Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2022-0278

Cross-site Scripting (XSS) - Stored in microweber/microweber

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0277

Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0274

Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Orchardcore
Products
Orchardcore
CVE-2022-0273

Improper Access Control in janeczku/calibre-web

Improper Access Control in Pypi calibreweb prior to 0.6.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Janeczku
Products
Calibre-web
CVE-2022-0272

Improper Restriction of XML External Entity Reference in detekt/detekt

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Detekt
Products
Detekt
CVE-2022-0271

LearnPress < 4.1.6 - Reflected Cross-Site Scripting

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Thimpress
Products
Learnpress
CVE-2022-0270

Improper header sanitization in bored-agent causes escalation of privilege

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mirantis
Products
Bored-agent
CVE-2022-0268

Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2022-0267

AdRotate < 5.8.22 - Admin+ SQL Injection

The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Adrotate Project
Products
Adrotate
CVE-2022-0266

Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.

CVSS 3.1 · 6.6 Medium EPSS 1.1% KEV · Not listed
Vendors
Livehelperchat
Products
Live Helper Chat
CVE-2022-0265

Improper Restriction of XML External Entity Reference in hazelcast/hazelcast

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Hazelcast
Products
Hazelcast
CVE-2022-0263

Unrestricted Upload of File with Dangerous Type in pimcore/pimcore

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0262

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0260

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0258

SQL Injection in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0257

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0256

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2022-0255

Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection

The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Deliciousbrains
Products
Database Backup
CVE-2022-0254

Zero Spam < 5.2.11 - Admin+ SQL Injection

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Highfivery
Products
Zero-spam