Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 1 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
6,5
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjePrzetwarzanie niepełne
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.