Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (18007 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-9014 1 Wpmarketplace Project 1 Wpmarketplace 2024-11-21 4.3 Medium
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.
CVE-2014-9013 1 Wpmarketplace Project 1 Wpmarketplace 2024-11-21 8.8 High
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
CVE-2014-8739 2 Creative-solutions, Jquery File Upload Project 2 Creative Contact Form, Jquery File Upload 2024-11-21 9.8 Critical
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
CVE-2014-8336 1 Wp-dbmanager Project 1 Wp-dbmanager 2024-11-21 N/A
The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
CVE-2014-8335 1 Wp-dbmanager Project 1 Wp-dbmanager 2024-11-21 N/A
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVE-2014-7238 1 Formget 1 Contact Form Integrated With Google Maps 2024-11-21 6.1 Medium
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
CVE-2014-6604 1 Subscribe2 Project 1 Subscribe2 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
CVE-2014-6412 1 Wordpress 1 Wordpress 2024-11-21 N/A
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
CVE-2014-6059 1 Vasyltech 1 Advanced Access Manager 2024-11-21 7.2 High
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
CVE-2014-5072 1 Wpsecurityauditlog 1 Wp Security Audit Log 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2014-5034 1 Fresh-media 1 Brute Force Login Protection 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.
CVE-2014-5014 1 Tinywebgallery 1 Wordpress Flash Uploader 2024-11-21 N/A
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
CVE-2014-4972 1 Ajax Upload For Gravity Forms Project 1 Ajax Upload For Gravity Forms 2024-11-21 N/A
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
CVE-2014-4932 1 Wordfence 1 Wordfence Security 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
CVE-2014-4592 1 Czepol 1 Wp-planet 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2014-4567 1 Videowhisper 1 Video Comments Webcam Recorder 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVE-2014-4561 1 Ultimate-weather Project 1 Ultimate-weather 2024-11-21 6.1 Medium
The ultimate-weather plugin 1.0 for WordPress has XSS
CVE-2014-4559 1 Cybercompay 1 Swipehq-payment-gateway-wp-e-commerce 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key, (2) payment_page_url, (3) merchant_id, (4) api_url, or (5) currency parameter.
CVE-2014-4558 1 Cybercompany 1 Swipehq-payment-gateway-woocommerce 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
CVE-2014-4553 1 Spreadshirt-rss-3d-cube-flash-gallery Project 1 Spreadshirt-rss-3d-cube-flash-gallery 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.