CVE-2025-0213

Campcodes Project Management System update_forms.php unrestricted upload

A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Project Management System

CVE-2022-45358

WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Colorlib

Products

Activello

CVE-2023-27610

WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection

Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Transbank

Products

Transbank Webpay Rest

CVE-2023-30474

WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ultimate Noindex Nofollow Tool Ii Project

Products

Ultimate Noindex Nofollow Tool Ii

CVE-2023-22687

WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure

Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Freesoul Deactivate Plugins - Plugin Manager And Cleanup Project

Products

Freesoul Deactivate Plugins - Plugin Manager And Cleanup

CVE-2022-43458

WordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codetides

Products

Advanced Floating Content

CVE-2023-2972

Prototype Pollution in antfu/utils

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Antfu

Products

Utils

CVE-2022-44734

WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft

Products

Car Rental

CVE-2022-45849

WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Colorlib

Products

Activello Theme

CVE-2022-45838

WordPress ARForms Form Builder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Reputeinfosystems

Products

Arforms Form Builder

CVE-2022-44632

WordPress Content Repeater – Custom Posts Simplified Plugin <= 1.1.13 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Content-repeater Project

Products

Content-repeater

CVE-2022-44631

WordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

1app

Products

1app Business Forms

CVE-2022-44582

WordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apptivo Apptivo Business Site CRM plugin <= 3.0.12 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apptivo

Products

Apptivo Business Site Crm

CVE-2024-50339

GLPI vulnerable to unauthenticated session hijacking

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVSS 4.0 · 9.3 Critical EPSS 18.7% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2022-44594

WordPress All in One Time Clock Lite Plugin <= 1.3.320 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Codebangers

Products

All In One Time Clock Lite

CVE-2023-24584

Controller 6000 buffer overflow via upload feature in web interface

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gallagher

Products

Controller 6000 Controller 6000 Firmware

CVE-2022-47435

WordPress WP-OliveCart Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wp-olivecart Project

Products

Wp-olivecart

CVE-2023-24386

WordPress AI Contact Us Form Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <= 1.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ai Contact Us Form Project

Products

Ai Contact Us Form

CVE-2023-24404

WordPress Marketing Performance Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rarathemes

Products

Vryasage Marketing Performance

CVE-2022-45361

WordPress 0mk Shortener Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Boris Kuzmanov 0mk Shortener plugin <= 0.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

0mk Shortener Project

Products

0mk Shortener