Search vulnerabilities

Expected end of text, found ',' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2016-10958

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Estatik
Products
Estatik
CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Akal Project
Products
Akal
CVE-2016-10955

The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Cysteme
Products
Cysteme-finder
CVE-2016-10954

The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Dynamicpress
Products
Neosense
CVE-2016-10950

The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Sirv
Products
Sirv
CVE-2016-10949

The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Relevanssi
Products
Relevanssi
CVE-2016-10945

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Pagelines
Products
Pagelines
CVE-2016-10942

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Podlove
Products
Podlove Podcast Publisher