Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File InclusCheck this weekEPSS 66.00%Aug 20, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.ThisCheck this weekEPSS 57.00%Aug 20, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp aCheck this weekEPSS 57.00%Aug 20, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptiCheck this weekEPSS 56.00%Aug 20, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PCheck this weekEPSS 57.00%Aug 20, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File ICheck this weekEPSS 66.00%Aug 20, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHPCheck this weekEPSS 57.00%Aug 20, 2025
- High7.5Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects RealtynaCheck this weekEPSS 21.00%Aug 20, 2025
- High7.5The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input inCheck this weekEPSS 39.00%Aug 20, 2025
- High8.8The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function inCheck this weekEPSS 64.00%Aug 20, 2025
- High8.8The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input inCheck this weekEPSS 52.00%Aug 20, 2025
- UnknownWHMpress whmcs Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 3.29%Aug 20, 2025
- Medium6.9A vulnerability was found in itsourcecode Sports Management System 1.0.Check this weekEPSS 44.00%Aug 19, 2025
- Medium6.9A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0.Check this weekEPSS 43.00%Aug 19, 2025
- Medium6.9A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0.Check this weekEPSS 57.00%Aug 19, 2025
- Medium5.3A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0.Check this weekEPSS 47.00%Aug 19, 2025
- Medium6.9A vulnerability was identified in Surbowl dormitory-management-php up to 9f1d9d1f528cabffc66fda3652c56ff327fda317.Check this weekEPSS 34.00%Aug 19, 2025
- Medium5.1A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d.Check this weekEPSS 39.00%Aug 19, 2025
- Medium5.3A vulnerability was identified in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7.Check this weekEPSS 52.00%Aug 19, 2025
- Critical9.8The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispaCheck this weekEPSS 18.03%Aug 19, 2025
- Critical9.8In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison.Check this weekEPSS 55.00%Aug 19, 2025
- Medium5.3EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interfacCheck this weekEPSS 71.00%Aug 19, 2025
- Medium6.1Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.Check this weekEPSS 24.00%Aug 19, 2025
- Critical10.0Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQCheck this weekEPSS 64.00%Aug 19, 2025
- Critical9.8A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution via the path, contentCheck if you run itEPSS 1.21%Aug 19, 2025