,3EPSS 0,97 % | ||
| CVE-2019-25362 WMV to AVI MPEG DVD WMV Convertor 4.6.1217 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the license name and license code fields.… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,3EPSS 0,76 % | ||
| CVE-2026-0573 An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API… |
Wysoki priorytet |
CVSS 9,0EPSS 0,74 % | ||
| CVE-2025-70152 Wstrzyknięcie SQL w systemie zarządzania użytkownikami umożliwia nieautoryzowany dostęp do danych. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,5 % | ||
| CVE-2025-70150 Brak uwierzytelnienia w CodeAstro umożliwia usuwanie rekordów członków przez nieautoryzowanych atakujących. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2025-70149 Wstrzyknięcie SQL w CodeAstro Membership Management System umożliwia nieautoryzowany dostęp do danych. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,44 % | ||
| CVE-2025-70141 Nieprawidłowa kontrola dostępu w SourceCodester Customer Support System umożliwia nieautoryzowane operacje. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,4EPSS 0,77 % | ||
| CVE-2025-70146 Brak uwierzytelnienia w skryptach administracyjnych ProjectWorlds Online Time Table Generator umożliwia nieautoryzowane operacje. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,64 % | ||
| CVE-2025-65791 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,82 % | ||
| CVE-2025-70998 UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,49 % | ||
| CVE-2025-15579 Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or… |
Wysoki priorytet |
CVSS 9,5EPSS 0,43 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 04:02 UTC – 10.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.