{"ID":"CVE-2017-1000029","Info":{"Name":"Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion","Severity":"high","Description":"Oracle GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-1000029.yaml"}
{"ID":"CVE-2017-1000163","Info":{"Name":"Phoenix Framework - Open Redirect","Severity":"medium","Description":"Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-1000163.yaml"}
{"ID":"CVE-2017-1000170","Info":{"Name":"WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion","Severity":"high","Description":"WordPress Delightful Downloads Jquery File Tree versions 2.1.5 and older are susceptible to local file inclusion vulnerabilities via jqueryFileTree.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-1000170.yaml"}
{"ID":"CVE-2017-1000226","Info":{"Name":"Stop User Enumeration \u003c= 1.3.8 - REST API User Enumeration Bypass","Severity":"medium","Description":"Stop User Enumeration 1.3.8 contains a user enumeration vulnerability via the REST API, letting attackers identify valid users, exploit requires sending specific API requests.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2017/CVE-2017-1000226.yaml"}
{"ID":"CVE-2017-1000486","Info":{"Name":"Primetek Primefaces 5.x - Remote Code Execution","Severity":"critical","Description":"Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-1000486.yaml"}
{"ID":"CVE-2017-10075","Info":{"Name":"Oracle Content Server - Cross-Site Scripting","Severity":"high","Description":"Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2017/CVE-2017-10075.yaml"}
{"ID":"CVE-2017-10271","Info":{"Name":"Oracle WebLogic Server - Remote Command Execution","Severity":"high","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-10271.yaml"}
@@ -1375,6 +1376,7 @@
{"ID":"CVE-2021-24342","Info":{"Name":"WordPress JNews Theme \u003c8.0.6 - Cross-Site Scripting","Severity":"medium","Description":"WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*).","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24342.yaml"}
{"ID":"CVE-2021-24347","Info":{"Name":"WordPress SP Project \u0026 Document Manager \u003c4.22 - Authenticated Shell Upload","Severity":"high","Description":"WordPress SP Project \u0026 Document Manager plugin before 4.22 is susceptible to authenticated shell upload. The plugin allows users to upload files; however, the plugin attempts to prevent PHP and other similar executable files from being uploaded via checking the file extension. PHP files can still be uploaded by changing the file extension's case, for example, from php to pHP.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2021/CVE-2021-24347.yaml"}
{"ID":"CVE-2021-24351","Info":{"Name":"WordPress The Plus Addons for Elementor \u003c4.1.12 - Cross-Site Scripting","Severity":"medium","Description":"WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplus_more_post AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24351.yaml"}
{"ID":"CVE-2021-24353","Info":{"Name":"Simple 301 Redirects by BetterLinks \u003c= 2.0.3 - Unauthenticated Arbitrary Redirect Import","Severity":"high","Description":"The Simple 301 Redirects by BetterLinks plugin for WordPress before 2.0.4 registers its import_data() handler on admin_init with no capability check. In versions 2.0.0 - 2.0.2 the import block also has no nonce check, so an unauthenticated attacker can import an arbitrary set of 301 redirects by POSTing a JSON file to admin-post.php, pointing any path on the site to an attacker-controlled destination (phishing, malware distribution, SEO abuse). 2.0.3 added a nonce check (partial fix) and 2.0.4 added the capability check (full fix). This template proves impact by importing a redirect with no authentication and then confirming the source path now returns a 301 to the injected destination.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2021/CVE-2021-24353.yaml"}
{"ID":"CVE-2021-24358","Info":{"Name":"Plus Addons for Elementor Page Builder \u003c 4.1.10 - Open Redirect","Severity":"medium","Description":"WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24358.yaml"}
{"ID":"CVE-2021-24364","Info":{"Name":"WordPress Jannah Theme \u003c5.4.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-24364.yaml"}
{"ID":"CVE-2021-24370","Info":{"Name":"WordPress Fancy Product Designer \u003c4.6.9 - Arbitrary File Upload","Severity":"critical","Description":"WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-24370.yaml"}
@@ -3553,6 +3555,7 @@
{"ID":"CVE-2025-10897","Info":{"Name":"WooCommerce Designer Pro \u003c= 1.9.28 - Arbitrary File Read","Severity":"high","Description":"WooCommerce Designer Pro theme for WordPress \u003c= 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-10897.yaml"}
{"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
{"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
{"ID":"CVE-2025-11201","Info":{"Name":"MLflow Tracking Server - Unauthenticated Model Source Path Traversal RCE","Severity":"critical","Description":"MLflow Tracking Server is vulnerable to an unauthenticated path traversal in the model-version creation API. The server validates the `source` parameter and rejects relative/local paths, but skips that validation entirely when the request carries the `mlflow.prompt.is_prompt` tag (the request is then treated as a prompt). An unauthenticated attacker can supply an arbitrary traversal path as the model version `source`, writing attacker-controlled files to arbitrary locations on the server filesystem and achieving remote code execution under the service account. The fix adds an opt-in MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX allowlist; with the default (unset) configuration the bypass remains exploitable even on 2.22.4.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11201.yaml"}
{"ID":"CVE-2025-11307","Info":{"Name":"WP Google Maps \u003c 9.0.48 - Cross-Site Scripting","Severity":"high","Description":"WP Google Maps WordPress plugin \u003c 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-11307.yaml"}
{"ID":"CVE-2025-11368","Info":{"Name":"LearnPress \u003c 4.3.0 - Arbitrary Callback Execution to Information Exposure","Severity":"medium","Description":"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-11368.yaml"}
{"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
@@ -4021,6 +4024,7 @@
{"ID":"CVE-2026-123270","Info":{"Name":"Redpanda Connect Streams API - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Redpanda Connect 4.39.0 through 4.110.0 exposes an unauthenticated streams management API by default; an attacker can register and trigger a stream containing a command processor.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-123270.yaml"}
{"ID":"CVE-2026-123488","Info":{"Name":"Craft CMS \u003c 4.18.9, \u003c 5.11.2 - Unauthenticated SQL Injection","Severity":"critical","Description":"Craft CMS \u003c 4.18.9, \u003c 5.11.2 contain an unauthenticated SQL injection caused by unsanitized concatenation of the attribute parameter in the element search endpoint, letting remote attackers read and write the database to gain administrator access, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-123488.yaml"}
{"ID":"CVE-2026-12394","Info":{"Name":"WordPress MemberGlut \u003c 1.1.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"MemberGlut WordPress plugin \u003c 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-12394.yaml"}
{"ID":"CVE-2026-125357","Info":{"Name":"Munin munin-httpd 2.99.1-2.999.18 - Unauthenticated Path Traversal","Severity":"medium","Description":"Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal caused by improper '/../' substring check in static file handler Munin::Master::HTML::handle_request, letting unauthenticated attackers read files outside the static directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-125357.yaml"}
{"ID":"CVE-2026-12583","Info":{"Name":"Newsletters \u003c 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field","Severity":"high","Description":"The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-12583.yaml"}
{"ID":"CVE-2026-12592","Info":{"Name":"SlimStat Analytics \u003c 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header","Severity":"high","Description":"SlimStat Analytics WordPress plugin \u003c 5.5.0 contains a stored XSS caused by unescaped visitor-controlled geolocation value in admin analytics reports, letting unauthenticated visitors execute scripts in admin browsers, exploit requires Cloudflare geolocation provider configuration.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12592.yaml"}
{"ID":"CVE-2026-12609","Info":{"Name":"Eclipse Theia - Unauthenticated Path Traversal","Severity":"high","Description":"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12609.yaml"}
The TYPO3 Caddy shopping-cart extension (not the Caddy web server) before 7.2.10 contains a reflected cross-site scripting vulnerability caused by insufficient sanitization of the paymillToken HTTP POST parameter in Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php. An unauthenticated attacker can inject arbitrary HTML and JavaScript that is returned in the HTTP response and executed in a victim's browser. NVD lists affected releases from 2.1.4 through 7.2.7. The issue was fixed in 7.2.10 (TYPO3 Forge #79325).
impact:|
An attacker can execute arbitrary JavaScript in a victim's browser, which may lead to session hijacking, credential theft, or defacement of the affected site.
remediation:|
Upgrade the TYPO3 Caddy extension to version 7.2.10 or later.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
ghost