Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Aspose Importer & Exporter | CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences… |
8,7 | 0,5 % | Brak wpisu w KEV nie wyklucza ataków | |
| Aspose PDF Exporter | CVE-2015-20125 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal… |
8,7 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| DotNetCMS | CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the… |
8,8 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| Memphis Documents Library | CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in… |
8,7 | 0,53 % | Brak wpisu w KEV nie wyklucza ataków | |
| Issuu Panel | CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value… |
9,2 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| JavaMelody | CVE-2016-20102 JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only… |
5,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| SocialFit | CVE-2012-20005 SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and… |
5,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| DedeCMS | CVE-2014-125131 DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag… |
5,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Blogroll Fun | CVE-2014-125132 Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious… |
5,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| NativeChurch | CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve… |
8,7 | 1,12 % | Brak wpisu w KEV nie wyklucza ataków | |
| ChurcHope | CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive… |
8,7 | 0,82 % | Brak wpisu w KEV nie wyklucza ataków | |
| Aspose Doc Exporter | CVE-2015-20123 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter… |
8,7 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| Custom Tables | CVE-2012-20003 Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php… |
5,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| K-news | CVE-2012-20004 K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to… |
5,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| TinyMCE Thumbnail Gallery | CVE-2012-20002 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like… |
8,7 | 0,53 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86409 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. |
8,1 | 1,1 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. |
8,1 | 0,77 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to… |
9,1 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86412 A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting… |
8,1 | 0,83 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86413 When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. |
9,1 | 0,73 % | Brak wpisu w KEV nie wyklucza ataków | |
| virtualenv | CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted… |
4,5 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| virtualenv | CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the… |
7,8 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113866 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability… |
5,9 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113867 Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the… |
9,1 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2026-113868 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A… |
5,3 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 19:02 UTC – 14.11.2026, 00:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.