Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | CVSS | EPSS | KEV | Zapisz |
|---|---|---|---|---|---|
| Aspose Importer & Exporter | CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences… |
CVSS8,7 | EPSS0,5 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Aspose PDF Exporter | CVE-2015-20125 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal… |
CVSS8,7 | EPSS0,41 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| DotNetCMS | CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the… |
CVSS8,8 | EPSS0,34 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Memphis Documents Library | CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in… |
CVSS8,7 | EPSS0,53 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Issuu Panel | CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value… |
CVSS9,2 | EPSS0,4 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| JavaMelody | CVE-2016-20102 JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only… |
CVSS5,1 | EPSS0,26 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| SocialFit | CVE-2012-20005 SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and… |
CVSS5,1 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| DedeCMS | CVE-2014-125131 DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag… |
CVSS5,1 | EPSS0,26 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Blogroll Fun | CVE-2014-125132 Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious… |
CVSS5,1 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| NativeChurch | CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve… |
CVSS8,7 | EPSS1,12 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| ChurcHope | CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive… |
CVSS8,7 | EPSS0,82 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Aspose Doc Exporter | CVE-2015-20123 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter… |
CVSS8,7 | EPSS0,41 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Custom Tables | CVE-2012-20003 Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php… |
CVSS5,1 | EPSS0,27 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| K-news | CVE-2012-20004 K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to… |
CVSS5,1 | EPSS0,27 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| TinyMCE Thumbnail Gallery | CVE-2012-20002 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like… |
CVSS8,7 | EPSS0,53 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86409 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. |
CVSS8,1 | EPSS1,1 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. |
CVSS8,1 | EPSS0,77 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to… |
CVSS9,1 | EPSS0,43 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting… |
CVSS8,1 | EPSS0,83 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86413 When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. |
CVSS9,1 | EPSS0,73 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| virtualenv | CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted… |
CVSS4,5 | EPSS0,2 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| virtualenv | CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the… |
CVSS7,8 | EPSS0,26 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113866 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability… |
CVSS5,9 | EPSS0,37 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113867 Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the… |
CVSS9,1 | EPSS0,4 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113868 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A… |
CVSS5,3 | EPSS0,43 % | KEVBrak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 11:02 UTC – 13.11.2026, 16:09 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.