Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2022-25746

Buffer Copy Without Checking Size of Input in Kernel

Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Aqt1000 Aqt1000 Firmware Ar8035 and 193 more
CVE-2022-25715

Incorrect type casting in Display driver

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Aqt1000 Aqt1000 Firmware Mdm9150 and 61 more
CVE-2022-22088

Integer Overflow to Buffer Overflow in Bluetooth HOST

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Apq8009 Apq8009 Firmware Apq8009w and 297 more
CVE-2025-3141

SourceCodester Online Medicine Ordering System manage_category.php sql injection

A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_category.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Online Medicine Ordering System
CVE-2014-125057

mrobit robitailletheknot CSRF Token filters.php comparison

A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token Handler. The manipulation of the argument _token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6b2813696ccb88d0576dfb305122ee880eb36197. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217599.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Robitailletheknot Project
Products
Robitailletheknot
CVE-2018-25070

polterguy Phosphorus Five CSV Import NonQuery.cs csv.Read sql injection

A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Aista
Products
Phosphorus Five
CVE-2015-10024

hoffie larasync file_storage.go path traversal

A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Larasync Project
Products
Larasync
CVE-2015-10032

HealthMateWeb createaccount.php cross site scripting

A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Healthmateweb Project
Products
Healthmateweb
CVE-2021-4311

Talend Open Studio for MDM XML xml external entity reference

A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Talend
Products
Open Studio
CVE-2022-4778

path traversal in elvexys StreamX using StreamView HTML component with public web server feature

StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem. StreamX applications using StreamView HTML component with the public web server feature activated are affected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elvexys
Products
Streamx
CVE-2022-4491

WP Table Reloaded <= 1.9.4 - Contributor+ Stored XSS

The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-table Reloaded Project
Products
Wp-table Reloaded
CVE-2022-4479

Table of Contents Plus < 2212 - Contributor+ Stored XSS

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dublue
Products
Table Of Contents Plus
CVE-2022-4468

WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS

The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bootstrapped
Products
Wp Recipe Maker
CVE-2022-4426

Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpswings
Products
Mautic Integration For Woocommerce
CVE-2022-4394

iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ipages Flipbook Project
Products
Ipages Flipbook
CVE-2022-4391

Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSS

The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Vision Interactive Project
Products
Vision Interactive