Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary JavaScript b…Check if you run itEPSS 0.29%May 21, 2026
- Critical9.8The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2.Patch nowKEVEPSS 2.39%May 21, 2026
- Medium5.4Mantis Bug Tracker (MantisBT) is an open source issue tracker.Check if you run itEPSS 0.29%May 20, 2026
- High7.4Yii 2 is a PHP application framework.Check if you run itEPSS 0.50%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScrip…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary Jav…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows authenticated attackers to inject arbitrary JavaSc…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary Java…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitrary Java…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary JavaScript…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitrary JavaS…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows authenticated attackers to inject arbitrary JavaScr…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScrip…Check if you run itEPSS 0.29%May 20, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitrary Java…Check if you run itEPSS 0.29%May 20, 2026
- High8.7Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering c…Check if you run itEPSS 0.76%May 20, 2026
- Medium4.3The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in…Check if you run itEPSS 0.20%May 20, 2026
- High8.8The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter.Check if you run itEPSS 0.82%May 20, 2026
- Critical9.8The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOS…Check if you run itEPSS 0.76%May 20, 2026
- Medium6.1The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1.0.Check if you run itEPSS 0.29%May 20, 2026
- Medium6.1The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficie…Check if you run itEPSS 0.36%May 20, 2026
- Medium6.1The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97…Check if you run itEPSS 0.36%May 20, 2026
- Medium4.9The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7.Check if you run itEPSS 0.58%May 20, 2026
- Critical9.8The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0.Check if you run itEPSS 1.35%May 20, 2026
- Medium4.3The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7.Check if you run itEPSS 0.22%May 20, 2026
- Medium6.5The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and inc…Check if you run itEPSS 0.61%May 20, 2026