Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,910

CVE-2023-5155

SQLi in Utarit's Smart Deposit System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2026-6395

Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page

The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Winking Wordpress
Products
Word 2 Cash Wordpress
CVE-2026-2955

AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wupsales
Products
Wordpress Ai Chatbot & Workflow Automation By Aiwu
CVE-2026-31405

media: dvb-net: fix OOB access in ULE extension header tables

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2023-6153

Authentication Bypass in TeoSOFT Software TeoBASE

Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass. This issue affects TeoBASE: through 20240327. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2023-6190

Authenicated Path Traversal in İzmir Katip Çelebi University

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ikcu
Products
University Information Management System
CVE-2023-6201

Command Injection in Univera Panorama Framework

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama allows Command Injection. This issue affects Panorama: before 8.0.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Univera
Products
Panorama
CVE-2023-6255

Hardcoded Credentals in SoliClub Mobile App

Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2023-4993

Sensetive Data Exposure in Utarit's Soliclub

Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Solipay Mobile Solipay Mobile App
CVE-2023-6436

SQLi in Ekol Bilisim Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ekolbilisim
Products
Web Sablonu Yazilimi
CVE-2023-6441

SQLi in UNI-PA's University Information System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Uni-pa University Marketing And Computer Internet Trade Inc Unipa
Products
University Information System University Information System
CVE-2023-6515

IDOR in Mia Technology's Mia-Med

Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6517

Seeing the SMS Verification Code in Mia Technology's Mia-Med

Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6518

Password Disclosure in Mia Technology's Mia-Med

Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6519

Seeing admin password hash value in Mia Technology's Mia-Med

Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miateknoloji
Products
Mia-med
CVE-2023-6522

Information Disclosure in ExtremePacs's Extreme XDS

Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Extremepacs
Products
Extreme Xds
CVE-2023-6523

IDOR in ExtremePacs's Extreme XDS

Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse. This issue affects Extreme XDS: before 3914.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Extremepacs
Products
Extreme Xds
CVE-2023-6672

Stored XSS in National Keep's CyberMath

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CyberMath allows Stored XSS. This issue affects CyberMath: from v1.4 before v1.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2023-6673

Reflected XSS in National Keep's CyberMath

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CyberMath allows Reflected XSS. This issue affects CyberMath: from v.1.4 before v.1.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2023-6675

Malicious File Upload in National Keep's CyberMath

Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath