Updated the description and name fields for CVE-2025-6403 to clarify the SQL injection vulnerability. Adjusted matchers and tags for improved accuracy.
- Converted Python code protocol to JavaScript protocol
- Improved readability and maintainability
- Maintained all original functionality and matchers
* AEM querybuilder bypass research by Assenote
New technique to hack AEM CMS
* Rename aem-querybuilder-exposure-bypass.yaml to aem-querybuilder-bypass.yaml
* Rename AEM QueryBuilder rule to include 'Bypass'
Updated the name of the AEM QueryBuilder rule to include 'Bypass'.
* misc updates
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
Co-authored-by: PDTeamX <[email protected]>
* Update ASP.Net page configuration and matchers
Updated the ASP.Net Test Page to ASP.Net Default Page, modified the description, and adjusted the Shodan query. Added additional matchers for improved detection.
* Update shodan-query for ASP.Net page
* Fix blank space in default-asp-net-page.yaml
* simplified matcher
---------
Co-authored-by: PDTeamX <[email protected]>
* Add CVE-2025-54236 YAML configuration
* Enhance CVE-2025-54236 details and update request method
Updated CVE-2025-54236 entry with detailed information including description, impact, and remediation steps. Changed request method and added new variables for file upload.
* Update tags in CVE-2025-54236.yaml
Removed 'passive' tag from CVE-2025-54236.yaml.
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
Updated the CVE-2019-16072 YAML file to include impact details and revised remediation steps. Adjusted metadata fields and modified matchers for improved accuracy.
Updated author information, modified severity description, and adjusted remediation guidance. Changed verification status and refined matchers and extractors.
"cloudapp.net" is no longer vulnerable.
Microsoft replaced "cloud service (classic)" with "cloud service (extended support)" which has another DNS zone `cloudapp.azure.com`.
Microsoft no longer allows register new cloud services under `cloudapp.net`
Template / PR Information
Tests Shibboleth.sso for open redirect misconfiguration (unrestricted in earlier versions, able to be restricted since v3.1 but still enabled by default and should be manually configured)
Template Validation
I've validated this template locally?
YES
[shibboleth-open-redirect] [http] [medium] https://server/Shibboleth.sso/Logout?return=https://345oqvpCTut4VdCVNDLCDUCHFcu.interact.sh
Adding same POC for detection as the weak crypto enables the deserialization attack. If you can successfully deserialize malicious data (CVE-2017-9822), it proves the encryption is weak enough to craft the payload (CVE-2018-15811/18325). They are different aspects of the same exploitation chain, which is why the metasploit module targets all five related CVEs with a single exploit.
- change flow from "http(1) && http(2)" to "http(2)" so detection isn't blocked if root (/) returns 404
- enable DOTALL in regex by updating (?i) -> (?is) to match multi-line HTML responses
- keep root health-check as internal heuristic
- Add nuclei template for CVE-2025-58443 FOGProject authentication bypass
- Detects unauthenticated access to management interface
- Includes database dump via SQL export functionality
- Supports Local File Inclusion (LFI) through file parameter
- Extracts FOG version and sensitive information
- Tested against FOGProject 1.5.10.1673
- CVSS Score: 9.9 (Critical)
Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
description:Detects whether kube-apiserver includes the --token-auth-file startup argument.
impact:|
If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
remediation:|
Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
/etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
remediation:|
Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
impact:|
Remote unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
remediation:|
Update to the latest Fireware OS version beyond 2025.1.
Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
The run-parts command in Linux is used to run all the executable files in a directory. It is commonly used for running scripts or commands located in a specific directory, such as system maintenance scripts in /etc/cron.daily. The run-parts command provides a convenient way to execute multiple scripts or commands in a batch manner.
{"ID":"CVE-2004-0519","Info":{"Name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2004/CVE-2004-0519.yaml"}
{"ID":"CVE-2004-1965","Info":{"Name":"Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) redirect parameter to member.php, (2) to parameter to myhome.php (3) TID parameter to post.php, or (4) redirect parameter to index.php.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2004/CVE-2004-1965.yaml"}
{"ID":"CVE-2005-2428","Info":{"Name":"Lotus Domino R5 and R6 WebMail - Information Disclosure","Severity":"medium","Description":"Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled (which is by default) allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and the client Lotus Domino release in the ClntBld field (a different vulnerability than CVE-2005-2696).","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2005/CVE-2005-2428.yaml"}
{"ID":"CVE-2005-3128","Info":{"Name":"SquirrelMail Address Add 1.4.2 - Cross-Site Scripting","Severity":"medium","Description":"SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2005/CVE-2005-3128.yaml"}
{"ID":"CVE-2005-3344","Info":{"Name":"Horde Groupware Unauthenticated Admin Access","Severity":"critical","Description":"Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2005/CVE-2005-3344.yaml"}
{"ID":"CVE-2005-3634","Info":{"Name":"SAP Web Application Server 6.x/7.0 - Open Redirect","Severity":"medium","Description":"frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.\n","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2005/CVE-2005-3634.yaml"}
{"ID":"CVE-2005-4385","Info":{"Name":"Cofax \u003c=2.0RC3 - Cross-Site Scripting","Severity":"medium","Description":"Cofax 2.0 RC3 and earlier contains a cross-site scripting vulnerability in search.htm which allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2005/CVE-2005-4385.yaml"}
@@ -40,7 +41,7 @@
{"ID":"CVE-2009-1872","Info":{"Name":"Adobe Coldfusion \u003c=8.0.1 - Cross-Site Scripting","Severity":"medium","Description":"Adobe ColdFusion Server 8.0.1 and earlier contain multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2009/CVE-2009-1872.yaml"}
{"ID":"CVE-2009-2015","Info":{"Name":"Joomla! MooFAQ 1.0 - Local File Inclusion","Severity":"high","Description":"Joomla! Ideal MooFAQ 1.0 via com_moofaq allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter (local file inclusion).","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2009/CVE-2009-2015.yaml"}
{"ID":"CVE-2009-2100","Info":{"Name":"Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion","Severity":"medium","Description":"Joomla! JoomlaPraise Projectfork (com_projectfork) 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2009/CVE-2009-2100.yaml"}
{"ID":"CVE-2009-3053","Info":{"Name":"Joomla! Agora 3.0.0b - Local File Inclusion","Severity":"medium","Description":"Joomla! Agora 3.0.0b (com_agora) allows remote attackers to include and execute arbitrary local files via local file inclusion in the action parameter to the avatars page, reachable through index.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2009/CVE-2009-3053.yaml"}
{"ID":"CVE-2009-3053","Info":{"Name":"Joomla! Agora 3.0.0b - Local File Inclusion","Severity":"medium","Description":"Joomla! Agora 3.0.0b (com_agora) allows remote attackers to include and execute arbitrary local files via local file inclusion in the action parameter to the avatars page, reachable through index.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2009/CVE-2009-3053.yaml"}
{"ID":"CVE-2009-3318","Info":{"Name":"Joomla! Roland Breedveld Album 1.14 - Local File Inclusion","Severity":"high","Description":"Joomla! Roland Breedveld Album 1.14 (com_album) is susceptible to local file inclusion because it allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2009/CVE-2009-3318.yaml"}
{"ID":"CVE-2009-4202","Info":{"Name":"Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion","Severity":"high","Description":"Joomla! Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2009/CVE-2009-4202.yaml"}
{"ID":"CVE-2009-4223","Info":{"Name":"KR-Web \u003c=1.1b2 - Remote File Inclusion","Severity":"high","Description":"KR-Web 1.1b2 and prior contain a remote file inclusion vulnerability via adm/krgourl.php, which allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2009/CVE-2009-4223.yaml"}
@@ -129,6 +130,7 @@
{"ID":"CVE-2010-1981","Info":{"Name":"Joomla! Component Fabrik 2.0 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2010/CVE-2010-1981.yaml"}
{"ID":"CVE-2010-1982","Info":{"Name":"Joomla! Component JA Voice 2.0 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1982.yaml"}
{"ID":"CVE-2010-1983","Info":{"Name":"Joomla! Component redTWITTER 1.0 - Local File Inclusion","Severity":"high","Description":"A drectory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-1983.yaml"}
{"ID":"CVE-2010-2018","Info":{"Name":"Lokomedia CMS - Local File Inclusion","Severity":"high","Description":"A Local File Inclusion (LFI) vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-2018.yaml"}
{"ID":"CVE-2010-2033","Info":{"Name":"Joomla! Percha Categories Tree 0.6 - Local File Inclusion","Severity":"high","Description":"A directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-2033.yaml"}
{"ID":"CVE-2010-2034","Info":{"Name":"Joomla! Component Percha Image Attach 1.1 - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-2034.yaml"}
{"ID":"CVE-2010-2035","Info":{"Name":"Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-2035.yaml"}
@@ -160,6 +162,7 @@
{"ID":"CVE-2010-5278","Info":{"Name":"MODx manager - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter when magic_quotes_gpc is disabled.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2010/CVE-2010-5278.yaml"}
{"ID":"CVE-2010-5286","Info":{"Name":"Joomla! Component Jstore - 'Controller' Local File Inclusion","Severity":"critical","Description":"A directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2010/CVE-2010-5286.yaml"}
{"ID":"CVE-2011-0049","Info":{"Name":"Majordomo2 - SMTP/HTTP Directory Traversal","Severity":"medium","Description":"A directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2011/CVE-2011-0049.yaml"}
{"ID":"CVE-2011-0518","Info":{"Name":"LotusCMS 3.0 - Remote Code Execution","Severity":"critical","Description":"LotusCMS 3.0 is susceptible to remote code execution via the Router () function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2011/CVE-2011-0518.yaml"}
{"ID":"CVE-2011-1669","Info":{"Name":"WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI)","Severity":"medium","Description":"A directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2011/CVE-2011-1669.yaml"}
{"ID":"CVE-2011-2744","Info":{"Name":"Chyrp 2.x - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2011/CVE-2011-2744.yaml"}
{"ID":"CVE-2011-2780","Info":{"Name":"Chyrp 2.x - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2011/CVE-2011-2780.yaml"}
@@ -210,12 +213,14 @@
{"ID":"CVE-2013-3827","Info":{"Name":"Javafaces LFI","Severity":"medium","Description":"An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2013/CVE-2013-3827.yaml"}
{"ID":"CVE-2013-4117","Info":{"Name":"WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2013/CVE-2013-4117.yaml"}
{"ID":"CVE-2013-4625","Info":{"Name":"WordPress Plugin Duplicator \u003c 0.4.5 - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2013/CVE-2013-4625.yaml"}
{"ID":"CVE-2013-4982","Info":{"Name":"AVTECH DVR - Login Verification Code Bypass","Severity":"low","Description":"AVTECH DVR products are vulnerable to verification code bypass just by entering the \"login=quick\" parameter to bypass verification code.\n","Classification":{"CVSSScore":"5.0"}},"file_path":"http/cves/2013/CVE-2013-4982.yaml"}
{"ID":"CVE-2013-5528","Info":{"Name":"Cisco Unified Communications Manager 7/8/9 - Directory Traversal","Severity":"medium","Description":"A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815","Classification":{"CVSSScore":"4"}},"file_path":"http/cves/2013/CVE-2013-5528.yaml"}
{"ID":"CVE-2013-5979","Info":{"Name":"Xibo 1.2.2/1.4.1 - Directory Traversal","Severity":"medium","Description":"A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2013/CVE-2013-5979.yaml"}
{"ID":"CVE-2013-6281","Info":{"Name":"WordPress Spreadsheet - Cross-Site Scripting","Severity":"medium","Description":"WordPress Spreadsheet plugin contains a reflected cross-site scripting vulnerability in /dhtmlxspreadsheet/codebase/spreadsheet.php.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2013/CVE-2013-6281.yaml"}
{"ID":"CVE-2013-7091","Info":{"Name":"Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2013/CVE-2013-7091.yaml"}
{"ID":"CVE-2013-7240","Info":{"Name":"WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal","Severity":"medium","Description":"A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2013/CVE-2013-7240.yaml"}
{"ID":"CVE-2013-7285","Info":{"Name":"XStream \u003c1.4.6/1.4.10 - Remote Code Execution","Severity":"critical","Description":"Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2013/CVE-2013-7285.yaml"}
{"ID":"CVE-2014-100004","Info":{"Name":"Sitecore CMS - Cross-Site Scripting","Severity":"medium","Description":"Sitecore CMS contains a cross-site scripting vulnerability via the \"special way\" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2014/CVE-2014-100004.yaml"}
{"ID":"CVE-2014-10037","Info":{"Name":"DomPHP 0.83 - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. (dot dot) in the url parameter to photoalbum/index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2014/CVE-2014-10037.yaml"}
{"ID":"CVE-2014-1203","Info":{"Name":"Eyou E-Mail \u003c3.6 - Remote Code Execution","Severity":"critical","Description":"Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php via the get_login_ip_config_file function.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2014/CVE-2014-1203.yaml"}
{"ID":"CVE-2014-2321","Info":{"Name":"ZTE Cable Modem Web Shell","Severity":"critical","Description":"ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to web_shell_cmd.gch, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2014/CVE-2014-2321.yaml"}
@@ -373,7 +378,7 @@
{"ID":"CVE-2016-2389","Info":{"Name":"SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion","Severity":"high","Description":"SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to /Catalog, aka SAP Security Note 2230978.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2016/CVE-2016-2389.yaml"}
{"ID":"CVE-2016-3081","Info":{"Name":"Apache S2-032 Struts - Remote Code Execution","Severity":"high","Description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix (related to chained expressions).\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2016/CVE-2016-3081.yaml"}
{"ID":"CVE-2016-3088","Info":{"Name":"Apache ActiveMQ Fileserver - Arbitrary File Write","Severity":"critical","Description":"Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2016/CVE-2016-3088.yaml"}
{"ID":"CVE-2016-3978","Info":{"Name":"Fortinet FortiOS - Open Redirect/Cross-Site Scripting","Severity":"medium","Description":"FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the \"redirect\" parameter to \"login.\"","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-3978.yaml"}
{"ID":"CVE-2016-3978","Info":{"Name":"Fortinet FortiOS - Open Redirect/Cross-Site Scripting","Severity":"medium","Description":"FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the \"redirect\" parameter to \"login.\"","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-3978.yaml"}
{"ID":"CVE-2016-4437","Info":{"Name":"Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability","Severity":"high","Description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2016/CVE-2016-4437.yaml"}
{"ID":"CVE-2016-4975","Info":{"Name":"Apache mod_userdir CRLF injection","Severity":"medium","Description":"Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-4975.yaml"}
{"ID":"CVE-2016-4977","Info":{"Name":"Spring Security OAuth2 Remote Command Execution","Severity":"high","Description":"Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote command execution via the crafting of the value for response_type.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2016/CVE-2016-4977.yaml"}
@@ -386,7 +391,6 @@
{"ID":"CVE-2016-7834","Info":{"Name":"Sony IPELA Engine IP Camera - Hardcoded Account","Severity":"high","Description":"Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2016/CVE-2016-7834.yaml"}
{"ID":"CVE-2016-7981","Info":{"Name":"SPIP \u003c3.1.2 - Cross-Site Scripting","Severity":"medium","Description":"SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in valider_xml.php which allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-7981.yaml"}
{"ID":"CVE-2016-8527","Info":{"Name":"Aruba Airwave \u003c8.2.3.1 - Cross-Site Scripting","Severity":"medium","Description":"Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-8527.yaml"}
{"ID":"CVE-2016-8735","Info":{"Name":"Apache Tomcat - Remote Code Execution via JMX Ports","Severity":"critical","Description":"Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 are vulnerable to remote code execution if JmxRemoteLifecycleListener is used and the JMX ports are exposed to attackers. The vulnerability exists due to inconsistent credential type handling, which was not aligned with the CVE-2016-3427 Oracle patch. Attackers with access to JMX ports can exploit this issue to execute arbitrary code remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2016/CVE-2016-8735.yaml"}
{"ID":"CVE-2016-9299","Info":{"Name":"Jenkins CLI - HTTP Java Deserialization","Severity":"critical","Description":"The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2016/CVE-2016-9299.yaml"}
{"ID":"CVE-2017-0929","Info":{"Name":"DotNetNuke (DNN) ImageHandler \u003c9.2.0 - Server-Side Request Forgery","Severity":"high","Description":"DotNetNuke (aka DNN) before 9.2.0 suffers from a server-side request forgery vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-0929.yaml"}
{"ID":"CVE-2017-1000028","Info":{"Name":"Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion","Severity":"high","Description":"Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-1000028.yaml"}
@@ -440,6 +444,7 @@
{"ID":"CVE-2017-17736","Info":{"Name":"Kentico - Installer Privilege Escalation","Severity":"critical","Description":"Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17736.yaml"}
{"ID":"CVE-2017-18024","Info":{"Name":"AvantFAX 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18024.yaml"}
{"ID":"CVE-2017-18349","Info":{"Name":"Fastjson Insecure Deserialization - Remote Code Execution","Severity":"critical","Description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-18349.yaml"}
{"ID":"CVE-2017-18362","Info":{"Name":"Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution","Severity":"critical","Description":"ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.In February 2019, attackers actively exploited this vulnerability in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-18362.yaml"}
{"ID":"CVE-2017-18487","Info":{"Name":"AdPush \u003c 1.44 - Cross-Site Scripting","Severity":"medium","Description":"The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18487.yaml"}
{"ID":"CVE-2017-18490","Info":{"Name":"Contact Form Multi by BestWebSoft \u003c 1.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18490.yaml"}
{"ID":"CVE-2017-18491","Info":{"Name":"Contact Form by BestWebSoft \u003c 4.0.6 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18491.yaml"}
@@ -472,6 +477,7 @@
{"ID":"CVE-2017-18590","Info":{"Name":"Timesheet Plugin \u003c 0.1.5 - Cross-Site Scripting","Severity":"medium","Description":"The Timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18590.yaml"}
{"ID":"CVE-2017-18598","Info":{"Name":"WordPress Qards - Cross-Site Scripting","Severity":"medium","Description":"WordPress Qards through 2017-10-11 contains a cross-site scripting vulnerability via a remote document specified in the URL parameter to html2canvasproxy.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18598.yaml"}
{"ID":"CVE-2017-18638","Info":{"Name":"Graphite \u003c=1.1.5 - Server-Side Request Forgery","Severity":"high","Description":"Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery (SSR)F. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-18638.yaml"}
{"ID":"CVE-2017-20194","Info":{"Name":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Information Disclosure","Severity":"medium","Description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2017/CVE-2017-20194.yaml"}
{"ID":"CVE-2017-3131","Info":{"Name":"FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting","Severity":"medium","Description":"A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in \"Applications\" under FortiView.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-3131.yaml"}
{"ID":"CVE-2017-3132","Info":{"Name":"Fortinet FortiOS \u003c 5.6.0 - Cross-Site Scripting","Severity":"medium","Description":"A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-3132.yaml"}
{"ID":"CVE-2017-3133","Info":{"Name":"Fortinet FortiOS \u003c 5.6.0 - Cross-Site Scripting","Severity":"medium","Description":"A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-3133.yaml"}
@@ -515,6 +521,7 @@
{"ID":"CVE-2018-1000671","Info":{"Name":"Sympa version =\u003e6.2.16 - Cross-Site Scripting","Severity":"medium","Description":"Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-1000671.yaml"}
{"ID":"CVE-2018-1000856","Info":{"Name":"DomainMOD 4.11.01 - Cross-Site Scripting","Severity":"medium","Description":"DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2018/CVE-2018-1000856.yaml"}
{"ID":"CVE-2018-1000861","Info":{"Name":"Jenkins - Remote Command Injection","Severity":"critical","Description":"Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-1000861.yaml"}
{"ID":"CVE-2018-10088","Info":{"Name":"XiongMai uc-httpd 1.0.0 - Buffer Overflow","Severity":"critical","Description":"Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-10088.yaml"}
{"ID":"CVE-2018-10093","Info":{"Name":"AudioCodes 420HD - Remote Code Execution","Severity":"high","Description":"AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2018/CVE-2018-10093.yaml"}
{"ID":"CVE-2018-10095","Info":{"Name":"Dolibarr \u003c7.0.2 - Cross-Site Scripting","Severity":"medium","Description":"Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-10095.yaml"}
{"ID":"CVE-2018-10141","Info":{"Name":"Palo Alto Networks PAN-OS GlobalProtect \u003c8.1.4 - Cross-Site Scripting","Severity":"medium","Description":"Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-10141.yaml"}
@@ -532,6 +539,7 @@
{"ID":"CVE-2018-10942","Info":{"Name":"Prestashop AttributeWizardPro Module - Arbitrary File Upload","Severity":"critical","Description":"In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-10942.yaml"}
{"ID":"CVE-2018-10956","Info":{"Name":"IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion","Severity":"high","Description":"IPConfigure Orchid Core VMS 2.0.5 is susceptible to local file inclusion.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-10956.yaml"}
{"ID":"CVE-2018-11133","Info":{"Name":"Quest KACE SMA /common/run_cross_report.php 'fmt' XSS","Severity":"medium","Description":"The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-11133.yaml"}
{"ID":"CVE-2018-11138","Info":{"Name":"Quest KACE System Management Appliance 8.0.318 - Remote Code Execution","Severity":"critical","Description":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-11138.yaml"}
{"ID":"CVE-2018-11222","Info":{"Name":"Pandora FMS \u003c=7.0NG.722 - Remote Code Execution","Severity":"high","Description":"Pandora FMS versions \u003c=7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload (CVE-2018-11221) and a local file inclusion (CVE-2018-11222). An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-11222.yaml"}
{"ID":"CVE-2018-11227","Info":{"Name":"Monstra CMS \u003c=3.0.4 - Cross-Site Scripting","Severity":"medium","Description":"Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-11227.yaml"}
{"ID":"CVE-2018-11231","Info":{"Name":"Opencart Divido - Sql Injection","Severity":"high","Description":"OpenCart Divido plugin is susceptible to SQL injection\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-11231.yaml"}
@@ -558,7 +566,7 @@
{"ID":"CVE-2018-1273","Info":{"Name":"Spring Data Commons - Remote Code Execution","Severity":"critical","Description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,\nand older unsupported versions, contain a property binder vulnerability\ncaused by improper neutralization of special elements.\nAn unauthenticated remote malicious user (or attacker) can supply\nspecially crafted request parameters against Spring Data REST backed HTTP resources\nor using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-1273.yaml"}
{"ID":"CVE-2018-12909","Info":{"Name":"Webgrind \u003c= 1.5 - Local File Inclusion","Severity":"high","Description":"Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer\u0026file= URI\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-12909.yaml"}
{"ID":"CVE-2018-12998","Info":{"Name":"Zoho manageengine - Cross-Site Scripting","Severity":"medium","Description":"Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-12998.yaml"}
{"ID":"CVE-2018-1335","Info":{"Name":"Apache Tika \u003c1.1.8- Header Command Injection","Severity":"high","Description":"Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-1335.yaml"}
{"ID":"CVE-2018-1335","Info":{"Name":"Apache Tika \u003c1.1.8 - Header Command Injection","Severity":"high","Description":"Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-1335.yaml"}
{"ID":"CVE-2018-13379","Info":{"Name":"Fortinet FortiOS - Credentials Disclosure","Severity":"critical","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-13379.yaml"}
{"ID":"CVE-2018-13380","Info":{"Name":"Fortinet FortiOS - Cross-Site Scripting","Severity":"medium","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-13380.yaml"}
{"ID":"CVE-2018-13980","Info":{"Name":"Zeta Producer Desktop CMS \u003c14.2.1 - Local File Inclusion","Severity":"medium","Description":"Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin \"filebrowser\" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.","Classification":{"CVSSScore":"5.5"}},"file_path":"http/cves/2018/CVE-2018-13980.yaml"}
@@ -576,6 +584,7 @@
{"ID":"CVE-2018-15517","Info":{"Name":"D-Link Central WifiManager - Server-Side Request Forgery","Severity":"high","Description":"D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using a browser.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2018/CVE-2018-15517.yaml"}
{"ID":"CVE-2018-15535","Info":{"Name":"Responsive FileManager \u003c9.13.4 - Local File Inclusion","Severity":"high","Description":"Responsive FileManager before version 9.13.4 is vulnerable to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory, aka local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-15535.yaml"}
{"ID":"CVE-2018-15745","Info":{"Name":"Argus Surveillance DVR 4.0.0.0 - Local File Inclusion","Severity":"high","Description":"Argus Surveillance DVR 4.0.0.0 devices allow unauthenticated local file inclusion, leading to file disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-15745.yaml"}
{"ID":"CVE-2018-15811","Info":{"Name":"DotNetNuke 9.2 - 9.2.1 - Weak Encryption \u0026 Cookie Deserialization","Severity":"high","Description":"DNN (DotNetNuke) versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-15811.yaml"}
{"ID":"CVE-2018-15917","Info":{"Name":"Jorani Leave Management System 0.6.5 - Cross-Site Scripting","Severity":"medium","Description":"Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2018/CVE-2018-15917.yaml"}
{"ID":"CVE-2018-15961","Info":{"Name":"Adobe ColdFusion - Unrestricted File Upload Remote Code Execution","Severity":"critical","Description":"Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-15961.yaml"}
{"ID":"CVE-2018-16059","Info":{"Name":"WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion","Severity":"medium","Description":"WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2018/CVE-2018-16059.yaml"}
@@ -596,6 +605,7 @@
{"ID":"CVE-2018-16836","Info":{"Name":"Rubedo CMS \u003c=3.4.0 - Directory Traversal","Severity":"critical","Description":"Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-16836.yaml"}
{"ID":"CVE-2018-16979","Info":{"Name":"Monstra CMS 3.0.4 - HTTP Header Injection","Severity":"medium","Description":"Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to virtual hosts not intended for this purpose. This is a related issue to CVE-2012-2943.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-16979.yaml"}
{"ID":"CVE-2018-17153","Info":{"Name":"Western Digital MyCloud NAS - Authentication Bypass","Severity":"critical","Description":"It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called \\\"cgi_get_ipv6\\\" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter \\\"flag\\\" with the value \\\"1\\\" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17153.yaml"}
{"ID":"CVE-2018-17173","Info":{"Name":"LG Supersign EZ CMS - Remote Code Execution","Severity":"critical","Description":"LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17173.yaml"}
{"ID":"CVE-2018-17207","Info":{"Name":"WordPress Duplicator Plugin \u003c 1.2.42 - Arbitrary Code Execution","Severity":"critical","Description":"An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17207.yaml"}
{"ID":"CVE-2018-17246","Info":{"Name":"Kibana - Local File Inclusion","Severity":"critical","Description":"Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17246.yaml"}
{"ID":"CVE-2018-17254","Info":{"Name":"Joomla! JCK Editor SQL Injection","Severity":"critical","Description":"The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17254.yaml"}
@@ -605,6 +615,7 @@
{"ID":"CVE-2018-18069","Info":{"Name":"WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting","Severity":"medium","Description":"WordPress plugin sitepress-multilingual-cms 3.6.3 is vulnerable to cross-site scripting in process_forms via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-18069.yaml"}
{"ID":"CVE-2018-18264","Info":{"Name":"Kubernetes Dashboard \u003c1.10.1 - Authentication Bypass","Severity":"high","Description":"Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-18264.yaml"}
{"ID":"CVE-2018-18323","Info":{"Name":"Centos Web Panel 0.9.8.480 - Local File Inclusion","Severity":"high","Description":"Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-18323.yaml"}
{"ID":"CVE-2018-18325","Info":{"Name":"DotNetNuke 9.2 - 9.2.2 - Weak Encryption \u0026 Cookie Deserialization","Severity":"high","Description":"DNN (DotNetNuke) versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-18325.yaml"}
{"ID":"CVE-2018-18570","Info":{"Name":"Planon \u003cLive Build 41 - Cross-Site Scripting","Severity":"medium","Description":"Planon before Live Build 41 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-18570.yaml"}
{"ID":"CVE-2018-18608","Info":{"Name":"DedeCMS 5.7 SP2 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-18608.yaml"}
{"ID":"CVE-2018-18775","Info":{"Name":"Microstrategy Web 7 - Cross-Site Scripting","Severity":"medium","Description":"Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-18775.yaml"}
@@ -657,10 +668,11 @@
{"ID":"CVE-2018-5316","Info":{"Name":"WordPress SagePay Server Gateway for WooCommerce \u003c1.0.9 - Cross-Site Scripting","Severity":"medium","Description":"WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-5316.yaml"}
{"ID":"CVE-2018-5715","Info":{"Name":"SugarCRM 3.5.1 - Cross-Site Scripting","Severity":"medium","Description":"SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string (aka a $key variable).","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-5715.yaml"}
{"ID":"CVE-2018-6008","Info":{"Name":"Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion","Severity":"high","Description":"Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the download_file parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-6008.yaml"}
{"ID":"CVE-2018-6184","Info":{"Name":"Zeit Next.js \u003c4.2.3 - Local File Inclusion","Severity":"high","Description":"Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /_next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-6184.yaml"}
{"ID":"CVE-2018-6184","Info":{"Name":"Zeit Next.js \u003c4.2.3 - Local File Inclusion","Severity":"high","Description":"Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /_next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-6184.yaml"}
{"ID":"CVE-2018-6200","Info":{"Name":"vBulletin - Open Redirect","Severity":"medium","Description":"vBulletin 3.x.x and 4.2.x through 4.2.5 contains an open redirect vulnerability via the redirector.php URL parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-6200.yaml"}
{"ID":"CVE-2018-6530","Info":{"Name":"D-Link - Unauthenticated Remote Code Execution","Severity":"critical","Description":"OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-6530.yaml"}
{"ID":"CVE-2018-6605","Info":{"Name":"Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection","Severity":"critical","Description":"SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-6605.yaml"}
{"ID":"CVE-2018-6882","Info":{"Name":"Zimbra Collaboration Suite - Cross-site Scripting","Severity":"medium","Description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2018/CVE-2018-6882.yaml"}
{"ID":"CVE-2018-6910","Info":{"Name":"DedeCMS 5.7 - Path Disclosure","Severity":"high","Description":"DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-6910.yaml"}
{"ID":"CVE-2018-7192","Info":{"Name":"osTicket \u003c 1.10.2 - Cross-Site Scripting","Severity":"medium","Description":"Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the \"message\" parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-7192.yaml"}
{"ID":"CVE-2018-7193","Info":{"Name":"osTicket \u003c 1.10.2 - Cross-Site Scripting","Severity":"medium","Description":"Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the \"order\" parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-7193.yaml"}
@@ -698,7 +710,7 @@
{"ID":"CVE-2019-0232","Info":{"Name":"Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution","Severity":"high","Description":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https-//codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https-//web.archive.org/web/20161228144344/https-//blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2019/CVE-2019-0232.yaml"}
{"ID":"CVE-2019-1003000","Info":{"Name":"Jenkins Script Security Plugin \u003c=1.49 - Sandbox Bypass","Severity":"high","Description":"A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin (versions 1.49 and earlier) within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2019/CVE-2019-1003000.yaml"}
{"ID":"CVE-2019-10068","Info":{"Name":"Kentico CMS Insecure Deserialization Remote Code Execution","Severity":"critical","Description":"Kentico CMS is susceptible to remote code execution via a .NET deserialization vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-10068.yaml"}
{"ID":"CVE-2019-10092","Info":{"Name":"Apache HTTP Server \u003c=2.4.39 - HTML Injection/Partial Cross-Site Scripting","Severity":"medium","Description":"Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-10092.yaml"}
{"ID":"CVE-2019-10092","Info":{"Name":"Apache HTTP Server \u003c=2.4.39 - HTML Injection/Partial Cross-Site Scripting","Severity":"medium","Description":"Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-10092.yaml"}
{"ID":"CVE-2019-10098","Info":{"Name":"Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect","Severity":"medium","Description":"In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-10098.yaml"}
{"ID":"CVE-2019-1010287","Info":{"Name":"Timesheet Next Gen \u003c=1.5.3 - Cross-Site Scripting","Severity":"medium","Description":"Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a \"redirect\" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-1010287.yaml"}
{"ID":"CVE-2019-1010290","Info":{"Name":"Babel - Open Redirect","Severity":"medium","Description":"Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-1010290.yaml"}
@@ -711,6 +723,7 @@
{"ID":"CVE-2019-11013","Info":{"Name":"Nimble Streamer \u003c=3.5.4-9 - Local File Inclusion","Severity":"medium","Description":"Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2019/CVE-2019-11013.yaml"}
{"ID":"CVE-2019-11248","Info":{"Name":"Debug Endpoint pprof - Exposure Detection","Severity":"high","Description":"The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2019/CVE-2019-11248.yaml"}
{"ID":"CVE-2019-11370","Info":{"Name":"Carel pCOWeb \u003cB1.2.4 - Cross-Site Scripting","Severity":"medium","Description":"Carel pCOWeb prior to B1.2.4 is vulnerable to stored cross-site scripting, as demonstrated by the config/pw_snmp.html \"System contact\" field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2019/CVE-2019-11370.yaml"}
{"ID":"CVE-2019-11507","Info":{"Name":"Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)","Severity":"medium","Description":"Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit a malicious link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-11507.yaml"}
{"ID":"CVE-2019-11510","Info":{"Name":"Pulse Connect Secure SSL VPN Arbitrary File Read","Severity":"critical","Description":"Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2019/CVE-2019-11510.yaml"}
{"ID":"CVE-2019-11580","Info":{"Name":"Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Atlassian Crowd and Crowd Data Center is susceptible to a remote code execution vulnerability because the pdkinstall development plugin is incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-11580.yaml"}
{"ID":"CVE-2019-11581","Info":{"Name":"Atlassian Jira Server-Side Template Injection","Severity":"critical","Description":"Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-11581.yaml"}
@@ -728,6 +741,7 @@
{"ID":"CVE-2019-12986","Info":{"Name":"Citrix SD-WAN Center - Remote Command Injection","Severity":"critical","Description":"Citrix SD-WAN Center is susceptible to remote command injection via the trace_route function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for ipAddress, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-12986.yaml"}
{"ID":"CVE-2019-12987","Info":{"Name":"Citrix SD-WAN Center - Remote Command Injection","Severity":"critical","Description":"Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying an array value with crafted values for action, host, path, or type, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-12987.yaml"}
{"ID":"CVE-2019-12988","Info":{"Name":"Citrix SD-WAN Center - Remote Command Injection","Severity":"critical","Description":"Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for ztd_password, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-12988.yaml"}
{"ID":"CVE-2019-12989","Info":{"Name":"Citrix SD-WAN and NetScaler SD-WAN - SQL Injection","Severity":"critical","Description":"Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-12989.yaml"}
{"ID":"CVE-2019-12990","Info":{"Name":"Citrix SD-WAN Center - Local File Inclusion","Severity":"critical","Description":"Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-12990.yaml"}
{"ID":"CVE-2019-13101","Info":{"Name":"D-Link DIR-600M - Authentication Bypass","Severity":"critical","Description":"D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-13101.yaml"}
{"ID":"CVE-2019-13372","Info":{"Name":"D-Link Central WiFi Manager CWM(100) - Remote Code Execution","Severity":"critical","Description":"/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-13372.yaml"}
@@ -756,7 +770,8 @@
{"ID":"CVE-2019-15858","Info":{"Name":"WordPress Woody Ad Snippets \u003c2.2.5 - Cross-Site Scripting/Remote Code Execution","Severity":"high","Description":"WordPress Woody Ad Snippets prior to 2.2.5 is susceptible to cross-site scripting and remote code execution via admin/includes/class.import.snippet.php, which allows unauthenticated options import as demonstrated by storing a cross-site scripting payload for remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2019/CVE-2019-15858.yaml"}
{"ID":"CVE-2019-15859","Info":{"Name":"Socomec DIRIS A-40 Devices Password Disclosure","Severity":"critical","Description":"Socomec DIRIS A-40 devices before 48250501 are susceptible to a password disclosure vulnerability in the web interface that could allow remote attackers to get full access to a device via the /password.jsn URI.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-15859.yaml"}
{"ID":"CVE-2019-15889","Info":{"Name":"WordPress Download Manager \u003c2.9.94 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-15889.yaml"}
{"ID":"CVE-2019-16057","Info":{"Name":"D-Link DNS-320 - Remote Code Execution","Severity":"critical","Description":"The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-16057.yaml"}
{"ID":"CVE-2019-16057","Info":{"Name":"D-Link DNS-320 - Remote Code Execution","Severity":"critical","Description":"The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-16057.yaml"}
{"ID":"CVE-2019-16072","Info":{"Name":"Enigma NMS \u003c 65.0.0 - Authenticated OS Command Injection","Severity":"critical","Description":"An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-16072.yaml"}
{"ID":"CVE-2019-16097","Info":{"Name":"Harbor \u003c=1.82.0 - Privilege Escalation","Severity":"medium","Description":"Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2019/CVE-2019-16097.yaml"}
{"ID":"CVE-2019-16123","Info":{"Name":"PilusCart \u003c=1.4.1 - Local File Inclusion","Severity":"high","Description":"PilusCart versions 1.4.1 and prior suffer from a file disclosure vulnerability via local file inclusion.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-16123.yaml"}
{"ID":"CVE-2019-16278","Info":{"Name":"nostromo 1.9.6 - Remote Code Execution","Severity":"critical","Description":"nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via directory traversal in the function http_verify.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-16278.yaml"}
@@ -815,9 +830,9 @@
{"ID":"CVE-2019-20933","Info":{"Name":"InfluxDB \u003c1.7.6 - Authentication Bypass","Severity":"critical","Description":"InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-20933.yaml"}
{"ID":"CVE-2019-25141","Info":{"Name":"Easy WP SMTP \u003c= 1.3.9 - Missing Authorization to Arbitrary Options Update","Severity":"critical","Description":"The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-25141.yaml"}
{"ID":"CVE-2019-25152","Info":{"Name":"Abandoned Cart Lite for WooCommerce \u003c 5.2.0 - Cross-Site Scripting","Severity":"high","Description":"The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2019/CVE-2019-25152.yaml"}
{"ID":"CVE-2019-2578","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control","Severity":"high","Description":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2019/CVE-2019-2578.yaml"}
{"ID":"CVE-2019-2578","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control","Severity":"high","Description":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2019/CVE-2019-2578.yaml"}
{"ID":"CVE-2019-2579","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection","Severity":"medium","Description":"The Oracle WebCenter Sites component of Oracle Fusion Middleware 12.2.1.3.0 is susceptible to SQL injection via an easily exploitable vulnerability that allows low privileged attackers with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2019/CVE-2019-2579.yaml"}
{"ID":"CVE-2019-2588","Info":{"Name":"Oracle Business Intelligence - Path Traversal","Severity":"medium","Description":"Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2019/CVE-2019-2588.yaml"}
{"ID":"CVE-2019-2588","Info":{"Name":"Oracle Business Intelligence - Path Traversal","Severity":"medium","Description":"Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2019/CVE-2019-2588.yaml"}
{"ID":"CVE-2019-2616","Info":{"Name":"Oracle Business Intelligence/XML Publisher - XML External Entity Injection","Severity":"high","Description":"Oracle Business Intelligence and XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 are vulnerable to an XML external entity injection attack.","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2019/CVE-2019-2616.yaml"}
{"ID":"CVE-2019-2725","Info":{"Name":"Oracle WebLogic Server - Remote Command Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-2725.yaml"}
{"ID":"CVE-2019-2729","Info":{"Name":"Oracle WebLogic Server Administration Console - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-2729.yaml"}
@@ -831,6 +846,7 @@
{"ID":"CVE-2019-3911","Info":{"Name":"LabKey Server Community Edition \u003c18.3.0 - Cross-Site Scripting","Severity":"medium","Description":"LabKey Server Community Edition before 18.3.0-61806.763 contains a reflected cross-site scripting vulnerability via the onerror parameter in the /__r2/query endpoints, which allows an unauthenticated remote attacker to inject arbitrary JavaScript.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-3911.yaml"}
{"ID":"CVE-2019-3912","Info":{"Name":"LabKey Server Community Edition \u003c18.3.0 - Open Redirect","Severity":"medium","Description":"LabKey Server Community Edition before 18.3.0-61806.763 contains an open redirect vulnerability via the /__r1/ returnURL parameter, which allows an attacker to redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-3912.yaml"}
{"ID":"CVE-2019-3929","Info":{"Name":"Barco/AWIND OEM Presentation Platform - Remote Command Injection","Severity":"critical","Description":"The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-3929.yaml"}
{"ID":"CVE-2019-4716","Info":{"Name":"IBM Planning Analytics - Authentication Bypass \u0026 Remote Code Execution Version Detection","Severity":"critical","Description":"IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-4716.yaml"}
{"ID":"CVE-2019-5127","Info":{"Name":"YouPHPTube Encoder 2.3 - Remote Command Injection","Severity":"critical","Description":"YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-5127.yaml"}
{"ID":"CVE-2019-5128","Info":{"Name":"YouPHPTube Encoder - Arbitrary File Write","Severity":"critical","Description":"Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-5128.yaml"}
{"ID":"CVE-2019-5129","Info":{"Name":"YouPHPTube Encoder 2.3 - Command Injection","Severity":"critical","Description":"Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-5129.yaml"}
@@ -877,7 +893,7 @@
{"ID":"CVE-2019-9726","Info":{"Name":"Homematic CCU3 - Local File Inclusion","Severity":"high","Description":"eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem, aka local file inclusion. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-9726.yaml"}
{"ID":"CVE-2019-9733","Info":{"Name":"JFrog Artifactory 6.7.3 - Admin Login Bypass","Severity":"critical","Description":"JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9733.yaml"}
{"ID":"CVE-2019-9757","Info":{"Name":"LabKey Server 19.1.0 - XML External Entity (XXE)","Severity":"high","Description":"An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-9757.yaml"}
{"ID":"CVE-2019-9762","Info":{"Name":"PHPSHE 1.7 - SQL Injection","Severity":"critical","Description":"A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9762.yaml"}
{"ID":"CVE-2019-9762","Info":{"Name":"PHPSHE 1.7 - SQL Injection","Severity":"critical","Description":"A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9762.yaml"}
{"ID":"CVE-2019-9874","Info":{"Name":"Sitecore Experience Platform - Deserialization of Untrusted Data","Severity":"critical","Description":"Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability (CVE-2019-9874). An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the /sitecore/shell/Applications/Layouts/IDE.aspx endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9874.yaml"}
{"ID":"CVE-2019-9879","Info":{"Name":"WPGraphQL 0.2.3 - User Creation","Severity":"critical","Description":"The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9879.yaml"}
{"ID":"CVE-2019-9880","Info":{"Name":"WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure","Severity":"critical","Description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2019/CVE-2019-9880.yaml"}
@@ -892,6 +908,7 @@
{"ID":"CVE-2020-10189","Info":{"Name":"ManageEngine Desktop Central Java Deserialization","Severity":"critical","Description":"Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10189.yaml"}
{"ID":"CVE-2020-10220","Info":{"Name":"rConfig 3.9 - SQL Injection","Severity":"critical","Description":"An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10220.yaml"}
{"ID":"CVE-2020-10257","Info":{"Name":"ThemeREX Addons - Remote Code Execution","Severity":"critical","Description":"ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10257.yaml"}
{"ID":"CVE-2020-10546","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10546.yaml"}
{"ID":"CVE-2020-10547","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10547.yaml"}
{"ID":"CVE-2020-10548","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions have unauthenticated devices.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10548.yaml"}
@@ -906,7 +923,7 @@
{"ID":"CVE-2020-11455","Info":{"Name":"LimeSurvey 4.1.11 - Local File Inclusion","Severity":"critical","Description":"LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11455.yaml"}
{"ID":"CVE-2020-11514","Info":{"Name":"Rank Math SEO \u003c= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint","Severity":"critical","Description":"The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11514.yaml"}
{"ID":"CVE-2020-11515","Info":{"Name":"Rank Math SEO \u003c= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint","Severity":"medium","Description":"The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an \"Open Redirect\" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11515.yaml"}
{"ID":"CVE-2020-11529","Info":{"Name":"Grav \u003c1.7 - Open Redirect","Severity":"medium","Description":"Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11529.yaml"}
{"ID":"CVE-2020-11529","Info":{"Name":"Grav \u003c1.7 - Open Redirect","Severity":"medium","Description":"Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11529.yaml"}
{"ID":"CVE-2020-11530","Info":{"Name":"WordPress Chop Slider 3 - Blind SQL Injection","Severity":"critical","Description":"WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to get_script/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11530.yaml"}
{"ID":"CVE-2020-11546","Info":{"Name":"SuperWebmailer 7.21.0.01526 - Remote Code Execution","Severity":"critical","Description":"SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11546.yaml"}
{"ID":"CVE-2020-11547","Info":{"Name":"PRTG Network Monitor \u003c20.1.57.1745 - Information Disclosure","Severity":"medium","Description":"PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-11547.yaml"}
@@ -1034,7 +1051,7 @@
{"ID":"CVE-2020-24903","Info":{"Name":"Cute Editor for ASP.NET 6.4 - Cross-Site Scripting","Severity":"medium","Description":"Cute Editor for ASP.NET 6.4 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-24903.yaml"}
{"ID":"CVE-2020-24912","Info":{"Name":"QCube Cross-Site-Scripting","Severity":"medium","Description":"A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-24912.yaml"}
{"ID":"CVE-2020-24949","Info":{"Name":"PHP-Fusion 9.03.50 - Remote Code Execution","Severity":"high","Description":"PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-24949.yaml"}
{"ID":"CVE-2020-25078","Info":{"Name":"D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure","Severity":"high","Description":"D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices are vulnerable to password disclosures vulnerabilities because the /config/getuser endpoint allows for remote administrator password disclosure.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-25078.yaml"}
{"ID":"CVE-2020-25078","Info":{"Name":"D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure","Severity":"high","Description":"D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices are vulnerable to password disclosures vulnerabilities because the /config/getuser endpoint allows for remote administrator password disclosure.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-25078.yaml"}
{"ID":"CVE-2020-25213","Info":{"Name":"WordPress File Manager Plugin - Remote Code Execution","Severity":"critical","Description":"The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-25213.yaml"}
{"ID":"CVE-2020-25223","Info":{"Name":"Sophos UTM Preauth - Remote Code Execution","Severity":"critical","Description":"Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-25223.yaml"}
{"ID":"CVE-2020-25495","Info":{"Name":"Xinuo Openserver 5/6 - Cross-Site scripting","Severity":"medium","Description":"Xinuo (formerly SCO) Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-25495.yaml"}
@@ -1077,6 +1094,7 @@
{"ID":"CVE-2020-29164","Info":{"Name":"PacsOne Server \u003c7.1.1 - Cross-Site Scripting","Severity":"medium","Description":"PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29164.yaml"}
{"ID":"CVE-2020-29214","Info":{"Name":"Alumni Management System 1.0 - SQL Injection","Severity":"critical","Description":"SourceCodester Alumni Management System 1.0 contains a sql_injection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29214.yaml"}
{"ID":"CVE-2020-29227","Info":{"Name":"Car Rental Management System 1.0 - Local File Inclusion","Severity":"critical","Description":"Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the \"page\" parameter, leading to code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29227.yaml"}
{"ID":"CVE-2020-29279","Info":{"Name":"74CMS - Remote File Inclusion","Severity":"critical","Description":"PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29279.yaml"}
{"ID":"CVE-2020-29390","Info":{"Name":"Zeroshell 3.9.3 - Command Injection","Severity":"critical","Description":"Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29390.yaml"}
{"ID":"CVE-2020-29395","Info":{"Name":"Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29395.yaml"}
{"ID":"CVE-2020-29453","Info":{"Name":"Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)","Severity":"medium","Description":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-29453.yaml"}
@@ -1117,6 +1135,7 @@
{"ID":"CVE-2020-36728","Info":{"Name":"WordPress Plugin Adning Advertising \u003c 1.5.6 - Arbitrary File Upload","Severity":"medium","Description":"The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2020/CVE-2020-36728.yaml"}
{"ID":"CVE-2020-36731","Info":{"Name":"Flexible Checkout Fields for WooCommerce \u003c= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update","Severity":"high","Description":"The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2020/CVE-2020-36731.yaml"}
{"ID":"CVE-2020-36836","Info":{"Name":"WordPress WP Fastest Cache \u003c= 0.9.0.2 - Authenticated Arbitrary File Deletion","Severity":"high","Description":"The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2020/CVE-2020-36836.yaml"}
{"ID":"CVE-2020-3952","Info":{"Name":"VMware vCenter Server LDAP Broken Access Control","Severity":"critical","Description":"Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-3952.yaml"}
{"ID":"CVE-2020-4427","Info":{"Name":"IBM Data Risk Manager - Authentication Bypass via SAML","Severity":"critical","Description":"IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-4427.yaml"}
{"ID":"CVE-2020-4463","Info":{"Name":"IBM Maximo Asset Management Information Disclosure - XML External Entity Injection","Severity":"high","Description":"IBM Maximo Asset Management is vulnerable to an\nXML external entity injection (XXE) attack when processing XML data.\nA remote attacker could exploit this vulnerability to expose\nsensitive information or consume memory resources.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2020/CVE-2020-4463.yaml"}
{"ID":"CVE-2020-5191","Info":{"Name":"PHPGurukul Hospital Management System - Cross-Site Scripting","Severity":"medium","Description":"PHPGurukul Hospital Management System in PHP 4.0 contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-5191.yaml"}
@@ -1149,7 +1168,7 @@
{"ID":"CVE-2020-8115","Info":{"Name":"Revive Adserver \u003c=5.0.3 - Cross-Site Scripting","Severity":"medium","Description":"Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script is printed back without proper escaping, allowing an attacker to execute arbitrary JavaScript code on the browser of the victim.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-8115.yaml"}
{"ID":"CVE-2020-8163","Info":{"Name":"Ruby on Rails \u003c5.0.1 - Remote Code Execution","Severity":"high","Description":"Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-8163.yaml"}
{"ID":"CVE-2020-8191","Info":{"Name":"Citrix ADC/Gateway - Cross-Site Scripting","Severity":"medium","Description":"Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 contain a cross-site scripting vulnerability due to improper input validation.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-8191.yaml"}
{"ID":"CVE-2020-8193","Info":{"Name":"Citrix - Local File Inclusion","Severity":"medium","Description":"Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 are vulnerable to local file inclusion because they allow unauthenticated access to certain URL endpoints.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2020/CVE-2020-8193.yaml"}
{"ID":"CVE-2020-8193","Info":{"Name":"Citrix - Local File Inclusion","Severity":"medium","Description":"Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 are vulnerable to local file inclusion because they allow unauthenticated access to certain URL endpoints.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2020/CVE-2020-8193.yaml"}
{"ID":"CVE-2020-8194","Info":{"Name":"Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection","Severity":"medium","Description":"Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18. Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allow modification of a file download.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2020/CVE-2020-8194.yaml"}
{"ID":"CVE-2020-8209","Info":{"Name":"Citrix XenMobile Server - Local File Inclusion","Severity":"high","Description":"Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6, and Citrix XenMobile Server before 10.9 RP5 are susceptible to local file inclusion vulnerabilities.\nreference:\n- https://swarm.ptsecurity.com/path-traversal-on-citrix-xenmobile-server/\n- https://support.citrix.com/article/CTX277457\n- https://nvd.nist.gov/vuln/detail/CVE-2020-8209\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-8209.yaml"}
{"ID":"CVE-2020-8497","Info":{"Name":"Artica Pandora FMS \u003c=7.42 - Arbitrary File Read","Severity":"medium","Description":"Artica Pandora FMS through 7.42 is susceptible to arbitrary file read. An attacker can read the chat history, which is in JSON format and contains user names, user IDs, private messages, and timestamps. This can potentially lead to unauthorized data modification and other operations.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-8497.yaml"}
@@ -1208,7 +1227,7 @@
{"ID":"CVE-2021-21307","Info":{"Name":"Lucee Admin - Remote Code Execution","Severity":"critical","Description":"Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 contains an unauthenticated remote code execution vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-21307.yaml"}
{"ID":"CVE-2021-21311","Info":{"Name":"Adminer \u003c4.7.9 - Server-Side Request Forgery","Severity":"high","Description":"Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-21311.yaml"}
{"ID":"CVE-2021-21315","Info":{"Name":"Node.JS System Information Library \u003c5.3.1 - Remote Command Injection","Severity":"high","Description":"Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information.","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2021/CVE-2021-21315.yaml"}
{"ID":"CVE-2021-21345","Info":{"Name":"XStream \u003c1.4.16 - Remote Code Execution","Severity":"critical","Description":"XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2021/CVE-2021-21345.yaml"}
{"ID":"CVE-2021-21345","Info":{"Name":"XStream \u003c1.4.16 - Remote Code Execution","Severity":"critical","Description":"XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2021/CVE-2021-21345.yaml"}
{"ID":"CVE-2021-21351","Info":{"Name":"XStream \u003c1.4.16 - Remote Code Execution","Severity":"critical","Description":"XStream before 1.4.16 is susceptible to remote code execution. An attacker can load and execute arbitrary code from a remote host via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2021/CVE-2021-21351.yaml"}
{"ID":"CVE-2021-21389","Info":{"Name":"BuddyPress REST API \u003c7.2.1 - Privilege Escalation/Remote Code Execution","Severity":"high","Description":"WordPress BuddyPress before version 7.2.1 is susceptible to a privilege escalation vulnerability that can be leveraged to perform remote code execution.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2021/CVE-2021-21389.yaml"}
{"ID":"CVE-2021-21402","Info":{"Name":"Jellyfin \u003c10.7.0 - Local File Inclusion","Severity":"medium","Description":"Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-21402.yaml"}
@@ -1238,7 +1257,7 @@
{"ID":"CVE-2021-22707","Info":{"Name":"EVlink City \u003c R8 V3.4.0.1 - Authentication Bypass","Severity":"critical","Description":"A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22707.yaml"}
{"ID":"CVE-2021-22873","Info":{"Name":"Revive Adserver \u003c5.1.0 - Open Redirect","Severity":"medium","Description":"Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-22873.yaml"}
{"ID":"CVE-2021-22911","Info":{"Name":"Rocket.Chat \u003c=3.13 - NoSQL Injection","Severity":"critical","Description":"Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22911.yaml"}
{"ID":"CVE-2021-22986","Info":{"Name":"F5 iControl REST - Remote Command Execution","Severity":"critical","Description":"F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3; and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22986.yaml"}
{"ID":"CVE-2021-22986","Info":{"Name":"F5 iControl REST - Remote Command Execution","Severity":"critical","Description":"F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3; and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22986.yaml"}
{"ID":"CVE-2021-23241","Info":{"Name":"MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion","Severity":"medium","Description":"MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-23241.yaml"}
{"ID":"CVE-2021-24145","Info":{"Name":"WordPress Modern Events Calendar Lite \u003c5.16.5 - Authenticated Arbitrary File Upload","Severity":"high","Description":"WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-24145.yaml"}
{"ID":"CVE-2021-24146","Info":{"Name":"WordPress Modern Events Calendar Lite \u003c5.16.5 - Sensitive Information Disclosure","Severity":"high","Description":"WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24146.yaml"}
@@ -1250,9 +1269,11 @@
{"ID":"CVE-2021-24175","Info":{"Name":"The Plus Addons for Elementor Page Builder \u003c 4.1.7 - Authentication Bypass","Severity":"critical","Description":"The Plus Addons for Elementor plugin (before version 4.1.7) allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24175.yaml"}
{"ID":"CVE-2021-24176","Info":{"Name":"WordPress JH 404 Logger \u003c=1.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress JH 404 Logger plugin through 1.1 contains a cross-site scripting vulnerability. Referer and path of 404 pages are not properly sanitized when they are output in the WordPress dashboard, which can lead to executing arbitrary JavaScript code.","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-24176.yaml"}
{"ID":"CVE-2021-24210","Info":{"Name":"WordPress PhastPress \u003c1.111 - Open Redirect","Severity":"medium","Description":"WordPress PhastPress plugin before 1.111 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24210.yaml"}
{"ID":"CVE-2021-24212","Info":{"Name":"WooCommerce Help Scout - Arbitrary File Upload","Severity":"critical","Description":"WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24212.yaml"}
{"ID":"CVE-2021-24214","Info":{"Name":"WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24214.yaml"}
{"ID":"CVE-2021-24215","Info":{"Name":"Controlled Admin Access WordPress Plugin \u003c= 1.4.0 - Improper Access Control \u0026 Privilege Escalation","Severity":"critical","Description":"An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24215.yaml"}
{"ID":"CVE-2021-24219","Info":{"Name":"All Thrive Themes and Plugins - Unauthenticated Option Update","Severity":"medium","Description":"The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-24219.yaml"}
{"ID":"CVE-2021-24220","Info":{"Name":"Multiple Thrive Themes \u003c 2.0.0 - Arbitrary File Upload","Severity":"critical","Description":"Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2021/CVE-2021-24220.yaml"}
{"ID":"CVE-2021-24226","Info":{"Name":"AccessAlly \u003c3.5.7 - Sensitive Information Leakage","Severity":"high","Description":"WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file \\\"resource/frontend/product/product-shortcode.php\\\" (which is responsible for the [accessally_order_form] shortcode) dumps serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, and no login or administrator role is required.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24226.yaml"}
{"ID":"CVE-2021-24227","Info":{"Name":"Patreon WordPress \u003c1.7.0 - Unauthenticated Local File Inclusion","Severity":"high","Description":"Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24227.yaml"}
{"ID":"CVE-2021-24235","Info":{"Name":"WordPress Goto Tour \u0026 Travel Theme \u003c2.0 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Goto Tour \u0026 Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and start_date GET parameters on its Tour List page.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24235.yaml"}
@@ -1282,7 +1303,7 @@
{"ID":"CVE-2021-24351","Info":{"Name":"WordPress The Plus Addons for Elementor \u003c4.1.12 - Cross-Site Scripting","Severity":"medium","Description":"WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplus_more_post AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24351.yaml"}
{"ID":"CVE-2021-24358","Info":{"Name":"Plus Addons for Elementor Page Builder \u003c 4.1.10 - Open Redirect","Severity":"medium","Description":"WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24358.yaml"}
{"ID":"CVE-2021-24364","Info":{"Name":"WordPress Jannah Theme \u003c5.4.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24364.yaml"}
{"ID":"CVE-2021-24370","Info":{"Name":"WordPress Fancy Product Designer \u003c4.6.9 - Arbitrary File Upload","Severity":"critical","Description":"WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24370.yaml"}
{"ID":"CVE-2021-24370","Info":{"Name":"WordPress Fancy Product Designer \u003c4.6.9 - Arbitrary File Upload","Severity":"critical","Description":"WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24370.yaml"}
{"ID":"CVE-2021-24387","Info":{"Name":"WordPress Pro Real Estate 7 Theme \u003c3.1.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ct_community parameter in its search listing page before outputting it back.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24387.yaml"}
{"ID":"CVE-2021-24389","Info":{"Name":"WordPress FoodBakery \u003c2.2 - Cross-Site Scripting","Severity":"medium","Description":"WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakery_radius parameter before outputting it back in the response.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24389.yaml"}
{"ID":"CVE-2021-24406","Info":{"Name":"WordPress wpForo Forum \u003c 1.9.7 - Open Redirect","Severity":"medium","Description":"WordPress wpForo Forum \u003c 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24406.yaml"}
@@ -1370,7 +1391,7 @@
{"ID":"CVE-2021-26072","Info":{"Name":"Atlassian Confluence \u003c 5.8.6 - Server-Side Request Forgery","Severity":"medium","Description":"Confluence Server and Data Center before 5.8.6 contain a blind server-side request forgery caused by the WidgetConnector plugin, letting remote attackers manipulate internal network resources, exploit requires network access to the server.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2021/CVE-2021-26072.yaml"}
{"ID":"CVE-2021-26084","Info":{"Name":"Confluence Server - Remote Code Execution","Severity":"critical","Description":"Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled. To check whether this is enabled go to COG \u003e User Management \u003e User Signup Options.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-26084.yaml"}
{"ID":"CVE-2021-26085","Info":{"Name":"Atlassian Confluence Server - Local File Inclusion","Severity":"medium","Description":"Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-26085.yaml"}
{"ID":"CVE-2021-26086","Info":{"Name":"Atlassian Jira Limited - Local File Inclusion","Severity":"medium","Description":"Affected versions of Atlassian Jira Limited Server and Data Center are vulnerable to local file inclusion because they allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-26086.yaml"}
{"ID":"CVE-2021-26086","Info":{"Name":"Atlassian Jira Limited - Local File Inclusion","Severity":"medium","Description":"Affected versions of Atlassian Jira Limited Server and Data Center are vulnerable to local file inclusion because they allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-26086.yaml"}
{"ID":"CVE-2021-26247","Info":{"Name":"Cacti - Cross-Site Scripting","Severity":"medium","Description":"Cacti contains a cross-site scripting vulnerability via \"http://\u003cCACTI_SERVER\u003e/auth_changepassword.php?ref=\u003cscript\u003ealert(1)\u003c/script\u003e\" which can successfully execute the JavaScript payload present in the \"ref\" URL parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-26247.yaml"}
{"ID":"CVE-2021-26292","Info":{"Name":"AfterLogic Aurora and WebMail Pro \u003c 7.7.9 - Full Path Disclosure","Severity":"low","Description":"AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP DELETE request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to obtain web root path.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2021/CVE-2021-26292.yaml"}
{"ID":"CVE-2021-26294","Info":{"Name":"AfterLogic Aurora and WebMail Pro \u003c 7.7.9 - Information Disclosure","Severity":"high","Description":"AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-26294.yaml"}
@@ -1426,17 +1447,20 @@
{"ID":"CVE-2021-29484","Info":{"Name":"Ghost CMS \u003c=4.32 - Cross-Site Scripting","Severity":"medium","Description":"Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2021/CVE-2021-29484.yaml"}
{"ID":"CVE-2021-29490","Info":{"Name":"Jellyfin 10.7.2 - Server Side Request Forgery","Severity":"medium","Description":"Jellyfin is a free software media system. Versions 10.7.2 and below are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2021/CVE-2021-29490.yaml"}
{"ID":"CVE-2021-29505","Info":{"Name":"XStream \u003c1.4.17 - Remote Code Execution","Severity":"high","Description":"XStream before 1.4.17 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2021/CVE-2021-29505.yaml"}
{"ID":"CVE-2021-29622","Info":{"Name":"Prometheus - Open Redirect","Severity":"medium","Description":"Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-29622.yaml"}
{"ID":"CVE-2021-29622","Info":{"Name":"Prometheus - Open Redirect","Severity":"medium","Description":"Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-29622.yaml"}
{"ID":"CVE-2021-29625","Info":{"Name":"Adminer \u003c=4.8.0 - Cross-Site Scripting","Severity":"medium","Description":"Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled).","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-29625.yaml"}
{"ID":"CVE-2021-3002","Info":{"Name":"Seo Panel 4.8.0 - Cross-Site Scripting","Severity":"medium","Description":"Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-3002.yaml"}
{"ID":"CVE-2021-30049","Info":{"Name":"SysAid Technologies 20.3.64 b14 - Cross-Site Scripting","Severity":"medium","Description":"SysAid 20.3.64 b14 contains a cross-site scripting vulnerability via the /KeepAlive.jsp?stamp= URI.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-30049.yaml"}
{"ID":"CVE-2021-30116","Info":{"Name":"Kaseya VSA \u003c 9.5.7 - Credential Disclosure via Windows Agent","Severity":"critical","Description":"Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\\Program Files (x86)\\Kaseya\\XXXXXXXXXX\\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813\u0026pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2021/CVE-2021-30116.yaml"}
{"ID":"CVE-2021-30118","Info":{"Name":"Kaseya VSA \u003c 9.5.7 - Arbitrary File Upload to Remote Code Execution","Severity":"critical","Description":"An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring \u0026 Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently use these files to execute asp commands. Detailed description --- Given the following request- ``` POST /SystemTab/uploader.aspx?Filename=shellz.aspx\u0026PathData=C%3A%5CKaseya%5CWebPages%5C\u0026__RequestValidationToken=ac1906a5-d511-47e3-8500-47cc4b0ec219\u0026qqfile=shellz.aspx HTTP/1.1 Host- 192.168.1.194 Cookie- sessionId=92812726; %5F%5FRequestValidationToken=ac1906a5%2Dd511%2D47e3%2D8500%2D47cc4b0ec219 Content-Length- 12 \u003c%@ Page Language=\"C#\" Debug=\"true\" validateRequest=\"false\" %\u003e \u003c%@ Import namespace=\"System.Web.UI.WebControls\" %\u003e \u003c%@ Import namespace=\"System.Diagnostics\" %\u003e \u003c%@ Import namespace=\"System.IO\" %\u003e \u003c%@ Import namespace=\"System\" %\u003e \u003c%@ Import namespace=\"System.Data\" %\u003e \u003c%@ Import namespace=\"System.Data.SqlClient\" %\u003e \u003c%@ Import namespace=\"System.Security.AccessControl\" %\u003e \u003c%@ Import namespace=\"System.Security.Principal\" %\u003e \u003c%@ Import namespace=\"System.Collections.Generic\" %\u003e \u003c%@ Import namespace=\"System.Collections\" %\u003e \u003cscript runat=\"server\"\u003e private const string password = \"pass\"; // The password ( pass ) private const string style = \"dark\"; // The style ( light / dark ) protected void Page_Load(object sender, EventArgs e) { //this.Remote(password); this.Login(password); this.Style(); this.ServerInfo(); \u003csnip\u003e ``` The attacker can control the name of the file written via the qqfile parameter and the location of the file written via the PathData parameter. Even though the call requires that a sessionId cookie is passed we have determined that the sessionId is not actually validated and any numeric value is accepted as valid. Security issues discovered --- * a sessionId cookie is required by /SystemTab/uploader.aspx, but is not actually validated, allowing an attacker to bypass authentication * /SystemTab/uploader.aspx allows an attacker to create a file with arbitrary content in any place the webserver has write access * The web server process has write access to the webroot where the attacker can execute it by requesting the URL of the newly created file. Impact --- This arbitrary file upload allows an attacker to place files of his own choosing on any location on the hard drive of the server the webserver process has access to, including (but not limited to) the webroot. If the attacker uploads files with code to the webroot (e.g. aspx code) he can then execute this code in the context of the webserver to breach either the integrity, confidentiality, or availability of the system or to steal credentials of other users. In other words, this can lead to a full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-30118.yaml"}
{"ID":"CVE-2021-30128","Info":{"Name":"Apache OFBiz \u003c17.12.07 - Arbitrary Code Execution","Severity":"critical","Description":"Apache OFBiz before 17.12.07 is susceptible to arbitrary code execution via unsafe deserialization. An attacker can modify deserialized data or code without using provided accessor functions.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-30128.yaml"}
{"ID":"CVE-2021-30134","Info":{"Name":"Php-mod/curl Library \u003c2.3.2 - Cross-Site Scripting","Severity":"medium","Description":"Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-30134.yaml"}
{"ID":"CVE-2021-30151","Info":{"Name":"Sidekiq \u003c=6.2.0 - Cross-Site Scripting","Severity":"medium","Description":"Sidekiq through 5.1.3 and 6.x through 6.2.0 contains a cross-site scripting vulnerability via the queue name of the live-poll feature when Internet Explorer is used.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-30151.yaml"}
{"ID":"CVE-2021-3017","Info":{"Name":"Intelbras WIN 300/WRN 342 - Credentials Disclosure","Severity":"high","Description":"Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-3017.yaml"}
{"ID":"CVE-2021-30175","Info":{"Name":"ZEROF Web Server 1.0 - SQL Injection","Severity":"critical","Description":"ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-30175.yaml"}
{"ID":"CVE-2021-3018","Info":{"Name":"IPeakCMS 3.5 - SQL Injection","Severity":"critical","Description":"ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-3018.yaml"}
{"ID":"CVE-2021-3019","Info":{"Name":"ffay lanproxy Directory Traversal","Severity":"high","Description":"ffay lanproxy 0.1 is susceptible to a directory traversal vulnerability that could let attackers read /../conf/config.properties to obtain credentials for a connection to the intranet.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-3019.yaml"}
{"ID":"CVE-2021-30203","Info":{"Name":"Dzzoffice 2.02.1 - Cross-Site Scripting","Severity":"high","Description":"Dzzoffice 2.02.1_SC_UTF8 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-30203.yaml"}
{"ID":"CVE-2021-30213","Info":{"Name":"Knowage Suite 7.3 - Cross-Site Scripting","Severity":"medium","Description":"Knowage Suite 7.3 contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-30213.yaml"}
{"ID":"CVE-2021-30461","Info":{"Name":"VoipMonitor \u003c24.61 - Remote Code Execution","Severity":"critical","Description":"VoipMonitor prior to 24.61 is susceptible to remote code execution vulnerabilities because of its use of user supplied data via its web interface, allowing remote unauthenticated users to trigger a remote PHP code execution vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-30461.yaml"}
{"ID":"CVE-2021-30497","Info":{"Name":"Ivanti Avalanche 6.3.2 - Local File Inclusion","Severity":"high","Description":"Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-30497.yaml"}
@@ -1468,6 +1492,7 @@
{"ID":"CVE-2021-32819","Info":{"Name":"Nodejs Squirrelly - Remote Code Execution","Severity":"high","Description":"Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2021/CVE-2021-32819.yaml"}
{"ID":"CVE-2021-32820","Info":{"Name":"Express-handlebars - Local File Inclusion","Severity":"high","Description":"Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extensions (i.e., file.extension) can be included. Files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2021/CVE-2021-32820.yaml"}
{"ID":"CVE-2021-32853","Info":{"Name":"Erxes \u003c0.23.0 - Cross-Site Scripting","Severity":"critical","Description":"Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag.","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2021/CVE-2021-32853.yaml"}
{"ID":"CVE-2021-3287","Info":{"Name":"Zoho ManageEngine OpManager \u003c 12.5.329 - Remote Code Execution","Severity":"critical","Description":"Zoho ManageEngine OpManager before 12.5.329 contains a remote code execution caused by a general bypass in the deserialization class, letting unauthenticated attackers execute arbitrary code, exploit requires no authentication\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-3287.yaml"}
{"ID":"CVE-2021-3293","Info":{"Name":"emlog 5.3.1 Path Disclosure","Severity":"medium","Description":"emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-3293.yaml"}
{"ID":"CVE-2021-3297","Info":{"Name":"Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass","Severity":"high","Description":"Zyxel NBG2105 V1.00(AAGU.2)C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access.","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2021/CVE-2021-3297.yaml"}
{"ID":"CVE-2021-33044","Info":{"Name":"Dahua IPC/VTH/VTO - Authentication Bypass","Severity":"critical","Description":"Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-33044.yaml"}
@@ -1533,14 +1558,15 @@
{"ID":"CVE-2021-38147","Info":{"Name":"Wipro Holmes Orchestrator 20.4.1 - Information Disclosure","Severity":"high","Description":"Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-38147.yaml"}
{"ID":"CVE-2021-38154","Info":{"Name":"Canon Devices - Authentication Bypass in Catwalk Server","Severity":"high","Description":"Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-38154.yaml"}
{"ID":"CVE-2021-38156","Info":{"Name":"Nagios XI \u003c 5.8.6 - Cross-Site Scripting","Severity":"medium","Description":"In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-38156.yaml"}
{"ID":"CVE-2021-3831","Info":{"Name":"Gnuboard 5 - Cross-Site Scripting","Severity":"medium","Description":"Gnuboard 5 contains a cross-site scripting vulnerability via the $_GET['LGD_OID'] parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-3831.yaml"}
{"ID":"CVE-2021-38314","Info":{"Name":"WordPress Redux Framework \u003c=4.2.11 - Information Disclosure","Severity":"medium","Description":"WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 hash of the site URL with a known salt value of -redux and an md5 hash of the previous hash with a known salt value of -support. An attacker can potentially employ these AJAX actions to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of the site's AUTH_KEY concatenated with the SECURE_AUTH_KEY.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-38314.yaml"}
{"ID":"CVE-2021-38540","Info":{"Name":"Apache Airflow - Unauthenticated Variable Import","Severity":"critical","Description":"Apache Airflow Airflow \u003e=2.0.0 and \u003c2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-38540.yaml"}
{"ID":"CVE-2021-38647","Info":{"Name":"Microsoft Open Management Infrastructure - Remote Code Execution","Severity":"critical","Description":"Microsoft Open Management Infrastructure is susceptible to remote code execution (OMIGOD).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-38647.yaml"}
{"ID":"CVE-2021-38702","Info":{"Name":"Cyberoam NetGenie Cross-Site Scripting","Severity":"medium","Description":"Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-38702.yaml"}
{"ID":"CVE-2021-38704","Info":{"Name":"ClinicCases 7.3.3 Cross-Site Scripting","Severity":"medium","Description":"ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-38704.yaml"}
{"ID":"CVE-2021-38751","Info":{"Name":"ExponentCMS \u003c= 2.6 - Host Header Injection","Severity":"medium","Description":"An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2021/CVE-2021-38751.yaml"}
{"ID":"CVE-2021-39141","Info":{"Name":"XStream 1.4.18 - Remote Code Execution","Severity":"high","Description":"XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39141.yaml"}
{"ID":"CVE-2021-39144","Info":{"Name":"XStream 1.4.18 - Remote Code Execution","Severity":"high","Description":"XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Setups which followed XStream's security recommendations with an allow-list are not impacted.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39144.yaml"}
{"ID":"CVE-2021-39141","Info":{"Name":"XStream 1.4.18 - Remote Code Execution","Severity":"high","Description":"XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39141.yaml"}
{"ID":"CVE-2021-39144","Info":{"Name":"XStream 1.4.18 - Remote Code Execution","Severity":"high","Description":"XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Setups which followed XStream's security recommendations with an allow-list are not impacted.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39144.yaml"}
{"ID":"CVE-2021-39146","Info":{"Name":"XStream 1.4.18 - Arbitrary Code Execution","Severity":"high","Description":"XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Setups which followed XStream's security recommendations with an allow-list are not impacted.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39146.yaml"}
{"ID":"CVE-2021-39152","Info":{"Name":"XStream \u003c1.4.18 - Server-Side Request Forgery","Severity":"high","Description":"XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2021/CVE-2021-39152.yaml"}
{"ID":"CVE-2021-39165","Info":{"Name":"Cachet \u003c=2.3.18 - SQL Injection","Severity":"medium","Description":"Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet \u003chttps://github.com/CachetHQ/Cachet\u003e is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-39165.yaml"}
@@ -1552,7 +1578,8 @@
{"ID":"CVE-2021-39322","Info":{"Name":"WordPress Easy Social Icons Plugin \u003c 3.0.9 - Cross-Site Scripting","Severity":"medium","Description":"The Easy Social Icons plugin \u003c= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-39322.yaml"}
{"ID":"CVE-2021-39327","Info":{"Name":"WordPress BulletProof Security 5.1 Information Disclosure","Severity":"medium","Description":"The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-39327.yaml"}
{"ID":"CVE-2021-39341","Info":{"Name":"OptinMonster Plugin \u003c 2.6.5 - Unprotected REST-API","Severity":"high","Description":"The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2021/CVE-2021-39341.yaml"}
{"ID":"CVE-2021-39350","Info":{"Name":"FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting","Severity":"medium","Description":"The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts in versions 7.5.0.727 - 7.5.2.727.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-39350.yaml"}
{"ID":"CVE-2021-39350","Info":{"Name":"FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting","Severity":"medium","Description":"The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts in versions 7.5.0.727 - 7.5.2.727.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-39350.yaml"}
{"ID":"CVE-2021-39411","Info":{"Name":"Hospital Management System 1.0 - Cross-Site Scripting","Severity":"high","Description":"Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-39411.yaml"}
{"ID":"CVE-2021-39433","Info":{"Name":"BIQS IT Biqs-drive v1.83 Local File Inclusion","Severity":"high","Description":"A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-39433.yaml"}
{"ID":"CVE-2021-39501","Info":{"Name":"EyouCMS 1.5.4 Open Redirect","Severity":"medium","Description":"EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-39501.yaml"}
{"ID":"CVE-2021-40149","Info":{"Name":"Reolink E1 Zoom Camera \u003c=3.0.0.716 - Private Key Disclosure","Severity":"medium","Description":"Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key (RSA) disclosure vulnerability.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2021/CVE-2021-40149.yaml"}
@@ -1588,9 +1615,10 @@
{"ID":"CVE-2021-41293","Info":{"Name":"ECOA Building Automation System - Arbitrary File Retrieval","Severity":"high","Description":"The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41293.yaml"}
{"ID":"CVE-2021-41349","Info":{"Name":"Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting","Severity":"medium","Description":"Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-41349.yaml"}
{"ID":"CVE-2021-41381","Info":{"Name":"Payara Micro Community 5.2021.6 Directory Traversal","Severity":"high","Description":"Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41381.yaml"}
{"ID":"CVE-2021-41419","Info":{"Name":"QVIS NVR/DVR - Remote Code Execution","Severity":"critical","Description":"QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-41419.yaml"}
{"ID":"CVE-2021-41432","Info":{"Name":"FlatPress 1.2.1 - Stored Cross-Site Scripting","Severity":"medium","Description":"FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-41432.yaml"}
{"ID":"CVE-2021-41460","Info":{"Name":"ECShop 4.1.0 - SQL Injection","Severity":"high","Description":"ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41460.yaml"}
{"ID":"CVE-2021-41467","Info":{"Name":"JustWriting - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-41467.yaml"}
{"ID":"CVE-2021-41467","Info":{"Name":"JustWriting - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-41467.yaml"}
{"ID":"CVE-2021-41569","Info":{"Name":"SAS/Internet 9.4 1520 - Local File Inclusion","Severity":"high","Description":"SAS/Internet 9.4 build 1520 and earlier allows local file inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41569.yaml"}
{"ID":"CVE-2021-41648","Info":{"Name":"PuneethReddyHC action.php SQL Injection","Severity":"high","Description":"An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41648.yaml"}
{"ID":"CVE-2021-41649","Info":{"Name":"PuneethReddyHC Online Shopping System homeaction.php SQL Injection","Severity":"critical","Description":"An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-41649.yaml"}
@@ -1645,6 +1673,7 @@
{"ID":"CVE-2021-44529","Info":{"Name":"Ivanti EPM Cloud Services Appliance Code Injection","Severity":"critical","Description":"Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44529.yaml"}
{"ID":"CVE-2021-44848","Info":{"Name":"Thinfinity VirtualUI User Enumeration","Severity":"medium","Description":"Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.)","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-44848.yaml"}
{"ID":"CVE-2021-44910","Info":{"Name":"SpringBlade - Information Leakage","Severity":"high","Description":"SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a SpringCloud distributed microservice architecture and a SpringBoot monolithic microservice architecture. The SpringBlade framework has a default SIGN_KEY, which can be exploited by attackers to obtain sensitive information such as user account password logs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2021/CVE-2021-44910.yaml"}
{"ID":"CVE-2021-45027","Info":{"Name":"Oliver 5 Library Server \u003c8.00.008.053 - Local File Inclusion","Severity":"high","Description":"Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45027.yaml"}
{"ID":"CVE-2021-45043","Info":{"Name":"HD-Network Realtime Monitoring System 2.0 - Local File Inclusion","Severity":"high","Description":"Instances of HD-Network Realtime Monitoring System version 2.0 are vulnerable to a Local File Inclusion vulnerability which allows remote unauthenticated attackers to view confidential information.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45043.yaml"}
{"ID":"CVE-2021-45046","Info":{"Name":"Apache Log4j2 - Remote Code Injection","Severity":"critical","Description":"Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2021/CVE-2021-45046.yaml"}
{"ID":"CVE-2021-45092","Info":{"Name":"Thinfinity Iframe Injection","Severity":"critical","Description":"A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the \"vpath\" parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45092.yaml"}
@@ -1654,10 +1683,11 @@
{"ID":"CVE-2021-45420","Info":{"Name":"Emerson Dixell XWEB-500 - Arbitrary File Write","Severity":"critical","Description":"Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi, letting attackers write any file on the system, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45420.yaml"}
{"ID":"CVE-2021-45422","Info":{"Name":"Reprise License Manager 14.2 - Cross-Site Scripting","Severity":"medium","Description":"Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activate_process \"count\" parameter via GET.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-45422.yaml"}
{"ID":"CVE-2021-45428","Info":{"Name":"Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload","Severity":"critical","Description":"TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45428.yaml"}
{"ID":"CVE-2021-45467","Info":{"Name":"Control Web Panel (CWP) - File Inclusion","Severity":"critical","Description":"In CWP (Control Web Panel, previously CentOS Web Panel) before version 0.9.8.1107, an unauthenticated attacker can abuse null byte (%00) injection with the \"scripts\" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be exploited by using multiple %00 sequences to traverse directories via crafted requests such as /user/loader.php?api=1\u0026scripts=.%00./.%00./api/account_new_create\u0026acc=guadaapi, or similar payloads with more %00 instances (e.g., .%00%00%00./.%00%00%00./api/account_new_create). Attackers may use this flaw for arbitrary file access, privilege escalation, or remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45467.yaml"}
{"ID":"CVE-2021-45793","Info":{"Name":"Slims9 Bulian 9.4.2 - SQL Injection","Severity":"high","Description":"Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45793.yaml"}
{"ID":"CVE-2021-45811","Info":{"Name":"osTicket 1.15.x - SQL Injection","Severity":"medium","Description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-45811.yaml"}
{"ID":"CVE-2021-45967","Info":{"Name":"Pascom CPS Server-Side Request Forgery","Severity":"critical","Description":"Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-45967.yaml"}
{"ID":"CVE-2021-45968","Info":{"Name":"Pascom CPS - Local File Inclusion","Severity":"high","Description":"Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45968.yaml"}
{"ID":"CVE-2021-45968","Info":{"Name":"Pascom CPS - Local File Inclusion","Severity":"high","Description":"Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45968.yaml"}
{"ID":"CVE-2021-46005","Info":{"Name":"Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting","Severity":"medium","Description":"Sourcecodester Car Rental Management System 1.0 is vulnerable to cross-site scripting via the vehicalorcview parameter.","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-46005.yaml"}
{"ID":"CVE-2021-46068","Info":{"Name":"Vehicle Service Management System - Stored Cross-Site Scripting","Severity":"medium","Description":"A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2021/CVE-2021-46068.yaml"}
{"ID":"CVE-2021-46069","Info":{"Name":"Vehicle Service Management System 1.0 - Stored Cross Site Scripting","Severity":"medium","Description":"Vehicle Service Management System 1.0 contains a stored cross-site scripting vulnerability via the Mechanic List section in login panel.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2021/CVE-2021-46069.yaml"}
@@ -1689,7 +1719,7 @@
{"ID":"CVE-2022-0208","Info":{"Name":"WordPress Plugin MapPress \u003c2.73.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Plugin MapPress before version 2.73.4 does not sanitize and escape the 'mapid' parameter before outputting it back in the \"Bad mapid\" error message, leading to reflected cross-site scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0208.yaml"}
{"ID":"CVE-2022-0212","Info":{"Name":"WordPress Spider Calendar \u003c=1.5.65 - Cross-Site Scripting","Severity":"medium","Description":"WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0212.yaml"}
{"ID":"CVE-2022-0218","Info":{"Name":"HTML Email Template Designer \u003c 3.1 - Stored Cross-Site Scripting","Severity":"medium","Description":"WordPress Email Template Designer WP HTML Mail allows stored cross-site scripting through an unprotected REST-API endpoint.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0218.yaml"}
{"ID":"CVE-2022-0220","Info":{"Name":"WordPress GDPR \u0026 CCPA \u003c1.9.27 - Cross-Site Scripting","Severity":"medium","Description":"WordPress GDPR \u0026 CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an \"application/json\" content-type, and JavaScript code may be executed on a victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0220.yaml"}
{"ID":"CVE-2022-0220","Info":{"Name":"WordPress GDPR \u0026 CCPA \u003c1.9.27 - Cross-Site Scripting","Severity":"medium","Description":"WordPress GDPR \u0026 CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an \"application/json\" content-type, and JavaScript code may be executed on a victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0220.yaml"}
{"ID":"CVE-2022-0228","Info":{"Name":"Popup Builder \u003c 4.0.7 - SQL Injection","Severity":"high","Description":"The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-0228.yaml"}
{"ID":"CVE-2022-0234","Info":{"Name":"WordPress WOOCS \u003c 1.3.7.5 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0234.yaml"}
{"ID":"CVE-2022-0250","Info":{"Name":"Redirection for Contact Form 7 \u003c 2.5.0 - Cross-Site Scripting","Severity":"medium","Description":"The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0250.yaml"}
@@ -1815,7 +1845,7 @@
{"ID":"CVE-2022-21587","Info":{"Name":"Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution","Severity":"critical","Description":"Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-21587.yaml"}
{"ID":"CVE-2022-21661","Info":{"Name":"WordPress \u003c5.8.3 - SQL Injection","Severity":"high","Description":"WordPress before 5.8.3 is susceptible to SQL injection through multiple plugins or themes due to improper sanitization in WP_Query, An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-21661.yaml"}
{"ID":"CVE-2022-2168","Info":{"Name":"WordPress Download Manager \u003c 3.2.44 - Authenticated Cross-Site Scripting","Severity":"medium","Description":"The WordPress Download Manager plugin before version 3.2.44 does not properly sanitize and escape the user_ids parameter in the stats history dashboard. This allows authenticated attackers to perform Cross-Site Scripting attacks by injecting malicious JavaScript code.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2168.yaml"}
{"ID":"CVE-2022-21705","Info":{"Name":"October CMS - Remote Code Execution","Severity":"high","Description":"October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-21705.yaml"}
{"ID":"CVE-2022-21705","Info":{"Name":"October CMS - Remote Code Execution","Severity":"high","Description":"October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-21705.yaml"}
{"ID":"CVE-2022-2174","Info":{"Name":"microweber 1.2.18 - Cross-site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2174.yaml"}
{"ID":"CVE-2022-2185","Info":{"Name":"GitLab CE/EE - Remote Code Execution","Severity":"high","Description":"GitLab CE/EE 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 is susceptible to remote code execution. An authenticated user authorized to import projects can import a maliciously crafted project, thus possibly being able to execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2022/CVE-2022-2185.yaml"}
{"ID":"CVE-2022-2187","Info":{"Name":"WordPress Contact Form 7 Captcha \u003c0.1.2 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2187.yaml"}
@@ -1827,6 +1857,7 @@
{"ID":"CVE-2022-2290","Info":{"Name":"Trilium \u003c0.52.4 - Cross-Site Scripting","Severity":"medium","Description":"Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2290.yaml"}
{"ID":"CVE-2022-22947","Info":{"Name":"Spring Cloud Gateway Code Injection","Severity":"critical","Description":"Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2022/CVE-2022-22947.yaml"}
{"ID":"CVE-2022-22954","Info":{"Name":"VMware Workspace ONE Access - Server-Side Template Injection","Severity":"critical","Description":"VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-22954.yaml"}
{"ID":"CVE-2022-22956","Info":{"Name":"VMware Workspace ONE Access - Authentication Bypass","Severity":"critical","Description":"VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 \u0026 CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-22956.yaml"}
{"ID":"CVE-2022-22963","Info":{"Name":"Spring Cloud - Remote Code Execution","Severity":"critical","Description":"Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-22963.yaml"}
{"ID":"CVE-2022-22965","Info":{"Name":"Spring - Remote Code Execution","Severity":"critical","Description":"Spring MVC and Spring WebFlux applications running on Java Development Kit 9+ are susceptible to remote code execution via data binding. It requires the application to run on Tomcat as a WAR deployment. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-22965.yaml"}
{"ID":"CVE-2022-22972","Info":{"Name":"VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass","Severity":"critical","Description":"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-22972.yaml"}
@@ -1849,6 +1880,7 @@
{"ID":"CVE-2022-23881","Info":{"Name":"ZZZCMS zzzphp 2.1.0 - Remote Code Execution","Severity":"critical","Description":"ZZZCMS zzzphp v2.1.0 is susceptible to a remote command execution vulnerability via danger_key() at zzz_template.php.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23881.yaml"}
{"ID":"CVE-2022-23898","Info":{"Name":"MCMS 5.2.5 - SQL Injection","Severity":"critical","Description":"MCMS 5.2.5 contains a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23898.yaml"}
{"ID":"CVE-2022-23944","Info":{"Name":"Apache ShenYu Admin Unauth Access","Severity":"critical","Description":"Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2022/CVE-2022-23944.yaml"}
{"ID":"CVE-2022-24086","Info":{"Name":"Adobe Commerce (Magento) - Remote Code Execution","Severity":"critical","Description":"Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-24086.yaml"}
{"ID":"CVE-2022-24112","Info":{"Name":"Apache APISIX - Remote Code Execution","Severity":"critical","Description":"A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-24112.yaml"}
{"ID":"CVE-2022-24124","Info":{"Name":"Casdoor 1.13.0 - Unauthenticated SQL Injection","Severity":"high","Description":"Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-24124.yaml"}
{"ID":"CVE-2022-24129","Info":{"Name":"Shibboleth OIDC OP \u003c3.0.4 - Server-Side Request Forgery","Severity":"high","Description":"The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2022/CVE-2022-24129.yaml"}
@@ -1880,7 +1912,7 @@
{"ID":"CVE-2022-24990","Info":{"Name":"TerraMaster TOS \u003c 4.2.30 Server Information Disclosure","Severity":"high","Description":"TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-24990.yaml"}
{"ID":"CVE-2022-25061","Info":{"Name":"TP-Link TL-WR840N - Command Injection","Severity":"critical","Description":"The TP-Link TL-WR840N(ES)_V6.20_180709 router contains a command injection vulnerability in the oal_setIp6DefaultRoute component. This vulnerability allows authenticated attackers to execute arbitrary system commands, leading to complete device compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25061.yaml"}
{"ID":"CVE-2022-25082","Info":{"Name":"TOTOLink - Unauthenticated Command Injection","Severity":"critical","Description":"TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25082.yaml"}
{"ID":"CVE-2022-25125","Info":{"Name":"MCMS 5.2.4 - SQL Injection","Severity":"critical","Description":"MCMS 5.2.4 contains a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25125.yaml"}
{"ID":"CVE-2022-25125","Info":{"Name":"MCMS 5.2.4 - SQL Injection","Severity":"critical","Description":"MCMS 5.2.4 contains a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25125.yaml"}
{"ID":"CVE-2022-25148","Info":{"Name":"WordPress Plugin WP Statistics \u003c= 13.1.5 - SQL Injection","Severity":"critical","Description":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25148.yaml"}
{"ID":"CVE-2022-25149","Info":{"Name":"WordPress Plugin WP Statistics \u003c= 13.1.5 - SQL Injection","Severity":"high","Description":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25149.yaml"}
{"ID":"CVE-2022-25216","Info":{"Name":"DVDFab 12 Player/PlayerFab - Local File Inclusion","Severity":"high","Description":"DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25216.yaml"}
@@ -1906,6 +1938,7 @@
{"ID":"CVE-2022-2599","Info":{"Name":"WordPress Anti-Malware Security and Brute-Force Firewall \u003c4.21.83 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Anti-Malware Security and Brute-Force Firewall plugin before 4.21.83 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in an admin dashboard.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2599.yaml"}
{"ID":"CVE-2022-26134","Info":{"Name":"Confluence - Remote Code Execution","Severity":"critical","Description":"Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-26134.yaml"}
{"ID":"CVE-2022-26138","Info":{"Name":"Atlassian Questions For Confluence - Hardcoded Credentials","Severity":"critical","Description":"Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-26138.yaml"}
{"ID":"CVE-2022-26143","Info":{"Name":"Mitel MiCollab - Information Disclosure \u0026 Denial of Service","Severity":"critical","Description":"Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contain a vulnerability in the TP-240 component caused by improper handling, letting remote attackers obtain sensitive information and cause denial of service, exploit requires remote access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-26143.yaml"}
{"ID":"CVE-2022-26148","Info":{"Name":"Grafana \u0026 Zabbix Integration - Credentials Disclosure","Severity":"critical","Description":"Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-26148.yaml"}
{"ID":"CVE-2022-26159","Info":{"Name":"Ametys CMS Information Disclosure","Severity":"medium","Description":"Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-26159.yaml"}
{"ID":"CVE-2022-26233","Info":{"Name":"Barco Control Room Management Suite \u003c=2.9 Build 0275 - Local File Inclusion","Severity":"high","Description":"Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the \"GET /..\\..\" substring.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-26233.yaml"}
@@ -1919,6 +1952,7 @@
{"ID":"CVE-2022-26833","Info":{"Name":"Open Automation Software OAS Platform V16.00.0121 - Missing Authentication","Severity":"critical","Description":"An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2022/CVE-2022-26833.yaml"}
{"ID":"CVE-2022-26960","Info":{"Name":"elFinder \u003c=2.1.60 - Local File Inclusion","Severity":"critical","Description":"elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2022/CVE-2022-26960.yaml"}
{"ID":"CVE-2022-27043","Info":{"Name":"Yearning - Directory Traversal","Severity":"high","Description":"Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-27043.yaml"}
{"ID":"CVE-2022-27228","Info":{"Name":"Bitrix Site Manager - Remote Code Execution","Severity":"critical","Description":"In the vote (aka \"Polls, Votes\") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-27228.yaml"}
{"ID":"CVE-2022-2733","Info":{"Name":"Openemr \u003c 7.0.0.1 - Cross-Site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-2733.yaml"}
{"ID":"CVE-2022-2756","Info":{"Name":"Kavita \u003c0.5.4.1 - Server-Side Request Forgery","Severity":"medium","Description":"Kavita before 0.5.4.1 is susceptible to server-side request forgery in GitHub repository kareadita/kavita. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2022/CVE-2022-2756.yaml"}
{"ID":"CVE-2022-27593","Info":{"Name":"QNAP QTS Photo Station External Reference - Local File Inclusion","Severity":"critical","Description":"QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2022/CVE-2022-27593.yaml"}
@@ -1954,6 +1988,7 @@
{"ID":"CVE-2022-29299","Info":{"Name":"SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting","Severity":"medium","Description":"SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'time_begin' parameter to Solar_History.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2022/CVE-2022-29299.yaml"}
{"ID":"CVE-2022-29301","Info":{"Name":"SolarView Compact 6.00 - 'pow' Cross-Site Scripting","Severity":"high","Description":"SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'pow' parameter to Solar_SlideSub.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2022/CVE-2022-29301.yaml"}
{"ID":"CVE-2022-29303","Info":{"Name":"SolarView Compact 6.00 - OS Command Injection","Severity":"critical","Description":"SolarView Compact 6.00 was discovered to contain a command injection vulnerability via conf_mail.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29303.yaml"}
{"ID":"CVE-2022-29316","Info":{"Name":"Complete Online Job Search System 1.0 - Cross-Site Scripting","Severity":"high","Description":"Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-29316.yaml"}
{"ID":"CVE-2022-29349","Info":{"Name":"kkFileView 4.0.0 - Cross-Site Scripting","Severity":"medium","Description":"kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-29349.yaml"}
{"ID":"CVE-2022-29383","Info":{"Name":"NETGEAR ProSafe SSL VPN firmware - SQL Injection","Severity":"critical","Description":"NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29383.yaml"}
{"ID":"CVE-2022-29455","Info":{"Name":"WordPress Elementor Website Builder \u003c= 3.5.5 - DOM Cross-Site Scripting","Severity":"medium","Description":"WordPress Elementor Website Builder plugin 3.5.5 and prior contains a reflected cross-site scripting vulnerability via the document object model.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-29455.yaml"}
@@ -1984,6 +2019,9 @@
{"ID":"CVE-2022-31474","Info":{"Name":"BackupBuddy - Local File Inclusion","Severity":"high","Description":"BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-31474.yaml"}
{"ID":"CVE-2022-31499","Info":{"Name":"Nortek Linear eMerge E3-Series \u003c0.32-08f - Remote Command Injection","Severity":"critical","Description":"Nortek Linear eMerge E3-Series devices before 0.32-08f are susceptible to remote command injection via ReaderNo. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-7256.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31499.yaml"}
{"ID":"CVE-2022-31656","Info":{"Name":"VMware - Local File Inclusion","Severity":"critical","Description":"VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31656.yaml"}
{"ID":"CVE-2022-31704","Info":{"Name":"VMware vRealize Log Insight - Improper Access Control to RCE","Severity":"critical","Description":"The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31704.yaml"}
{"ID":"CVE-2022-31706","Info":{"Name":"VMware vRealize Log Insight - Path Traversal","Severity":"critical","Description":"he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31706.yaml"}
{"ID":"CVE-2022-31711","Info":{"Name":"VMware vRealize Log Insight \u003c v8.10.2 - Information Disclosure","Severity":"medium","Description":"VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-31711.yaml"}
{"ID":"CVE-2022-31798","Info":{"Name":"Nortek Linear eMerge E3-Series - Cross-Site Scripting","Severity":"medium","Description":"There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-31798.yaml"}
{"ID":"CVE-2022-31814","Info":{"Name":"pfSense pfBlockerNG \u003c=2.1..4_26 - OS Command Injection","Severity":"critical","Description":"pfSense pfBlockerNG through 2.1.4_26 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31814.yaml"}
{"ID":"CVE-2022-31845","Info":{"Name":"WAVLINK WN535 G3 - Information Disclosure","Severity":"high","Description":"WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in live_check.shtml. An attacker can obtain sensitive router information via execution of the exec cmd function and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-31845.yaml"}
@@ -2165,8 +2203,8 @@
{"ID":"CVE-2022-44951","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms\u0026entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44951.yaml"}
{"ID":"CVE-2022-44952","Info":{"Name":"Rukovoditel \u003c= 3.2.1 - Cross Site Scripting","Severity":"medium","Description":"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking \"Add\".\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44952.yaml"}
{"ID":"CVE-2022-44957","Info":{"Name":"WebTareas 2.4p5 - Cross-Site Scripting","Severity":"medium","Description":"webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-44957.yaml"}
{"ID":"CVE-2022-45037","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45037.yaml"}
{"ID":"CVE-2022-45038","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45038.yaml"}
{"ID":"CVE-2022-45037","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45037.yaml"}
{"ID":"CVE-2022-45038","Info":{"Name":"WBCE CMS v1.5.4 - Cross Site Scripting (Stored)","Severity":"medium","Description":"A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-45038.yaml"}
{"ID":"CVE-2022-45269","Info":{"Name":"Linx Sphere - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-45269.yaml"}
{"ID":"CVE-2022-45354","Info":{"Name":"Download Monitor \u003c= 4.7.60 - Sensitive Information Exposure","Severity":"high","Description":"The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and other info (not passwords)\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-45354.yaml"}
{"ID":"CVE-2022-45362","Info":{"Name":"WordPress Paytm Payment Gateway \u003c=2.7.0 - Server-Side Request Forgery","Severity":"medium","Description":"WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2022/CVE-2022-45362.yaml"}
@@ -2177,7 +2215,7 @@
{"ID":"CVE-2022-45835","Info":{"Name":"WordPress PhonePe Payment Solutions \u003c=1.0.15 - Server-Side Request Forgery","Severity":"high","Description":"WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-45835.yaml"}
{"ID":"CVE-2022-45917","Info":{"Name":"ILIAS eLearning \u003c7.16 - Open Redirect","Severity":"medium","Description":"ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-45917.yaml"}
{"ID":"CVE-2022-45933","Info":{"Name":"KubeView \u003c=0.1.31 - Information Disclosure","Severity":"critical","Description":"KubeView through 0.1.31 is susceptible to information disclosure. An attacker can obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication and retrieves certificate files that can be used for authentication as kube-admin. An attacker can thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-45933.yaml"}
{"ID":"CVE-2022-46020","Info":{"Name":"WBCE CMS v1.5.4 - Remote Code Execution","Severity":"critical","Description":"WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-46020.yaml"}
{"ID":"CVE-2022-46020","Info":{"Name":"WBCE CMS v1.5.4 - Remote Code Execution","Severity":"critical","Description":"WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-46020.yaml"}
{"ID":"CVE-2022-46071","Info":{"Name":"Helmet Store Showroom v1.0 - SQL Injection","Severity":"critical","Description":"There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-46071.yaml"}
{"ID":"CVE-2022-46073","Info":{"Name":"Helmet Store Showroom - Cross Site Scripting","Severity":"medium","Description":"Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-46073.yaml"}
{"ID":"CVE-2022-46169","Info":{"Name":"Cacti \u003c=1.2.22 - Remote Command Injection","Severity":"critical","Description":"Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS commands on the server, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-46169.yaml"}
@@ -2198,6 +2236,7 @@
{"ID":"CVE-2022-48165","Info":{"Name":"Wavlink - Improper Access Control","Severity":"high","Description":"Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-48165.yaml"}
{"ID":"CVE-2022-48166","Info":{"Name":"Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure","Severity":"high","Description":"An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-48166.yaml"}
{"ID":"CVE-2022-48197","Info":{"Name":"Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting","Severity":"medium","Description":"Reflected cross-site scripting (XSS) exists in the TreeView of YUI2 through 2800: up.php sam.php renderhidden.php removechildren.php removeall.php readd.php overflow.php newnode2.php newnode.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-48197.yaml"}
{"ID":"CVE-2022-48323","Info":{"Name":"Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution","Severity":"critical","Description":"Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-48323.yaml"}
{"ID":"CVE-2022-4897","Info":{"Name":"WordPress BackupBuddy \u003c8.8.3 - Cross Site Scripting","Severity":"medium","Description":"WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4897.yaml"}
{"ID":"CVE-2022-4971","Info":{"Name":"Sassy Social Share \u003c= 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4971.yaml"}
{"ID":"CVE-2023-0037","Info":{"Name":"WordPress 10Web Map Builder \u003c 1.0.73 - Unauthenticated SQL Injection","Severity":"critical","Description":"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-0037.yaml"}
@@ -2297,6 +2336,7 @@
{"ID":"CVE-2023-24278","Info":{"Name":"Squidex \u003c7.4.0 - Cross-Site Scripting","Severity":"medium","Description":"Squidex before 7.4.0 contains a cross-site scripting vulnerability via the squid.svg endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-24278.yaml"}
{"ID":"CVE-2023-24322","Info":{"Name":"mojoPortal 2.7.0.0 - Cross-Site Scripting","Severity":"medium","Description":"mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-24322.yaml"}
{"ID":"CVE-2023-24367","Info":{"Name":"Temenos T24 R20 - Cross-Site Scripting","Severity":"medium","Description":"Temenos T24 release 20 contains a reflected cross-site scripting vulnerability via the routineName parameter at genrequest.jsp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-24367.yaml"}
{"ID":"CVE-2023-2437","Info":{"Name":"UserPro \u003c= 5.1.1 - Authentication Bypass","Severity":"critical","Description":"The UserPro plugin for WordPress through 5.1.1 allows authentication bypass via the userpro_fbconnect AJAX action.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2437.yaml"}
{"ID":"CVE-2023-24488","Info":{"Name":"Citrix Gateway and Citrix ADC - Cross-Site Scripting","Severity":"medium","Description":"Citrix ADC and Citrix Gateway versions before 13.1 and 13.1-45.61, 13.0 and 13.0-90.11, 12.1 and 12.1-65.35 contain a cross-site scripting vulnerability due to improper input validation.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-24488.yaml"}
{"ID":"CVE-2023-24489","Info":{"Name":"Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-24489.yaml"}
{"ID":"CVE-2023-24657","Info":{"Name":"phpIPAM - 1.6 - Cross-Site Scripting","Severity":"medium","Description":"phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-24657.yaml"}
@@ -2382,11 +2422,11 @@
{"ID":"CVE-2023-30192","Info":{"Name":"PrestaShop 'possearchproducts' \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"In the module “Search Products” (possearchproducts) from PosThemes for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-30192.yaml"}
{"ID":"CVE-2023-30194","Info":{"Name":"Prestashop posstaticfooter \u003c= 1.0.0 - SQL Injection","Severity":"critical","Description":"Prestashop posstaticfooter \u003c= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-30194.yaml"}
{"ID":"CVE-2023-30210","Info":{"Name":"OURPHP \u003c= 7.2.0 - Cross Site Scripting","Severity":"medium","Description":"OURPHP \u003c= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via /client/manage/ourphp_tz.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30210.yaml"}
{"ID":"CVE-2023-30212","Info":{"Name":"OURPHP \u003c= 7.2.0 - Cross Site Scripting","Severity":"medium","Description":"OURPHP \u003c= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30212.yaml"}
{"ID":"CVE-2023-30212","Info":{"Name":"OURPHP \u003c= 7.2.0 - Cross Site Scripting","Severity":"medium","Description":"OURPHP \u003c= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30212.yaml"}
{"ID":"CVE-2023-30256","Info":{"Name":"Webkul QloApps 1.5.2 - Cross-site Scripting","Severity":"medium","Description":"Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30256.yaml"}
{"ID":"CVE-2023-30258","Info":{"Name":"MagnusBilling - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-30258.yaml"}
{"ID":"CVE-2023-30534","Info":{"Name":"Cacti \u003c 1.2.25 Insecure Deserialization","Severity":"medium","Description":"Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2023/CVE-2023-30534.yaml"}
{"ID":"CVE-2023-30625","Info":{"Name":"Rudder Server \u003c 1.3.0-rc.1 - SQL Injection","Severity":"high","Description":"Rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-30625.yaml"}
{"ID":"CVE-2023-30625","Info":{"Name":"Rudder Server \u003c 1.3.0-rc.1 - SQL Injection","Severity":"high","Description":"Rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-30625.yaml"}
{"ID":"CVE-2023-3077","Info":{"Name":"MStore API \u003c 3.9.8 - SQL Injection","Severity":"critical","Description":"The MStore API WordPress plugin before 3.9.8 is vulnerable to Blind SQL injection via the product_id parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3077.yaml"}
{"ID":"CVE-2023-30777","Info":{"Name":"Advanced Custom Fields \u003c 6.1.6 - Cross-Site Scripting","Severity":"medium","Description":"Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30777.yaml"}
{"ID":"CVE-2023-30868","Info":{"Name":"Tree Page View Plugin \u003c 1.6.7 - Cross-Site Scripting","Severity":"medium","Description":"The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7. This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30868.yaml"}
@@ -2419,8 +2459,10 @@
{"ID":"CVE-2023-3380","Info":{"Name":"WAVLINK WN579X3 - Remote Command Execution","Severity":"critical","Description":"Remote Command Execution vulnerability in WAVLINK WN579X3 routers via pingIp parameter in /cgi-bin/adm.cgi.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3380.yaml"}
{"ID":"CVE-2023-33831","Info":{"Name":"FUXA - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-33831.yaml"}
{"ID":"CVE-2023-34020","Info":{"Name":"Uncanny Toolkit for LearnDash - Open Redirection","Severity":"medium","Description":"A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2023/CVE-2023-34020.yaml"}
{"ID":"CVE-2023-34048","Info":{"Name":"VMware vCenter Server - Out-of-Bounds Write","Severity":"critical","Description":"vCenter Server contains an out-of-bounds write caused by a vulnerability in the DCERPC protocol implementation. A malicious actor with network access can trigger remote code execution on vCenter Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-34048.yaml"}
{"ID":"CVE-2023-34105","Info":{"Name":"SRS - Command Injection","Severity":"high","Description":"SRS's v5.0.137~v5.0.156, v6.0.18~v6.0.47 api-server server is vulnerable to a drive-by command injection.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-34105.yaml"}
{"ID":"CVE-2023-34124","Info":{"Name":"SonicWall GMS and Analytics Web Services - Shell Injection","Severity":"critical","Description":"The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-34124.yaml"}
{"ID":"CVE-2023-34133","Info":{"Name":"SonicWall GMS and Analytics - SQL Injection","Severity":"high","Description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-34133.yaml"}
{"ID":"CVE-2023-34192","Info":{"Name":"Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting","Severity":"critical","Description":"Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2023/CVE-2023-34192.yaml"}
{"ID":"CVE-2023-34259","Info":{"Name":"Kyocera TASKalfa printer - Path Traversal","Severity":"medium","Description":"CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings.\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2023/CVE-2023-34259.yaml"}
{"ID":"CVE-2023-34362","Info":{"Name":"MOVEit Transfer - Remote Code Execution","Severity":"critical","Description":"In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-34362.yaml"}
@@ -2449,6 +2491,7 @@
{"ID":"CVE-2023-35160","Info":{"Name":"XWiki \u003e= 2.5-milestone-2 - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/XWiki/Main xpage=resubmit\u0026resubmit=javascript:alert(document.domain)\u0026xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-35160.yaml"}
{"ID":"CVE-2023-35161","Info":{"Name":"XWiki \u003e= 6.2-milestone-1 - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu\u0026resolve=true\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-35161.yaml"}
{"ID":"CVE-2023-35162","Info":{"Name":"XWiki \u003c 14.10.5 - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform is vulnerable to reflected XSS via the previewactions template. An attacker can inject JavaScript through the xcontinue parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-35162.yaml"}
{"ID":"CVE-2023-3519","Info":{"Name":"Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution","Severity":"critical","Description":"critical unauthenticated remote code execution (RCE) vulnerability affecting Citrix ADC (NetScaler ADC) and Citrix Gateway appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Exploitation can lead to arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3519.yaml"}
{"ID":"CVE-2023-3521","Info":{"Name":"FOSSBilling \u003c 0.5.3 - Cross-Site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3521.yaml"}
{"ID":"CVE-2023-3578","Info":{"Name":"DedeCMS 5.7.109 - Server-Side Request Forgery","Severity":"critical","Description":"Manipulation of the rssurl parameter in co_do.php leads to server-side request forgery in DedeCMS version 5.7.109.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3578.yaml"}
{"ID":"CVE-2023-35813","Info":{"Name":"Sitecore - Remote Code Execution","Severity":"critical","Description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-35813.yaml"}
@@ -2524,6 +2567,7 @@
{"ID":"CVE-2023-39796","Info":{"Name":"WBCE 1.6.0 - SQL Injection","Severity":"critical","Description":"There is an sql injection vulnerability in \"miniform module\" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file \"/modules/miniform/ajax_delete_message.php\" there is no authentication check. On line 40 in this file, there is a DELETE query that is vulnerable, an attacker could jump from the query using the tick sign - `.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-39796.yaml"}
{"ID":"CVE-2023-3990","Info":{"Name":"Mingsoft MCMS \u003c 5.3.1 - Cross-Site Scripting","Severity":"medium","Description":"A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3990.yaml"}
{"ID":"CVE-2023-40000","Info":{"Name":"LiteSpeed Cache \u003c= 5.7 - Unauthenticated Stored XSS","Severity":"high","Description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2023/CVE-2023-40000.yaml"}
{"ID":"CVE-2023-40044","Info":{"Name":"WS_FTP Server - Insecure Deserialization","Severity":"critical","Description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2023/CVE-2023-40044.yaml"}
{"ID":"CVE-2023-40208","Info":{"Name":"Stock Ticker \u003c= 3.23.2 - Cross-Site Scripting","Severity":"medium","Description":"The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-40208.yaml"}
{"ID":"CVE-2023-40355","Info":{"Name":"Axigen WebMail - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-40355.yaml"}
{"ID":"CVE-2023-40504","Info":{"Name":"LG Simple Editor \u003c= v3.21.0 - Command Injection","Severity":"critical","Description":"LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-40504.yaml"}
@@ -2617,7 +2661,7 @@
{"ID":"CVE-2023-47117","Info":{"Name":"Label Studio - Sensitive Information Exposure","Severity":"high","Description":"An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-47117.yaml"}
{"ID":"CVE-2023-4714","Info":{"Name":"PlayTube 3.0.1 - Information Disclosure","Severity":"high","Description":"A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4714.yaml"}
{"ID":"CVE-2023-47211","Info":{"Name":"ManageEngine OpManager - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2023/CVE-2023-47211.yaml"}
{"ID":"CVE-2023-47218","Info":{"Name":"QNAP QTS and QuTS Hero - OS Command Injection","Severity":"medium","Description":"An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2023/CVE-2023-47218.yaml"}
{"ID":"CVE-2023-47218","Info":{"Name":"QNAP QTS and QuTS Hero - OS Command Injection","Severity":"medium","Description":"An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2023/CVE-2023-47218.yaml"}
{"ID":"CVE-2023-47246","Info":{"Name":"SysAid Server - Remote Code Execution","Severity":"critical","Description":"In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-47246.yaml"}
{"ID":"CVE-2023-47248","Info":{"Name":"PyArrow Flight RPC - Remote Code Execution","Severity":"critical","Description":"PyArrow Flight RPC from v0.14.0 through v14.0.0 allows remote attackers to execute arbitrary code via a maliciously crafted Python-defined extension type.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-47248.yaml"}
{"ID":"CVE-2023-47253","Info":{"Name":"Qualitor \u003c= 8.20 - Remote Code Execution","Severity":"critical","Description":"Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-47253.yaml"}
@@ -2685,11 +2729,13 @@
{"ID":"CVE-2023-6421","Info":{"Name":"WordPress Download Manager - File Password Exposure","Severity":"medium","Description":"The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-6421.yaml"}
{"ID":"CVE-2023-6444","Info":{"Name":"Seriously Simple Podcasting \u003c 3.0.0 - Information Disclosure","Severity":"medium","Description":"The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-6444.yaml"}
{"ID":"CVE-2023-6505","Info":{"Name":"Prime Mover \u003c 1.9.3 - Sensitive Data Exposure","Severity":"high","Description":"Prime Mover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.2 via directory listing in the 'prime-mover-export-files/1/' folder. This makes it possible for unauthenticated attackers to extract sensitive data including site and configuration information, directories, files, and password hashes.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-6505.yaml"}
{"ID":"CVE-2023-6549","Info":{"Name":"Citrix Netscaler ADC \u0026 Gateway - Out-Of-Bounds Memory Read","Severity":"critical","Description":"The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. This bug is nearly identical to the Citrix Bleed vulnerability (CVE-2023-4966), except it is less likely to return highly sensitive information to an attacker.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-6549.yaml"}
{"ID":"CVE-2023-6553","Info":{"Name":"Worpress Backup Migration \u003c= 1.3.7 - Unauthenticated Remote Code Execution","Severity":"critical","Description":"The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated threat actors to easily execute code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-6553.yaml"}
{"ID":"CVE-2023-6567","Info":{"Name":"LearnPress \u003c= 4.2.5.7 - SQL Injection","Severity":"high","Description":"The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-6567.yaml"}
{"ID":"CVE-2023-6568","Info":{"Name":"Mlflow - Cross-Site Scripting","Severity":"medium","Description":"The vulnerability allows an attacker to inject malicious code into the Content-Type header of a POST request,\nwhich is then reflected back to the user without proper sanitization or escaping.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-6568.yaml"}
{"ID":"CVE-2023-6623","Info":{"Name":"Essential Blocks \u003c 4.4.3 - Local File Inclusion","Severity":"critical","Description":"Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-6623.yaml"}
{"ID":"CVE-2023-6634","Info":{"Name":"LearnPress \u003c 4.2.5.8 - Remote Code Execution","Severity":"critical","Description":"The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-6634.yaml"}
{"ID":"CVE-2023-6655","Info":{"Name":"Hongjing e-HR 2020 - SQL Injection","Severity":"high","Description":"A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2023/CVE-2023-6655.yaml"}
{"ID":"CVE-2023-6697","Info":{"Name":"WP Go Maps (formerly WP Google Maps) \u003c 9.0.29 - Cross-Site Scripting","Severity":"medium","Description":"The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-6697.yaml"}
{"ID":"CVE-2023-6786","Info":{"Name":"Payment Gateway for Telcell \u003c 2.0.4 - Open Redirect","Severity":"medium","Description":"The plugin does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-6786.yaml"}
{"ID":"CVE-2023-6831","Info":{"Name":"mlflow - Path Traversal","Severity":"high","Description":"Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2023/CVE-2023-6831.yaml"}
@@ -2714,10 +2760,13 @@
{"ID":"CVE-2024-0593","Info":{"Name":"WordPress Simple Job Board - Unauthorized Data Access","Severity":"medium","Description":"The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetch_quick_job() function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-0593.yaml"}
{"ID":"CVE-2024-0692","Info":{"Name":"SolarWinds Security Event Manager - Unauthenticated RCE","Severity":"high","Description":"The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-0692.yaml"}
{"ID":"CVE-2024-0713","Info":{"Name":"Monitorr Services Configuration - Arbitrary File Upload","Severity":"high","Description":"A vulnerability was found in Monitorr 1.7.6m. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /assets/php/upload.php of the component Services Configuration. The manipulation of the argument fileToUpload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251539. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-0713.yaml"}
{"ID":"CVE-2024-0799","Info":{"Name":"Arcserve Unified Data Protection - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0799.yaml"}
{"ID":"CVE-2024-0801","Info":{"Name":"Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll","Severity":"high","Description":"A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-0801.yaml"}
{"ID":"CVE-2024-0881","Info":{"Name":"Combo Blocks \u003c 2.2.76 - Improper Access Control","Severity":"medium","Description":"The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-0881.yaml"}
{"ID":"CVE-2024-0939","Info":{"Name":"Smart S210 Management Platform - Arbitary File Upload","Severity":"critical","Description":"A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0939.yaml"}
{"ID":"CVE-2024-0986","Info":{"Name":"Issabel Authenticated - Remote Code Execution","Severity":"medium","Description":"A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE- The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2024/CVE-2024-0986.yaml"}
{"ID":"CVE-2024-10081","Info":{"Name":"CodeChecker \u003c= 6.24.1 - Authentication Bypass","Severity":"critical","Description":"Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-10081.yaml"}
{"ID":"CVE-2024-10146","Info":{"Name":"Simple File List \u003c 6.1.13 - Reflected Cross-Site Scripting","Severity":"medium","Description":"Simple File List WordPress plugin \\u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-10146.yaml"}
{"ID":"CVE-2024-1021","Info":{"Name":"Rebuild \u003c= 3.5.5 - Server-Side Request Forgery","Severity":"critical","Description":"There is a security vulnerability in Rebuild 3.5.5, which is due to a server-side request forgery vulnerability in the URL parameter of the readRawText function of the HTTP Request Handler component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1021.yaml"}
{"ID":"CVE-2024-10400","Info":{"Name":"Tutor LMS \u003c= 2.7.6 - SQL Injection","Severity":"high","Description":"The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-10400.yaml"}
{"ID":"CVE-2024-10486","Info":{"Name":"Google for WooCommerce \u003c= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File","Severity":"medium","Description":"The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-10486.yaml"}
@@ -2733,6 +2782,7 @@
{"ID":"CVE-2024-10915","Info":{"Name":"D-Link NAS - Command Injection via Group Parameter","Severity":"critical","Description":"A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-10915.yaml"}
{"ID":"CVE-2024-10924","Info":{"Name":"Really Simple Security \u003c 9.1.2 - Authentication Bypass","Severity":"critical","Description":"The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the \"Two-Factor Authentication\" setting is enabled (disabled by default).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-10924.yaml"}
{"ID":"CVE-2024-11044","Info":{"Name":"Stable Diffusion Webui 1.10.0 - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-11044.yaml"}
{"ID":"CVE-2024-11238","Info":{"Name":"Landray EKP - Path Traversal","Severity":"medium","Description":"A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-11238.yaml"}
{"ID":"CVE-2024-11303","Info":{"Name":"Korenix JetPort 5601v3 - Path Traversal","Severity":"high","Description":"The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601- through 1.2.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-11303.yaml"}
{"ID":"CVE-2024-11305","Info":{"Name":"Altenergy Power Control Software - SQL Injection","Severity":"medium","Description":"A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-11305.yaml"}
{"ID":"CVE-2024-11320","Info":{"Name":"Pandora v7.0NG.777.3 - Remote Code Execution","Severity":"critical","Description":"Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.This issue affects Pandora FMS- from 700 through \u003c=777.4\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11320.yaml"}
@@ -2764,6 +2814,7 @@
{"ID":"CVE-2024-1380","Info":{"Name":"Relevanssi (A Better Search) \u003c= 4.22.0 - Query Log Export","Severity":"medium","Description":"The Relevanssi Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in all versions up to, and including, 4.22.0. This makes it possible for unauthenticated attackers to export the query log data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-1380.yaml"}
{"ID":"CVE-2024-13853","Info":{"Name":"WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting","Severity":"medium","Description":"The SEO Tools WordPress plugin through version 4.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'src' parameter in the rssread.php file before outputting it back in the page, which could allow attackers to execute arbitrary JavaScript code in a victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-13853.yaml"}
{"ID":"CVE-2024-13888","Info":{"Name":"WPMobile.App \u003c= 11.56 - Open Redirect","Severity":"high","Description":"The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-13888.yaml"}
{"ID":"CVE-2024-13979","Info":{"Name":"St. Joe ERP system - SQL Injection","Severity":"critical","Description":"A SQL injection vulnerability exists in the St. Joe ERP system (\"圣乔ERP系统\") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-13979.yaml"}
{"ID":"CVE-2024-1483","Info":{"Name":"Mlflow \u003c 2.9.2 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1483.yaml"}
{"ID":"CVE-2024-1512","Info":{"Name":"MasterStudy LMS WordPress Plugin \u003c= 3.2.5 - SQL Injection","Severity":"critical","Description":"The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1512.yaml"}
{"ID":"CVE-2024-1561","Info":{"Name":"Gradio 4.3-4.12 - Local File Read","Severity":"high","Description":"Local file read by calling arbitrary methods of Components class between Gradio versions 4.3-4.12\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1561.yaml"}
@@ -2773,7 +2824,7 @@
{"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
{"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
{"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
{"ID":"CVE-2024-2053","Info":{"Name":"Artica Proxy - Unauthenticated LFI","Severity":"high","Description":"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2053.yaml"}
{"ID":"CVE-2024-2053","Info":{"Name":"Artica Proxy - Unauthenticated LFI","Severity":"high","Description":"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2053.yaml"}
{"ID":"CVE-2024-20767","Info":{"Name":"Adobe ColdFusion - Arbitrary File Read","Severity":"high","Description":"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-20767.yaml"}
{"ID":"CVE-2024-21136","Info":{"Name":"Oracle Retail Xstore Suite - Pre-authenticated Path Traversal","Severity":"high","Description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-21136.yaml"}
{"ID":"CVE-2024-21485","Info":{"Name":"Dash Framework - Cross-site Scripting","Severity":"medium","Description":"Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting (XSS) via href attribute in anchor tags. This template tests for javascript:alert payload injection.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-21485.yaml"}
@@ -2824,6 +2875,7 @@
{"ID":"CVE-2024-27199","Info":{"Name":"TeamCity \u003c 2023.11.4 - Authentication Bypass","Severity":"high","Description":"In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-27199.yaml"}
{"ID":"CVE-2024-27292","Info":{"Name":"Docassemble - Local File Inclusion","Severity":"high","Description":"Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-27292.yaml"}
{"ID":"CVE-2024-27348","Info":{"Name":"Apache HugeGraph-Server - Remote Command Execution","Severity":"high","Description":"Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-27348.yaml"}
{"ID":"CVE-2024-27443","Info":{"Name":"Zimbra Collaboration - Cross-Site Scripting (XSS)","Severity":"medium","Description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-27443.yaml"}
{"ID":"CVE-2024-27497","Info":{"Name":"Linksys E2000 1.0.06 position.js Improper Authentication","Severity":"high","Description":"Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-27497.yaml"}
{"ID":"CVE-2024-27564","Info":{"Name":"ChatGPT个人专用版 - Server Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-27564.yaml"}
{"ID":"CVE-2024-2771","Info":{"Name":"Contact Form Plugin by Fluent Forms \u003c 5.1.17 - Unauthenticated Limited Privilege Escalation","Severity":"critical","Description":"The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-2771.yaml"}
@@ -2834,6 +2886,7 @@
{"ID":"CVE-2024-28000","Info":{"Name":"WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-28000.yaml"}
{"ID":"CVE-2024-28255","Info":{"Name":"OpenMetadata - Authentication Bypass","Severity":"critical","Description":"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-28255.yaml"}
{"ID":"CVE-2024-28397","Info":{"Name":"pyload-ng js2py - Remote Code Execution","Severity":"medium","Description":"An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-28397.yaml"}
{"ID":"CVE-2024-28623","Info":{"Name":"RiteCMS 3.0.0 - Cross-site Scripting","Severity":"medium","Description":"RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the main_menu/edit_section component, letting attackers execute arbitrary scripts in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-28623.yaml"}
{"ID":"CVE-2024-28734","Info":{"Name":"Coda v.2024Q1 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting vulnerability in Unit4 Financials by Coda v.2024Q1 allows a remote attacker to escalate privileges via a crafted script to the cols parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-28734.yaml"}
{"ID":"CVE-2024-2876","Info":{"Name":"Wordpress Email Subscribers by Icegram Express - SQL Injection","Severity":"critical","Description":"The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-2876.yaml"}
{"ID":"CVE-2024-2879","Info":{"Name":"WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection","Severity":"high","Description":"The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2879.yaml"}
@@ -2844,7 +2897,7 @@
{"ID":"CVE-2024-29030","Info":{"Name":"Memos 0.13.2 - Server-Side Request Forgery","Severity":"medium","Description":"An SSRF vulnerability exists at the `/api/resource` that allows authenticated users to enumerate the internal network.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-29030.yaml"}
{"ID":"CVE-2024-29059","Info":{"Name":".NET Framework - Leaking ObjRefs via HTTP .NET Remoting","Severity":"high","Description":".NET Framework Information Disclosure Vulnerability","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29059.yaml"}
{"ID":"CVE-2024-29198","Info":{"Name":"GeoServer Demo Request Endpoint - Server Side Request Forgery","Severity":"high","Description":"It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29198.yaml"}
{"ID":"CVE-2024-29269","Info":{"Name":"Telesquare TLR-2005KSH - Remote Command Execution","Severity":"critical","Description":"Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-29269.yaml"}
{"ID":"CVE-2024-29269","Info":{"Name":"Telesquare TLR-2005KSH - Remote Command Execution","Severity":"critical","Description":"Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-29269.yaml"}
{"ID":"CVE-2024-29272","Info":{"Name":"VvvebJs \u003c 1.7.5 - Arbitrary File Upload","Severity":"medium","Description":"Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-29272.yaml"}
{"ID":"CVE-2024-2928","Info":{"Name":"MLflow \u003c 2.11.3 - Path Traversal","Severity":"high","Description":"MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2928.yaml"}
{"ID":"CVE-2024-29824","Info":{"Name":"Ivanti EPM - Remote Code Execution","Severity":"critical","Description":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.\n","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2024/CVE-2024-29824.yaml"}
@@ -2858,7 +2911,7 @@
{"ID":"CVE-2024-30269","Info":{"Name":"DataEase \u003c= 2.4.1 - Sensitive Information Exposure","Severity":"medium","Description":"DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-30269.yaml"}
{"ID":"CVE-2024-3032","Info":{"Name":"WordPress Themify Builder \u003c 7.5.8 - Open Redirect","Severity":"medium","Description":"The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tb_redirect_fail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-3032.yaml"}
{"ID":"CVE-2024-30568","Info":{"Name":"Netgear R6850 V1.1.0.88 - Command Injection","Severity":"critical","Description":"Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-30568.yaml"}
{"ID":"CVE-2024-30569","Info":{"Name":"Netgear R6850 - Information Disclosure","Severity":"medium","Description":"Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details, connection status, and other system configuration data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-30569.yaml"}
{"ID":"CVE-2024-30569","Info":{"Name":"Netgear R6850 - Information Disclosure","Severity":"high","Description":"Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details, connection status, and other system configuration data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-30569.yaml"}
{"ID":"CVE-2024-30570","Info":{"Name":"Netgear R6850 - Information Disclosure","Severity":"medium","Description":"Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the debuginfo.htm page. This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as product model name, WAN connection type, and potentially other system details.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-30570.yaml"}
{"ID":"CVE-2024-3080","Info":{"Name":"ASUS DSL-AC88U - Authentication Bypass","Severity":"critical","Description":"A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding \"/js/..%2f%2f\" or \"/images/..%2f%2e\" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue affecting multiple ASUS router models.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-3080.yaml"}
{"ID":"CVE-2024-3097","Info":{"Name":"NextGEN Gallery \u003c= 3.59 - Missing Authorization to Unauthenticated Information Disclosure","Severity":"medium","Description":"The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-3097.yaml"}
@@ -2872,7 +2925,7 @@
{"ID":"CVE-2024-31851","Info":{"Name":"CData Sync \u003c 23.4.8843 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in the Java version of CData Sync \u003c 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-31851.yaml"}
{"ID":"CVE-2024-31982","Info":{"Name":"XWiki \u003c 4.10.20 - Remote code execution","Severity":"critical","Description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-31982.yaml"}
{"ID":"CVE-2024-32113","Info":{"Name":"Apache OFBiz Directory Traversal - Remote Code Execution","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32113.yaml"}
{"ID":"CVE-2024-32231","Info":{"Name":"Stash \u003c 0.26.0 - SQL Injection","Severity":"critical","Description":"Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32231.yaml"}
{"ID":"CVE-2024-32231","Info":{"Name":"Stash \u003c 0.26.0 - SQL Injection","Severity":"critical","Description":"Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32231.yaml"}
{"ID":"CVE-2024-32238","Info":{"Name":"H3C ER8300G2-X - Password Disclosure","Severity":"critical","Description":"H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32238.yaml"}
{"ID":"CVE-2024-3234","Info":{"Name":"Chuanhu Chat - Directory Traversal","Severity":"critical","Description":"The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-3234.yaml"}
{"ID":"CVE-2024-32399","Info":{"Name":"RaidenMAILD Mail Server v.4.9.4 - Path Traversal","Severity":"high","Description":"Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32399.yaml"}
@@ -2917,7 +2970,7 @@
{"ID":"CVE-2024-36401","Info":{"Name":"GeoServer RCE in Evaluating Property Name Expressions","Severity":"critical","Description":"In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36401.yaml"}
{"ID":"CVE-2024-36404","Info":{"Name":"GeoServer and GeoTools - Remote Code Execution","Severity":"critical","Description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36404.yaml"}
{"ID":"CVE-2024-36412","Info":{"Name":"SuiteCRM - SQL Injection","Severity":"critical","Description":"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36412.yaml"}
{"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
{"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
{"ID":"CVE-2024-3656","Info":{"Name":"Keycloak \u003c 24.0.5 - Broken Access Control","Severity":"high","Description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-3656.yaml"}
{"ID":"CVE-2024-36675","Info":{"Name":"LyLme spage v1.9.5 - Server-Side Request Forgery","Severity":"high","Description":"LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36675.yaml"}
{"ID":"CVE-2024-36683","Info":{"Name":"PrestaShop productsalert - SQL Injection","Severity":"critical","Description":"In the module 'Products Alert' (productsalert) up to version 1.7.4 from Smart Modules for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36683.yaml"}
@@ -2931,6 +2984,7 @@
{"ID":"CVE-2024-37393","Info":{"Name":"SecurEnvoy Two Factor Authentication - LDAP Injection","Severity":"critical","Description":"Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37393.yaml"}
{"ID":"CVE-2024-3742","Info":{"Name":"Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure","Severity":"high","Description":"Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-3742.yaml"}
{"ID":"CVE-2024-3753","Info":{"Name":"Hostel \u003c 1.1.5.3 - Cross-Site Scripting","Severity":"medium","Description":"The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2024/CVE-2024-3753.yaml"}
{"ID":"CVE-2024-37728","Info":{"Name":"OfficeWeb365 Indexs Interface - Arbitrary File Read","Severity":"high","Description":"There is any file reading in the officeWeb365 Indexs interface.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-37728.yaml"}
{"ID":"CVE-2024-37843","Info":{"Name":"Craft CMS \u003c=v3.7.31 - SQL Injection","Severity":"critical","Description":"Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-37843.yaml"}
{"ID":"CVE-2024-37881","Info":{"Name":"SiteGuard WP Plugin \u003c= 1.7.6 - Login Page Disclosure","Severity":"medium","Description":"The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37881.yaml"}
{"ID":"CVE-2024-3822","Info":{"Name":"Base64 Encoder/Decoder \u003c= 0.9.2 - Cross-Site Scripting","Severity":"medium","Description":"The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-3822.yaml"}
@@ -2961,8 +3015,10 @@
{"ID":"CVE-2024-41628","Info":{"Name":"Cluster Control CMON API - Directory Traversal","Severity":"high","Description":"Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-41628.yaml"}
{"ID":"CVE-2024-41667","Info":{"Name":"OpenAM\u003c=15.0.3 FreeMarker - Template Injection","Severity":"high","Description":"OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-41667.yaml"}
{"ID":"CVE-2024-41713","Info":{"Name":"Mitel MiCollab - Authentication Bypass","Severity":"high","Description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-41713.yaml"}
{"ID":"CVE-2024-4180","Info":{"Name":"The Events Calendar \u003c 6.4.0.1 - Cross-site Scripting","Severity":"medium","Description":"The Events Calendar WordPress plugin \u003c 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-4180.yaml"}
{"ID":"CVE-2024-41810","Info":{"Name":"Twisted - Open Redirect \u0026 XSS","Severity":"medium","Description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The Twisted web framework's redirectTo function is vulnerable to reflected XSS if an attacker can control the redirect URL. This template tests for an open redirect and XSS vulnerability in the URL parameter. This vulnerability is fixed in 24.7.0rc1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-41810.yaml"}
{"ID":"CVE-2024-41955","Info":{"Name":"Open Redirect in Login Redirect - MobSF","Severity":"medium","Description":"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.\n","Classification":{"CVSSScore":"5.2"}},"file_path":"http/cves/2024/CVE-2024-41955.yaml"}
{"ID":"CVE-2024-42009","Info":{"Name":"Roundcube Webmail - Cross-Site Scripting","Severity":"critical","Description":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-42009.yaml"}
{"ID":"CVE-2024-4257","Info":{"Name":"BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection","Severity":"medium","Description":"A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-4257.yaml"}
{"ID":"CVE-2024-42640","Info":{"Name":"Angular-Base64-Upload - Remote Code Execution","Severity":"critical","Description":"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-42640.yaml"}
{"ID":"CVE-2024-42852","Info":{"Name":"AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting","Severity":"medium","Description":"AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-42852.yaml"}
@@ -3100,9 +3156,10 @@
{"ID":"CVE-2024-6517","Info":{"Name":"Contact Form 7 Math Captcha \u003c= 2.0.1 - Cross-site Scripting","Severity":"medium","Description":"The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-6517.yaml"}
{"ID":"CVE-2024-6586","Info":{"Name":"Lightdash v0.1024.6 - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-6586.yaml"}
{"ID":"CVE-2024-6587","Info":{"Name":"LiteLLM - Server-Side Request Forgery","Severity":"high","Description":"LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6587.yaml"}
{"ID":"CVE-2024-6646","Info":{"Name":"Netgear-WN604 downloadFile.php - Information Disclosure","Severity":"medium","Description":"There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be controlled. The attacker can initiate damage to the wireless network or further threaten it.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6646.yaml"}
{"ID":"CVE-2024-6646","Info":{"Name":"Netgear-WN604 downloadFile.php - Information Disclosure","Severity":"medium","Description":"There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be controlled. The attacker can initiate damage to the wireless network or further threaten it.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6646.yaml"}
{"ID":"CVE-2024-6651","Info":{"Name":"WordPress File Upload Plugin \u003c 4.24.8 - Cross-Site Scripting","Severity":"high","Description":"The WordPress File Upload plugin before version 4.24.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2024/CVE-2024-6651.yaml"}
{"ID":"CVE-2024-6670","Info":{"Name":"WhatsUp Gold HasErrors SQL Injection - Authentication Bypass","Severity":"critical","Description":"In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6670.yaml"}
{"ID":"CVE-2024-6690","Info":{"Name":"WP Content Copy Protection \u0026 No Right Click - Open Redirect","Severity":"medium","Description":"The WP Content Copy Protection \u0026 No Right Click plugin before version 15.3 contains an open-redirect vulnerability via the referrer parameter in no-js.php, allowing redirection of users to external sites.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-6690.yaml"}
{"ID":"CVE-2024-6746","Info":{"Name":"EasySpider 0.6.2 - Arbitrary File Read","Severity":"medium","Description":"A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \\EasySpider\\resources\\app\\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2024/CVE-2024-6746.yaml"}
{"ID":"CVE-2024-6781","Info":{"Name":"Calibre \u003c= 7.14.0 Arbitrary File Read","Severity":"high","Description":"Arbitrary file read via Calibre’s content server in Calibre \u003c= 7.14.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6781.yaml"}
{"ID":"CVE-2024-6782","Info":{"Name":"Calibre \u003c= 7.14.0 Remote Code Execution","Severity":"critical","Description":"Unauthenticated remote code execution via Calibre’s content server in Calibre \u003c= 7.14.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6782.yaml"}
@@ -3115,7 +3172,7 @@
{"ID":"CVE-2024-6911","Info":{"Name":"PerkinElmer ProcessPlus \u003c= 1.11.6507.0 - Local File Inclusion","Severity":"high","Description":"Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2024/CVE-2024-6911.yaml"}
{"ID":"CVE-2024-6922","Info":{"Name":"Automation Anywhere Automation 360 - Server-Side Request Forgery","Severity":"high","Description":"Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6922.yaml"}
{"ID":"CVE-2024-6924","Info":{"Name":"TrueBooker \u003c= 1.0.2 - SQL Injection","Severity":"high","Description":"The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6924.yaml"}
{"ID":"CVE-2024-6926","Info":{"Name":"Viral Signup \u003c= 2.1 - SQL Injection","Severity":"critical","Description":"The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6926.yaml"}
{"ID":"CVE-2024-6926","Info":{"Name":"Viral Signup \u003c= 2.1 - SQL Injection","Severity":"critical","Description":"The Viral Signup limited opt-in with viral referral sharing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6926.yaml"}
{"ID":"CVE-2024-6928","Info":{"Name":"Opti Marketing \u003c= 2.0.9 - SQL Injection","Severity":"high","Description":"The Opti Marketing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-6928.yaml"}
{"ID":"CVE-2024-7008","Info":{"Name":"Calibre \u003c= 7.15.0 - Reflected Cross-Site Scripting (XSS)","Severity":"medium","Description":"It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with authentication enabled and the victim is logged in at the time, this can be used to cause the victim to perform actions on the Calibre server on behalf of the attacker.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-7008.yaml"}
{"ID":"CVE-2024-7029","Info":{"Name":"AVTECH IP Camera - Command Injection","Severity":"high","Description":"The endpoint `/cgi-bin/supervisor/Factory.cgi` is vulnerable to command injection via the `action` parameter, allowing remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-7029.yaml"}
@@ -3180,10 +3237,14 @@
{"ID":"CVE-2025-0674","Info":{"Name":"Elber ESE DVB-S/S2 - Authentication Bypass","Severity":"critical","Description":"Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0674.yaml"}
{"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
{"ID":"CVE-2025-10035","Info":{"Name":"GoAnywhere - Authentication Bypass","Severity":"critical","Description":"Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10035.yaml"}
{"ID":"CVE-2025-1023","Info":{"Name":"ChurchCRM - SQL Injection","Severity":"critical","Description":"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1023.yaml"}
{"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
{"ID":"CVE-2025-1035","Info":{"Name":"KLog Server - Path Traversal","Severity":"medium","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.\n","Classification":{"CVSSScore":"5.7"}},"file_path":"http/cves/2025/CVE-2025-1035.yaml"}
{"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
{"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
{"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
{"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
{"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
{"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
{"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
{"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
@@ -3193,6 +3254,7 @@
{"ID":"CVE-2025-2010","Info":{"Name":"WordPress JobWP Plugin \u003c= 2.3.9 - SQL Injection","Severity":"critical","Description":"The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2010.yaml"}
{"ID":"CVE-2025-2011","Info":{"Name":"Slider \u0026 Popup Builder by Depicter \u003c= 3.6.1 - Unauthenticated SQL Injection","Severity":"high","Description":"The Slider \u0026 Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2011.yaml"}
{"ID":"CVE-2025-20188","Info":{"Name":"Cisco IOS XE WLC - Arbitrary File Upload","Severity":"critical","Description":"A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-20188.yaml"}
{"ID":"CVE-2025-20281","Info":{"Name":"Cisco ISE - Remote Code Execution","Severity":"critical","Description":"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-20281.yaml"}
{"ID":"CVE-2025-20362","Info":{"Name":"Cisco Secure Firewall ASA \u0026 FTD - Authentication Bypass","Severity":"medium","Description":"A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-20362.yaml"}
{"ID":"CVE-2025-2075","Info":{"Name":"Uncanny Automator \u003c= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","Severity":"high","Description":"The Uncanny Automator - Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-2075.yaml"}
{"ID":"CVE-2025-2127","Info":{"Name":"JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS","Severity":"medium","Description":"A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2025/CVE-2025-2127.yaml"}
@@ -3202,11 +3264,14 @@
{"ID":"CVE-2025-22952","Info":{"Name":"Elestio Memos \u003c= v0.24.0 - Server-Side Request Forgery","Severity":"critical","Description":"elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-22952.yaml"}
{"ID":"CVE-2025-23061","Info":{"Name":"Mongoose - NoSQL Injection","Severity":"critical","Description":"NoSQL injection vulnerability in Mongoose \u003c 8.9.5 affecting the populate() function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operators like $and, allowing execution of arbitrary JavaScript code on MongoDB server, bypassing authentication, and accessing sensitive administrative data.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-23061.yaml"}
{"ID":"CVE-2025-24016","Info":{"Name":"Wazuh - Unsafe Deserialization Remote Code Execution","Severity":"critical","Description":"A critical Remote Code Execution (RCE) vulnerability exists in Wazuh server versions \u003e= 4.4.0 and \u003c 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using as_wazuh_object in the framework/wazuh/core/cluster/common.py file. An attacker with API access can exploit this vulnerability by injecting an unsanitized dictionary into DAPI requests, leading to arbitrary Python code execution.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-24016.yaml"}
{"ID":"CVE-2025-24354","Info":{"Name":"Imgproxy \u003c 3.27.2 - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES is set to false, letting local services be exposed, exploit requires network access.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-24354.yaml"}
{"ID":"CVE-2025-24514","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-24514.yaml"}
{"ID":"CVE-2025-2473","Info":{"Name":"Company Visitor Management System 1.0 - SQL Injection","Severity":"critical","Description":"Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-2473.yaml"}
{"ID":"CVE-2025-24799","Info":{"Name":"GLPI \u003c 10.0.17 - Pre-Auth SQL Injection","Severity":"critical","Description":"A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-24799.yaml"}
{"ID":"CVE-2025-24813","Info":{"Name":"Apache Tomcat Path Equivalence - Remote Code Execution","Severity":"critical","Description":"Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24813.yaml"}
{"ID":"CVE-2025-24893","Info":{"Name":"XWiki Platform - Remote Code Execution","Severity":"critical","Description":"Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24893.yaml"}
{"ID":"CVE-2025-24963","Info":{"Name":"Vitest Browser Mode - Local File Read","Severity":"medium","Description":"Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host- true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host- true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-24963.yaml"}
{"ID":"CVE-2025-25034","Info":{"Name":"SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection","Severity":"critical","Description":"A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-25034.yaml"}
{"ID":"CVE-2025-25037","Info":{"Name":"Aquatronica Controller System \u003c= 5.1.6 - Information Disclosure","Severity":"high","Description":"Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-25037.yaml"}
{"ID":"CVE-2025-25231","Info":{"Name":"Omnissa Workspace ONE UEM - Path Traversal","Severity":"high","Description":"Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-25231.yaml"}
{"ID":"CVE-2025-25257","Info":{"Name":"Fortinet FortiWeb - SQL Injection","Severity":"critical","Description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25257.yaml"}
@@ -3221,13 +3286,15 @@
{"ID":"CVE-2025-2709","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2709.yaml"}
{"ID":"CVE-2025-2710","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2710.yaml"}
{"ID":"CVE-2025-2711","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2711.yaml"}
{"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 - Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
{"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 - Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
{"ID":"CVE-2025-2712","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2712.yaml"}
{"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
{"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
{"ID":"CVE-2025-27222","Info":{"Name":"TRUfusion Enterprise \u003c= 7.10.4.0 - Path Traversal","Severity":"critical","Description":"Pre-Auth Path Traversal Allowing to Leak Local server files disclosing sensitive clear-text passwords.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27222.yaml"}
{"ID":"CVE-2025-27223","Info":{"Name":"TRUfusion Enterprise \u003c= 7.10.4.0 - Authentication Bypass","Severity":"critical","Description":"Hard-Coded Cryptographic key allowing to forge session cookies that can be used to entirely bypass authentication\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27223.yaml"}
{"ID":"CVE-2025-27225","Info":{"Name":"TRUfusion Enterprise \u003c= 7.10.4.0 - Admin Contact Portal","Severity":"high","Description":"TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII (including partner and contact names).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-27225.yaml"}
{"ID":"CVE-2025-2746","Info":{"Name":"Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)","Severity":"critical","Description":"Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix \u003e= 173 and \u003c 178, this vulnerability can be exploited only if you provide a valid Staging Service username (default: admin)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2746.yaml"}
{"ID":"CVE-2025-2747","Info":{"Name":"Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)","Severity":"critical","Description":"An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2747.yaml"}
{"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
{"ID":"CVE-2025-27505","Info":{"Name":"GeoServer - Missing Authorization on REST API Index","Severity":"medium","Description":"GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27505.yaml"}
{"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
@@ -3254,6 +3321,7 @@
{"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
{"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
{"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
{"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
{"ID":"CVE-2025-32430","Info":{"Name":"XWiki Platform - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform versions \u003e= 4.2-milestone-3 and \u003c 16.4.8, \u003e= 16.5.0-rc-1 and \u003c 16.10.6, and \u003e= 17.0.0-rc-1 and \u003c 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32430.yaml"}
{"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
{"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
@@ -3262,14 +3330,17 @@
{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
{"ID":"CVE-2025-32969","Info":{"Name":"XWiki REST API Query - SQL Injection","Severity":"critical","Description":"A SQL injection vulnerability exists in XWiki's REST API query endpoint. An unauthenticated attacker can execute arbitrary SQL queries through the 'q' parameter by manipulating the HQL query, potentially leading to data exfiltration or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32969.yaml"}
{"ID":"CVE-2025-32970","Info":{"Name":"XWiki WYSIWYG API - Open Redirect","Severity":"medium","Description":"A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-32970.yaml"}
{"ID":"CVE-2025-34023","Info":{"Name":"Karel IP Phone IP1211 Web Management Panel - Local File Inclusion","Severity":"high","Description":"Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34023.yaml"}
{"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
{"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
{"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
{"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
{"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
{"ID":"CVE-2025-34035","Info":{"Name":"EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-34035.yaml"}
{"ID":"CVE-2025-34038","Info":{"Name":"Fanwei e-cology - SQL Injection","Severity":"high","Description":"Fanwei e-cology 8.0 contains a sql injection caused by unsanitized user input in the sql parameter of getdata.jsp, letting unauthenticated attackers execute arbitrary SQL queries and access sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34038.yaml"}
{"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
{"ID":"CVE-2025-34073","Info":{"Name":"Maltrail \u003c=0.54 Username Parameter - Remote Command Execution","Severity":"critical","Description":"Maltrail versions \u003c=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34073.yaml"}
{"ID":"CVE-2025-34045","Info":{"Name":"WeiPHP 5.0 - Path Traversal","Severity":"high","Description":"WeiPHP 5.0 contains a path traversal caused by insufficient input validation of the picUrl parameter in /public/index.php/material/Material/_download_imgage, letting unauthenticated remote attackers read arbitrary files.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-34045.yaml"}
{"ID":"CVE-2025-34073","Info":{"Name":"Maltrail \u003c=0.54 Username Parameter - Remote Command Execution","Severity":"critical","Description":"Maltrail versions \u003c=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34073.yaml"}
{"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
{"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
{"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
@@ -3277,6 +3348,7 @@
{"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
{"ID":"CVE-2025-34152","Info":{"Name":"Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter","Severity":"critical","Description":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34152.yaml"}
{"ID":"CVE-2025-34300","Info":{"Name":"SawtoothSoftware Lighthouse Studio \u003c 9.16.14 - Pre-Auth Remote Code Execution","Severity":"critical","Description":"A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34300.yaml"}
{"ID":"CVE-2025-34509","Info":{"Name":"Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials","Severity":"high","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-34509.yaml"}
{"ID":"CVE-2025-3515","Info":{"Name":"Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload","Severity":"high","Description":"The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-3515.yaml"}
{"ID":"CVE-2025-3605","Info":{"Name":"WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation","Severity":"critical","Description":"Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress (versions \u003c= 1.0.7). An unauthenticated attacker can exploit the AJAX endpoint flr_blocks_user_settings_handle_ajax_callback() to change the administrator's email address. Subsequently, the attacker can use the \"Forgot Password\" feature to reset the administrator's password, thereby gaining unauthorized access to the admin account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3605.yaml"}
{"ID":"CVE-2025-36604","Info":{"Name":"Dell UnityVSA \u003c 5.5 - Remote Command Injection","Severity":"critical","Description":"Dell Unity, version(s) 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-36604.yaml"}
@@ -3284,6 +3356,7 @@
{"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
{"ID":"CVE-2025-40630","Info":{"Name":"IceWarp Mail Server ≤11.4.0 - Open Redirect","Severity":"medium","Description":"IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-40630.yaml"}
{"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
{"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
{"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
{"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
{"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
@@ -3306,6 +3379,7 @@
{"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
{"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
{"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
{"ID":"CVE-2025-48703","Info":{"Name":"CWP (Control Web Panel) \u003c 0.9.8.1205 - Remote Code Execution","Severity":"critical","Description":"CWP (Control Web Panel) \u003c 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the t_total parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-48703.yaml"}
{"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
{"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
{"ID":"CVE-2025-48954","Info":{"Name":"Discourse OAuth Social Login - Cross-site Scripting","Severity":"high","Description":"Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-48954.yaml"}
@@ -3316,49 +3390,71 @@
{"ID":"CVE-2025-49596","Info":{"Name":"MCP Inspector \u003c 0.14.0 UnauthenticatedRemote Code Execution","Severity":"critical","Description":"The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49596.yaml"}
{"ID":"CVE-2025-49825","Info":{"Name":"Teleport - Authentication Bypass","Severity":"critical","Description":"Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-49825.yaml"}
{"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
{"ID":"CVE-2025-51482","Info":{"Name":"Letta Letta 0.7.12 - Remote Code Execution","Severity":"high","Description":"Letta 0.7.12 is vulnerable to remote code execution via POST /v1/tools/run in letta.server.rest_api.routers.v1.tools.run_tool_from_source, allowing attackers to execute arbitrary Python and OS commands via crafted tool source code.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-51482.yaml"}
{"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
{"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
{"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
{"ID":"CVE-2025-52472","Info":{"Name":"XWiki - HQL Injection","Severity":"high","Description":"XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-52472.yaml"}
{"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
{"ID":"CVE-2025-52665","Info":{"Name":"UniFi Access - Broken Access Control","Severity":"critical","Description":"UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-52665.yaml"}
{"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
{"ID":"CVE-2025-53118","Info":{"Name":"Securden Unified PAM - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53118.yaml"}
{"ID":"CVE-2025-53364","Info":{"Name":"Parse Server - GraphQL Schema Information Disclosure","Severity":"medium","Description":"The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53364.yaml"}
{"ID":"CVE-2025-53558","Info":{"Name":"ZTE ZXHN-F660T/F660A - Default Credentials","Severity":"high","Description":"ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53558.yaml"}
{"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 (authentication bypass), enables unauthenticated remote code execution. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
{"ID":"CVE-2025-53771","Info":{"Name":"Microsoft SharePoint Server - Authentication Bypass (ToolShell)","Severity":"medium","Description":"Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-53771.yaml"}
{"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
{"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
{"ID":"CVE-2025-54123","Info":{"Name":"Hoverfly \u003c= 1.11.3 - Remote Code Execution","Severity":"critical","Description":"Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-54123.yaml"}
{"ID":"CVE-2025-54125","Info":{"Name":"XWiki XML View - Sensitive Information Exposure","Severity":"high","Description":"A vulnerability in XWiki's XML view functionality exposes sensitive information such as passwords and email addresses that are stored in custom fields not explicitly named as password or email. This information disclosure occurs when accessing user profiles with the xml.vm template.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-54125.yaml"}
{"ID":"CVE-2025-54236","Info":{"Name":"Adobe Commerce - Authentication Bypass","Severity":"critical","Description":"Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-54236.yaml"}
{"ID":"CVE-2025-54249","Info":{"Name":"Adobe Experience Manager ≤ 6.5.23.0 – SSRF","Severity":"medium","Description":"Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-54249.yaml"}
{"ID":"CVE-2025-54251","Info":{"Name":"Adobe Experience Manager ≤ 6.5.23.0 - XML Injection","Severity":"medium","Description":"Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2025/CVE-2025-54251.yaml"}
{"ID":"CVE-2025-54253","Info":{"Name":"Adobe Experience Manager Forms - Insecure Deserialization","Severity":"critical","Description":"Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-54253.yaml"}
{"ID":"CVE-2025-54589","Info":{"Name":"Copyparty \u003c=1.18.6 - Cross-Site Scripting","Severity":"medium","Description":"Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-54589.yaml"}
{"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
{"ID":"CVE-2025-55161","Info":{"Name":"Stirling-PDF SSRF via Markdown","Severity":"high","Description":"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-55161.yaml"}
{"ID":"CVE-2025-55169","Info":{"Name":"WeGIA - Directory Traversal","Severity":"critical","Description":"WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55169.yaml"}
{"ID":"CVE-2025-55190","Info":{"Name":"ArgoCD Project API Token Repository Credentials Exposure","Severity":"critical","Description":"Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials\n(usernames, passwords) through the project details API endpoint, even when the token only has standard\napplication management permissions and no explicit access to secrets. This vulnerability affects versions\nv2.2.0-rc1 and later, including 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12,\nand 3.1.0-rc1 through 3.1.1. Any token with project get permissions is vulnerable, including global permissions.\nNote: This template requires valid ArgoCD credentials (username/password) to test the vulnerability.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-55190.yaml"}
{"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
{"ID":"CVE-2025-55747","Info":{"Name":"XWiki Platform - Information Disclosure","Severity":"high","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-55747.yaml"}
{"ID":"CVE-2025-55748","Info":{"Name":"XWiki Platform - Path Traversal","Severity":"high","Description":"XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55748.yaml"}
{"ID":"CVE-2025-5605","Info":{"Name":"WSO2 Management Console - Authentication Bypass","Severity":"medium","Description":"An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5605.yaml"}
{"ID":"CVE-2025-5701","Info":{"Name":"HyperComments \u003c= 1.2.2 - Arbitrary Options Update","Severity":"critical","Description":"The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5701.yaml"}
{"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
{"ID":"CVE-2025-57788","Info":{"Name":"Commvault Unauthenticated Password Disclosure (WT-2025-0047)","Severity":"medium","Description":"An issue was discovered in Commvault before 11.36.60. A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-57788.yaml"}
{"ID":"CVE-2025-57789","Info":{"Name":"Commvault Initial Administrator Login Process Vulnerability","Severity":"medium","Description":"An issue was discovered in Commvault before 11.36.60.During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-57789.yaml"}
{"ID":"CVE-2025-57808","Info":{"Name":"ESPHome - Authentication Bypass","Severity":"high","Description":"ESPHome 2025.8.0 contains an authentication bypass caused by improper validation of base64-encoded Authorization values in the web_server component, letting attackers access functionality without valid credentials, exploit requires crafted Authorization header.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-57808.yaml"}
{"ID":"CVE-2025-57819","Info":{"Name":"FreePBX - Remote Code Execution","Severity":"critical","Description":"FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-57819.yaml"}
{"ID":"CVE-2025-57822","Info":{"Name":"Next.js Middleware - Server-Side Request Forgery","Severity":"medium","Description":"In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-57822.yaml"}
{"ID":"CVE-2025-58179","Info":{"Name":"Astro Cloudflare Adapter - Server Side Request Forgery","Severity":"high","Description":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-58179.yaml"}
{"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
{"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
{"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
{"ID":"CVE-2025-59049","Info":{"Name":"Mockoon \u003c 9.2.0 - Path Traversal","Severity":"high","Description":"Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-59049.yaml"}
{"ID":"CVE-2025-59287","Info":{"Name":"Windows Server Update Service - Insecure Deserialization","Severity":"critical","Description":"Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-59287.yaml"}
{"ID":"CVE-2025-59474","Info":{"Name":"Jenkins Sidepanel - Unauthorized Agent/Queue Exposure","Severity":"medium","Description":"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-59474.yaml"}
{"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
{"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
{"ID":"CVE-2025-61666","Info":{"Name":"Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion","Severity":"high","Description":"Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61666.yaml"}
{"ID":"CVE-2025-6174","Info":{"Name":"WordPress Qwizcards \u003c 3.95 - Cross-Site Scripting (Reflected)","Severity":"medium","Description":"The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the \"theme_stylesheet\" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-6174.yaml"}
{"ID":"CVE-2025-61882","Info":{"Name":"Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution","Severity":"critical","Description":"Oracle Concurrent Processing 12.2.3-12.2.14 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61882.yaml"}
{"ID":"CVE-2025-61884","Info":{"Name":"Oracle E-Business Suite - Server-Side Request Forgery","Severity":"high","Description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-61884.yaml"}
{"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
{"ID":"CVE-2025-6204","Info":{"Name":"DELMIA Apriso - Command Injection","Severity":"critical","Description":"An Improper Control of Generation of Code (code injection / file upload → RCE) vulnerability affecting DELMIA Apriso (Release 2020 → Release 2025). When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place executable artifacts into web-served locations (via path traversal or insufficient normalization) and achieve remote code execution under the webserver context.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-6204.yaml"}
{"ID":"CVE-2025-6205","Info":{"Name":"DELMIA Apriso - Broken Access Control","Severity":"high","Description":"DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-6205.yaml"}
{"ID":"CVE-2025-6403","Info":{"Name":"Code-Projects School Fees Payment System 1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6403.yaml"}
{"ID":"CVE-2025-64095","Info":{"Name":"DNN - Unrestricted Arbitrary File Upload","Severity":"critical","Description":"DNN (formerly DotNetNuke) \\u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64095.yaml"}
{"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
{"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
{"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
{"ID":"CVE-2025-7160","Info":{"Name":"Zoo Management System 1.0 - SQL Injection","Severity":"critical","Description":"Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-7160.yaml"}
{"ID":"CVE-2025-8085","Info":{"Name":"Ditty \u003c 3.1.58 - Server-Side Request Forgery","Severity":"high","Description":"The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-8085.yaml"}
{"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
{"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
{"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
{"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
{"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
{"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
{"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
@@ -3382,7 +3478,7 @@
{"ID":"CVE-2015-1419","Info":{"Name":"vsftpd \u003c= 3.0.2 - Access Restriction Bypass","Severity":"medium","Description":"vsftpd 3.0.2 and earlier contain a vulnerability that allows remote attackers to bypass access restrictions due to improper parsing of the deny_file configuration directive.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2015/CVE-2015-1419.yaml"}
{"ID":"CVE-2015-3306","Info":{"Name":"ProFTPd - Remote Code Execution","Severity":"critical","Description":"ProFTPD 1.3.5 contains a remote code execution vulnerability via the mod_copy module which allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2015/CVE-2015-3306.yaml"}
{"ID":"CVE-2016-2004","Info":{"Name":"HP Data Protector - Arbitrary Command Execution","Severity":"critical","Description":"HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. This vulnerability exists because of an incomplete fix for CVE-2014-2623.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2016/CVE-2016-2004.yaml"}
{"ID":"CVE-2016-3510","Info":{"Name":"Oracle WebLogic Server Java Object Deserialization - Remote Code Execution","Severity":"critical","Description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2016/CVE-2016-3510.yaml"}
{"ID":"CVE-2016-3510","Info":{"Name":"Oracle WebLogic Server Java Object Deserialization - Remote Code Execution","Severity":"critical","Description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2016/CVE-2016-3510.yaml"}
{"ID":"CVE-2017-3881","Info":{"Name":"Cisco IOS 12.2(55)SE11 - Remote Code Execution","Severity":"critical","Description":"A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-3881.yaml"}
{"ID":"CVE-2017-5645","Info":{"Name":"Apache Log4j Server - Deserialization Command Execution","Severity":"critical","Description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-5645.yaml"}
{"ID":"CVE-2018-2628","Info":{"Name":"Oracle WebLogic Server Deserialization - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2628.yaml"}
@@ -3392,10 +3488,12 @@
{"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
{"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
{"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
{"ID":"CVE-2020-14644","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)","Severity":"critical","Description":"Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-14644.yaml"}
{"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}
{"ID":"CVE-2020-35359","Info":{"Name":"Pure-FTPd 1.0.48 - Denial of Service","Severity":"high","Description":"Pure-FTPd 1.0.48 is vulnerable to Denial of Service via exhaustion of connections due to lack of proper connection limits.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-35359.yaml"}
{"ID":"CVE-2020-9274","Info":{"Name":"Pure-FTPd ≤ 1.0.49 - DoS via Uninitialized Pointer","Severity":"high","Description":"Pure-FTPd versions ≤ 1.0.49 (\u003e= ~0.96) contain a vulnerability in the init_aliases() function within diraliases.c when processing aliases. This leads to access of an uninitialized pointer, which can cause a denial of service (DoS) condition.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-9274.yaml"}
{"ID":"CVE-2020-9365","Info":{"Name":"Pure-FTPd 1.0.24 - Security Vulnerability","Severity":"medium","Description":"Pure-FTPd 1.0.24 contains security vulnerabilities that could allow attackers to exploit the FTP server. This version is known to have various security issues that could lead to unauthorized access or other security implications.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"network/cves/2020/CVE-2020-9365.yaml"}
{"ID":"CVE-2021-27877","Info":{"Name":"Veritas Backup Exec - Broken Authentication","Severity":"high","Description":"An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes- SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"network/cves/2021/CVE-2021-27877.yaml"}
{"ID":"CVE-2021-30047","Info":{"Name":"vsftpd \u003c 3.0.3 - DoS","Severity":"high","Description":"vsftpd before 3.0.3 allows remote attackers to cause a denial of service by sending a crafted FTP command.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2021/CVE-2021-30047.yaml"}
{"ID":"CVE-2021-3122","Info":{"Name":"NCR Command Center Agent 16.3 - Remote Command Execution","Severity":"critical","Description":"CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain \"misconfiguration.\"\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2021/CVE-2021-3122.yaml"}
{"ID":"CVE-2021-40524","Info":{"Name":"Pure-FTPd 1.0.23 \u003c 1.0.50 - Arbitrary File Upload","Severity":"high","Description":"Pure-FTPd versions 1.0.23 through 1.0.49 contain an arbitrary file upload vulnerability due to max_filesize quota issue, allowing large or unbounded file uploads that can cause server hang or resource exhaustion.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2021/CVE-2021-40524.yaml"}
@@ -3406,16 +3504,22 @@
{"ID":"CVE-2022-37932","Info":{"Name":"HP Switch - Authentication Bypass","Severity":"high","Description":"A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions- Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;\n","Classification":{"CVSSScore":"8.8"}},"file_path":"network/cves/2022/CVE-2022-37932.yaml"}
{"ID":"CVE-2023-22629","Info":{"Name":"TitanFTP move-file Function ≤ 1.94.1205 - Path Traversal","Severity":"high","Description":"TitanFTP versions up to 1.94.1205 contain a path traversal vulnerability in the move-file function where the newPath parameter is improperly validated. An authenticated user can upload a file and then move it to any location on the server filesystem, potentially allowing arbitrary file placement and system compromise.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"network/cves/2023/CVE-2023-22629.yaml"}
{"ID":"CVE-2023-33246","Info":{"Name":"RocketMQ \u003c= 5.1.0 - Remote Code Execution","Severity":"critical","Description":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-33246.yaml"}
{"ID":"CVE-2023-37582","Info":{"Name":"Apache RocketMQ - Remote Command Execution","Severity":"critical","Description":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-37582.yaml"}
{"ID":"CVE-2023-48788","Info":{"Name":"Fortinet Forticlient Endpoint Management Server - SQL Injection","Severity":"critical","Description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-48788.yaml"}
{"ID":"CVE-2023-51713","Info":{"Name":"ProFTPD \u003c 1.3.8a - DoS via Out-of-Bounds Read","Severity":"high","Description":"ProFTPD versions before 1.3.8a contain a one-byte out-of-bounds read vulnerability in the make_ftp_cmd function within main.c. This vulnerability can lead to a daemon crash, causing denial of service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2023/CVE-2023-51713.yaml"}
{"ID":"CVE-2024-23108","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"FortiSIEM versions 6.4.0 through 7.1.1 contain an OS command injection vulnerability in the Phoenix Monitor service. The vulnerability exists in the XML parsing of TEST_STORAGE elements where the mount_point field is not properly sanitized before being passed to shell commands, allowing unauthenticated remote code execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2024/CVE-2024-23108.yaml"}
{"ID":"CVE-2024-48208","Info":{"Name":"Pure-FTPd \u003c 1.0.52 - Buffer Overflow","Severity":"high","Description":"Pure-FTPd versions prior to 1.0.52 contain a buffer overflow vulnerability due to an out-of-bounds read in the domlsd() function within the ls.c file. This vulnerability could allow attackers to execute arbitrary code on affected systems.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"network/cves/2024/CVE-2024-48208.yaml"}
{"ID":"CVE-2024-48651","Info":{"Name":"ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql","Severity":"high","Description":"ProFTPD versions through 1.3.8b (before commit cec01cc) contain a vulnerability in the mod_sql module due to improper handling of supplemental groups. This flaw allows authenticated users without explicitly assigned supplemental groups to inherit root group privileges (GID 0), potentially granting unauthorized access to sensitive system resources.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2024/CVE-2024-48651.yaml"}
{"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-8286.yaml"}
{"ID":"CVE-2010-20103","Info":{"Name":"ProFTPd-1.3.3c - Backdoor Command Execution","Severity":"critical","Description":"ProFTPD 1.3.3c contains a command injection backdoor caused by a hidden FTP command trigger in the source tarball, letting remote unauthenticated attackers execute arbitrary shell commands with root privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2010/CVE-2010-20103.yaml"}
{"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
{"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
{"ID":"CVE-2018-0171","Info":{"Name":"Cisco Smart Install - Configuration Download","Severity":"critical","Description":"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2018/CVE-2018-0171.yaml"}
{"ID":"CVE-2019-6443","Info":{"Name":"NTPsec \u003e 1.1.3 - 'ctl_getitem' Out-of-Bounds Read","Severity":"critical","Description":"NTPsec before 1.1.3 contains a stack-based buffer over-read caused by a bug in ctl_getitem in read_sysvars in ntp_control.c in ntpd, letting local or remote attackers read sensitive memory, exploit requires sending crafted control requests.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"javascript/cves/2019/CVE-2019-6443.yaml"}
{"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}
{"ID":"CVE-2020-2883","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-2883.yaml"}
{"ID":"CVE-2020-4429","Info":{"Name":"IBM Data Risk Manager - Hardcoded Credentials","Severity":"critical","Description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID- 180534.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-4429.yaml"}
{"ID":"CVE-2020-7247","Info":{"Name":"OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution","Severity":"critical","Description":"OpenSMTPD versions 6.4.0 - 6.6.1 are susceptible to remote code execution. smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-7247.yaml"}
{"ID":"CVE-2021-35394","Info":{"Name":"RealTek AP Router SDK - Arbitrary Command Injection","Severity":"critical","Description":"The SDK exposes a UDP server that allows remote execution of arbitray commands.","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2021/CVE-2021-35394.yaml"}
{"ID":"CVE-2023-21839","Info":{"Name":"Oracle WebLogic Server - Unauthorized Access","Severity":"high","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2023/CVE-2023-21839.yaml"}
A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.
XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
Loaded 100 of 9993 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
pussycat0x