Search vulnerabilities

Expected end of text, found '/' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2022-1598

WPQA < 5.5 - Unauthenticated Private Message Disclosure

The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.

CVSS 3.1 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
2code
Products
Wpqa Builder
CVE-2022-1597

WPQA < 5.4 - Reflected Cross-Site Scripting

The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks

CVSS 3.1 · 6.1 Medium EPSS 3.0% KEV · Not listed
Vendors
2code
Products
Wpqa Builder
CVE-2022-1596

ABB Relion REX640 Insufficient file access control

Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Rex640 Pcl1 Rex640 Pcl1 Firmware Rex640 Pcl2 and 3 more
CVE-2022-1594

HC Custom WP-Admin URL <= 1.4 - Arbitrary Settings Update via CSRF

The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hc Custom Wp-admin Url Project
Products
Hc Custom Wp-admin Url
CVE-2022-1593

Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF

The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Site Offline Or Coming Soon Project
Products
Site Offline Or Coming Soon
CVE-2022-1592

Server-Side Request Forgery in scout in clinical-genomics/scout

Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...

CVSS 3.1 · 8.2 High EPSS 1.3% KEV · Not listed
Vendors
Clinical-genomics
Products
Scout
CVE-2022-1591

WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Ping Optimizer Project
Products
Wordpress Ping Optimizer
CVE-2022-1587

pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Netapp Pcre and 1 more
Products
Fedora Active Iq Unified Manager H300s and 14 more
CVE-2022-1585

Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Project-source-code-download Project
Products
Project-source-code-download
CVE-2022-1584

Reflected XSS in microweber/microweber

Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-1583

External Links in New Window / New Tab < 1.43 - Tabnabbing

The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Webfactoryltd
Products
External Links In New Window \/ New Tab
CVE-2022-1582

External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting

The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webfactoryltd
Products
External Links In New Window \/ New Tab
CVE-2022-1580

Site Offline < 1.5.3 - Access Bypass

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Freehtmldesigns
Products
Site Offline
CVE-2022-1577

Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Deliciousbrains
Products
Database Backup
CVE-2022-1576

WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle
Products
Wp Maintenance Mode \& Coming Soon
CVE-2022-1575

Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.

CVSS 3.1 · 9.6 Critical EPSS 2.4% KEV · Not listed
Vendors
Diagrams
Products
Drawio
CVE-2022-1574

HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

CVSS 3.1 · 9.8 Critical EPSS 12.2% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp
CVE-2022-1573

HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF

The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp
CVE-2022-1572

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp