Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (324662 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-68509 1 Wordpress 1 Wordpress 2025-12-29 6.1 Medium
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.
CVE-2025-67632 1 Wordpress 1 Wordpress 2025-12-29 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design &#8211; GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSense for Responsive Design &#8211; GARD: from n/a through <= 2.23.
CVE-2025-68577 1 Wordpress 1 Wordpress 2025-12-29 8.8 High
Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.
CVE-2025-68589 2 Wordpress, Wpsocio 2 Wordpress, Wp Telegram Widget And Join Link 2025-12-29 8.1 High
Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.11.
CVE-2025-68599 1 Wordpress 1 Wordpress 2025-12-29 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.4.
CVE-2025-68606 2 Wordpress, Wpxpo 2 Wordpress, Postx 2025-12-29 7.5 High
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.
CVE-2025-68593 1 Wordpress 1 Wordpress 2025-12-29 8.8 High
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2025-68587 1 Wordpress 1 Wordpress 2025-12-29 8.1 High
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
CVE-2025-68585 1 Wordpress 1 Wordpress 2025-12-29 8.8 High
Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Document Revisions: from n/a through <= 3.7.2.
CVE-2025-68592 1 Wordpress 1 Wordpress 2025-12-29 8.8 High
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2025-68594 1 Wordpress 1 Wordpress 2025-12-29 8.1 High
Missing Authorization vulnerability in Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.1.
CVE-2025-68598 2 Livecomposer, Wordpress 2 Page Builder: Live Composer, Wordpress 2025-12-29 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiveComposer Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through <= 2.0.5.
CVE-2025-68601 2 Rustaurius, Wordpress 2 Five Star Restaurant Reservations, Wordpress 2025-12-29 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.7.
CVE-2025-43875 1 Johnsoncontrols 5 Istar Edge G2, Istar Ultra, Istar Ultra G2 and 2 more 2025-12-29 N/A
Under certain circumstances a successful exploitation could result in access to the device.
CVE-2025-43876 1 Johnsoncontrols 5 Istar Edge G2, Istar Ultra, Istar Ultra G2 and 2 more 2025-12-29 N/A
Under certain circumstances a successful exploitation could result in access to the device.
CVE-2019-25235 1 Smartwares 1 Home Easy 2025-12-29 9.8 Critical
Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.
CVE-2019-25242 1 Iwt 1 Facesentry Access Control System 2025-12-29 4.3 Medium
FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.
CVE-2019-25241 1 Iwt 1 Facesentry Access Control System 2025-12-29 7.5 High
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
CVE-2018-25155 1 Teradek 1 Slice 2025-12-29 5.3 Medium
Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page that automatically submits password change requests to the device when a logged-in user visits the page.
CVE-2019-25233 1 Ave 1 Dominaplus 2025-12-29 5.3 Medium
AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.