Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
KATALOG INFORMACJI
Podatności
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Filtry katalogu · zakres, producent, rekomendacja
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
- CVSS
- 9,8
- EPSS
- 0,39 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL…
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
- CVSS
- 9,8
- EPSS
- 0,38 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB…
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova…
- CVSS
- 9,8
- EPSS
- 0,38 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser.
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service…
- CVSS
- 9,8
- EPSS
- 0,38 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Payload is a free and open source headless content management system.
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite…
- CVSS
- 9,8
- EPSS
- 0,38 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract…
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions.…
- CVSS
- 9,8
- EPSS
- 0,38 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co.
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.
- CVSS
- 9,8
- EPSS
- 0,37 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a…
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.
- CVSS
- 9,8
- EPSS
- 0,36 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers…
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run…
- CVSS
- 9,8
- EPSS
- 0,36 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object…
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
- CVSS
- 9,8
- EPSS
- 0,36 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Payload is a free and open source headless content management system.
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control…
- CVSS
- 9,8
- EPSS
- 0,35 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
- CVSS
- 9,8
- EPSS
- 0,35 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM…
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CVSS
- 9,8
- EPSS
- 0,34 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to…
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including…
- CVSS
- 9,8
- EPSS
- 0,34 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. | Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Juno <= 2.25 versions. | Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. | Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. | Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. |
W tym tygodniu | 9,8 | 0,39 % | ||
| A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL… | A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. |
W tym tygodniu | 9,8 | 0,38 % | ||
| In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB… | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova… |
W tym tygodniu | 9,8 | 0,38 % | ||
| IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service… |
W tym tygodniu | 9,8 | 0,38 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite… |
W tym tygodniu | 9,8 | 0,38 % | ||
| MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract… | MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions.… |
W tym tygodniu | 9,8 | 0,38 % | ||
| Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. | Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26. |
W tym tygodniu | 9,8 | 0,37 % | ||
| Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a… | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser. |
W tym tygodniu | 9,8 | 0,36 % | ||
| Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers… | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run… |
W tym tygodniu | 9,8 | 0,36 % | ||
| Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object… | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5. |
W tym tygodniu | 9,8 | 0,36 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control… |
W tym tygodniu | 9,8 | 0,35 % | ||
| Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. | Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
W tym tygodniu | 9,8 | 0,35 % | ||
| Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM… | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. |
W tym tygodniu | 9,8 | 0,34 % | ||
| The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to… | The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including… |
W tym tygodniu | 9,8 | 0,34 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.