Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
6,5
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.