Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20777 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-20153 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
CVE-2018-20152 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
CVE-2018-20151 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
CVE-2018-20150 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
CVE-2018-20149 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
CVE-2018-20148 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
CVE-2018-20147 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 N/A
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
CVE-2018-20101 1 Codection 1 Import Users From Csv With Meta 2024-11-21 N/A
The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
CVE-2018-19796 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
CVE-2018-19564 1 Goldplugins 1 Easy Testimonials 2024-11-21 N/A
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
CVE-2018-19488 1 Wp-jobhunt Project 1 Wp-jobhunt 2024-11-21 N/A
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
CVE-2018-19487 1 Wp-jobhunt Project 1 Wp-jobhunt 2024-11-21 N/A
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
CVE-2018-19456 2 Opensuse, Wplaunchpad 2 Leap, Wpbackupplus 2024-11-21 N/A
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
CVE-2018-19370 1 Yoast 1 Yoast Seo 2024-11-21 N/A
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
CVE-2018-19287 1 Ninjaforma 1 Ninja Forms 2024-11-21 N/A
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
CVE-2018-19207 1 Van-ons 1 Wp-gdpr-compliance 2024-11-21 N/A
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
CVE-2018-19043 1 Media File Manager Project 1 Media File Manager 2024-11-21 N/A
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI.
CVE-2018-19042 1 Media File Manager Project 1 Media File Manager 2024-11-21 N/A
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI.
CVE-2018-19041 1 Media File Manager Project 1 Media File Manager 2024-11-21 N/A
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
CVE-2018-19040 1 Media File Manager Project 1 Media File Manager 2024-11-21 N/A
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.