Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,894

CVE-2026-5200

AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Acyba Wordpress
Products
Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress Wordpress
CVE-2023-6437

Authenticated RCE

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also  the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
—
Products
—
CVE-2023-6191

SQLi in WebPDKS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection. This issue affects WebPDKS: through 20240329. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Webpdks
Products
Egehan Security Webpdks
CVE-2023-6173

SQLi in TeoSOFT Software TeoBASE

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL Injection. This issue affects TeoBASE: through 27032024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2023-5155

SQLi in Utarit's Smart Deposit System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2026-6395

Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page

The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Winking Wordpress
Products
Word 2 Cash Wordpress
CVE-2026-2955

AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wupsales
Products
Wordpress Ai Chatbot & Workflow Automation By Aiwu
CVE-2026-31405

media: dvb-net: fix OOB access in ULE extension header tables

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2023-6153

Authentication Bypass in TeoSOFT Software TeoBASE

Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass. This issue affects TeoBASE: through 20240327. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2023-6190

Authenicated Path Traversal in İzmir Katip Çelebi University

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ikcu
Products
University Information Management System
CVE-2023-6201

Command Injection in Univera Panorama Framework

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama allows Command Injection. This issue affects Panorama: before 8.0.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Univera
Products
Panorama
CVE-2023-6255

Hardcoded Credentals in SoliClub Mobile App

Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2023-4993

Sensetive Data Exposure in Utarit's Soliclub

Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2023-6436

SQLi in Ekol Bilisim Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ekolbilisim
Products
Web Sablonu Yazilimi
CVE-2023-6441

SQLi in UNI-PA's University Information System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Uni-pa University Marketing And Computer Internet Trade Inc Unipa
Products
University Information System University Information System
CVE-2023-6515

IDOR in Mia Technology's Mia-Med

Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6517

Seeing the SMS Verification Code in Mia Technology's Mia-Med

Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6518

Password Disclosure in Mia Technology's Mia-Med

Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6519

Seeing admin password hash value in Mia Technology's Mia-Med

Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6522

Information Disclosure in ExtremePacs's Extreme XDS

Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Extremepacs
Products
Extreme Xds