Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script.Check if you run itEPSS 1.88%Aug 8, 2025
- Critical9.3An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6.Check if you run itEPSS 1.67%Aug 8, 2025
- UnknownMicro Focus acutoweb Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.77%Aug 7, 2025
- High8.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters.Check if you run itEPSS 0.30%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.Check if you run itEPSS 0.35%Aug 7, 2025
- Medium6.1Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.Check if you run itEPSS 0.20%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.Check if you run itEPSS 0.35%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissionNumber parametersCheck if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.Check if you run itEPSS 0.30%Aug 7, 2025
- Medium6.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.php.Check if you run itEPSS 0.20%Aug 7, 2025
- Medium6.5Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.Check if you run itEPSS 0.22%Aug 7, 2025
- High8.1A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface.Check this weekEPSS 13.65%Aug 6, 2025
- Medium6.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.Check this weekEPSS 25.00%Aug 6, 2025
- Medium6.5A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend templCheck this weekEPSS 47.00%Aug 6, 2025
- Medium6.0FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF.Check this weekEPSS 31.00%Aug 5, 2025
- Critical10.0The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php.Check if you run itEPSS 1.72%Aug 5, 2025
- Critical10.0The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php.Check if you run itEPSS 1.84%Aug 5, 2025
- Critical10.0PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization.Check if you run itEPSS 2.10%Aug 5, 2025