Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.3Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.81%May 11, 2026
- Unknowngetflightpath flightpath Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 62.57%May 11, 2026
- Medium5.1WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin setti…Check if you run itEPSS 0.19%May 10, 2026
- Medium5.1WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by explo…Check if you run itEPSS 0.21%May 10, 2026
- Medium5.1WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating…Check if you run itEPSS 0.20%May 10, 2026
- Medium6.9WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insu…Check if you run itEPSS 0.15%May 10, 2026
- Medium5.3WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting ma…Check if you run itEPSS 0.13%May 10, 2026
- Medium6.9WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating…Check if you run itEPSS 0.39%May 10, 2026
- High8.7Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the i…Check if you run itEPSS 0.35%May 10, 2026
- Medium5.1Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.Check if you run itEPSS 0.30%May 10, 2026
- Medium5.1Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject…Check if you run itEPSS 0.19%May 10, 2026
- Medium5.1Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in t…Check if you run itEPSS 0.20%May 10, 2026
- High8.7TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files…Check if you run itEPSS 0.62%May 10, 2026
- Critical9.3WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious…Check if you run itEPSS 0.40%May 10, 2026
- High8.7Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system command…Check if you run itEPSS 0.64%May 10, 2026
- High8.7ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP…Check if you run itEPSS 0.57%May 10, 2026
- High8.7e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uplo…Check if you run itEPSS 0.59%May 10, 2026
- Critical9.3OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disg…Check if you run itEPSS 0.66%May 10, 2026
- Critical9.3WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to…Check if you run itEPSS 0.59%May 10, 2026
- Medium5.1Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter.Check if you run itEPSS 0.28%May 10, 2026
- Low2.1A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0.Check if you run itEPSS 0.32%May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data str…Check if you run itEPSS 0.63%May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstrin…Check if you run itEPSS 0.60%May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a sign…Check if you run itEPSS 0.84%May 10, 2026
- Low2.9In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding proces…Check if you run itEPSS 1.05%May 10, 2026