Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2022-0705

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0704

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

CVSS 3.1 · 5.4 Medium EPSS 1.3% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0703

GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site Scripting

The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gd-mylist Project
Products
Gd-mylist
CVE-2022-0702

Petfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site Scripting

The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Unboxinteractive
Products
Petfinder-listings
CVE-2022-0701

SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Seo-301-meta Project
Products
Seo-301-meta
CVE-2022-0700

Simple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting

The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Chrsinteractive
Products
Simple Tracking
CVE-2022-0697

Open Redirect in archivy/archivy

Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Archivy Project
Products
Archivy
CVE-2022-0694

Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2022-0693

Master Elements <= 8.0 - Unauthenticated SQLi

The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection

CVSS 3.1 · 9.8 Critical EPSS 6.9% KEV · Not listed
Vendors
Devbunch
Products
Master Elements
CVE-2022-0692

Open Redirect on Rudloff/alltube in rudloff/alltube

Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.

CVSS 3.1 · 6.1 Medium EPSS 3.4% KEV · Not listed
Vendors
Alltube Project
Products
Alltube
CVE-2022-0691

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Rhmt Url-parse
CVE-2022-0690

Cross-site Scripting (XSS) - Reflected in microweber/microweber

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0689

Use multiple time the one-time coupon in microweber/microweber

Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0688

Business Logic Errors in microweber/microweber

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0687

Amelia < 1.0.46 - Manager+ RCE

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Tms-outsource
Products
Amelia
CVE-2022-0686

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

CVSS 3.1 · 9.1 Critical EPSS 1.8% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Rhmt Url-parse
CVE-2022-0684

WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site Scripting

The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Home Page Menu Project
Products
Wp Home Page Menu