Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20784 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-24144 1 Media File Organizer Project 1 Media File Organizer 2024-11-21 8.6 High
Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation.
CVE-2020-24143 1 Ninjateam 1 Video Downloader For Tiktok 2024-11-21 7.5 High
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.
CVE-2020-24142 1 Ninjateam 1 Video Downloader For Tiktok 2024-11-21 9.8 Critical
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
CVE-2020-24141 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2024-11-21 5.3 Medium
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
CVE-2020-24063 1 Canto 1 Canto 2024-11-21 7.2 High
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
CVE-2020-23762 1 Larsens Calendar Project 1 Larsens Calendar 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the "titel" column on the "Eintrage hinzufugen" tab.
CVE-2020-22277 1 Codection 1 Import And Export Users And Customers 2024-11-21 8.0 High
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
CVE-2020-22276 1 Weformspro 1 Weforms 2024-11-21 9.8 Critical
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
CVE-2020-22275 1 Easyregistrationforms 1 Easy Registration Forms 2024-11-21 8.8 High
Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable.
CVE-2020-21524 1 Halo 1 Halo 2024-11-21 9.1 Critical
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
CVE-2020-20634 1 Elementor 1 Website Builder 2024-11-21 6.5 Medium
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
CVE-2020-20633 1 Cookielawinfo 1 Gdpr Cookie Consent 2024-11-21 5.4 Medium
ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.
CVE-2020-20627 1 Givewp 1 Givewp 2024-11-21 5.3 Medium
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
CVE-2020-20626 1 Lara\'s Google Analytics Project 1 Lara\'s Google Analytics 2024-11-21 5.4 Medium
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
CVE-2020-20625 1 Slicedinvoices 1 Sliced Invoices 2024-11-21 7.5 High
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
CVE-2020-17362 1 Themeinprogress 1 Nova Lite 2024-11-21 6.1 Medium
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
CVE-2020-16140 1 Thembay 1 Greenmart 2024-11-21 6.1 Medium
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
CVE-2020-15537 1 Vanguard Project 1 Vanguard 2024-11-21 6.1 Medium
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.
CVE-2020-15536 1 Online Hotel Booking System Project 1 Online Hotel Booking System 2024-11-21 6.1 Medium
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
CVE-2020-15535 1 Bestsoftinc 1 Car Rental System 2024-11-21 6.1 Medium
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.