Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2026-4885

Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Addons For Elementor Wordpress
CVE-2025-68065

WordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Liquidthemes Wordpress
Products
Hub Wordpress
CVE-2026-27173

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow Cncf Kubernetes Apache-airflow-providers-cncf-kubernetes
CVE-2023-7103

Authentication Bypass in ZKSoftware's UFace 5

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. This issue affects UFace 5: through 12022024.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Zksoftware
Products
Uface 5
CVE-2026-5586

zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection

A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zhongyu09
Products
Openchatbi
CVE-2023-6676

Cross Site Request Forgery in National Keep's CyberMath

Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This issue affects CyberMath: from v1.4 before v1.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2023-6677

SQLi in Oduyo Online Collection Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection. This issue affects Online Collection: before v.1.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Oduyo
Products
Online Collection
CVE-2023-6724

IDOR in Simgesel Software's Hearing Tracking System (Barosel)

Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse. This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Simgesel
Products
Hearing Tracking System
CVE-2023-6919

Path Traversal in VGuard IP Camera Network Recorder

Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Biges
Products
Vg-255-bv Vg-255-bv Firmware Vg-255-df and 15 more
CVE-2023-7081

SQLi in PosTahsil's Online Payment System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Postahsil
Products
Online Payment System
CVE-2023-7153

Reflected XSS in Macroturk's Macro-Bel

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Macroturk Software and Internet Technologies Macro-Bel allows Reflected XSS. This issue affects Macro-Bel: before V.1.0.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Macroturk
Products
Macro-bel
CVE-2022-23790

XSS in Firmanet Software and Technology Customer Relation Manager

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Customer Relation Manager: before 2022.03.13.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Firmanet
Products
Technology Customer Relation Manager
CVE-2022-23791

XSS in Firmanet Software and Technology Customer Relation Manager

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Customer Relation Manager: before 2022.03.13.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Firmanet
Products
Customer Relation Manager
CVE-2022-24036

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2022-24038

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2022-24037

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Karmasis
Products
Infraskope Siem\+
CVE-2022-0495

SQL Injection in KOHA

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Parantezteknoloji
Products
Koha Library Automation
CVE-2026-7668

MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds

A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read. The attack may be initiated remotely. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor recommends to "use the latest v6.x or 7.x MikroTik RouterOS version, the reported issue should be fixed there."

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mikrotik
Products
Routeros
CVE-2022-0900

Cross-Site Scripting Vulnerability in DivvyDrive

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NetDataSoft DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from unspecified before v.4.6.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Netdatasoft
Products
Divvy Drive
CVE-2022-1277

SQL Injection in Inavitas Solar Log

Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Inavitas
Products
Solar Log