Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (72449 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-54679 2 Vertim, Wordpress 2 Neon Channel Product Customizer Free, Wordpress 2025-08-16 7.5 High
Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Neon Channel Product Customizer Free: from n/a through 2.0.
CVE-2025-24766 2 Wordpress, Wp-royal-themes 2 Wordpress, News Magazine X 2025-08-16 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Royal Themes News Magazine X allows PHP Local File Inclusion. This issue affects News Magazine X: from n/a through 1.2.37.
CVE-2025-30635 2 Themeatelier, Wordpress 2 Idonate, Wordpress 2025-08-16 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro allows PHP Local File Inclusion. This issue affects IDonatePro: from n/a through 2.1.9.
CVE-2025-30639 2 Themeatelier, Wordpress 2 Idonate, Wordpress 2025-08-16 7.5 High
Missing Authorization vulnerability in ThemeAtelier IDonatePro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects IDonatePro: from n/a through 2.1.9.
CVE-2025-52775 2 Ronik Unlimitedwp, Wordpress 2 Project Cost Calculator, Wordpress 2025-08-16 7.1 High
Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Project Cost Calculator: from n/a through 1.0.0.
CVE-2025-49038 2 Soflyy, Wordpress 2 Wp Dynamic Links, Wordpress 2025-08-16 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links allows Reflected XSS. This issue affects WP Dynamic Links: from n/a through 1.0.1.
CVE-2025-49267 2 Dynamiapps, Wordpress 2 Frontend Admin, Wordpress 2025-08-16 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps allows Blind SQL Injection. This issue affects Frontend Admin by DynamiApps: from n/a through 3.28.3.
CVE-2025-28999 3 Woocommerce, Wordpress, Zoomit 3 Woocommerce, Wordpress, Woocommerce Shop Page Builder 2025-08-16 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
CVE-2025-54697 2 Kadencewp, Wordpress 2 Kadence Woocommerce Email Designer, Wordpress 2025-08-16 7.2 High
Incorrect Privilege Assignment vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Privilege Escalation. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.16.
CVE-2025-30998 2 Rico Macchi, Wordpress 2 Wp Links Page, Wordpress 2025-08-16 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rico Macchi WP Links Page allows SQL Injection. This issue affects WP Links Page: from n/a through 4.9.6.
CVE-2025-48862 1 Bosch 1 Ctrlx Os 2025-08-16 7.1 High
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
CVE-2025-52820 3 Infosoftplugin, Woocommerce, Wordpress 3 Woocommerce Point Of Sale, Woocommerce, Wordpress 2025-08-16 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) allows SQL Injection. This issue affects WooCommerce Point Of Sale (POS): from n/a through 1.4.
CVE-2025-52731 2 Themefunction, Wordpress 2 Wordpress Event Manager Event Calendar And Booking Plugin, Wordpress 2025-08-16 7.5 High
Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through 4.0.24.
CVE-2025-48860 1 Bosch 1 Ctrlx Os 2025-08-16 8 High
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.
CVE-2025-52728 2 Webcodingplace, Wordpress 2 Responsive Posts Carousel Plugin, Wordpress 2025-08-16 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel WordPress Plugin allows PHP Local File Inclusion. This issue affects Responsive Posts Carousel WordPress Plugin: from n/a through 15.0.
CVE-2025-30626 3 Lambertgroup, Wordpress, Wpbakery 4 Multimedia Playlist Slider Addon For Wpbakery Page Builder, Wordpress, Page Builder and 1 more 2025-08-16 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through 2.1.
CVE-2025-49264 1 Wordpress 2 Cloud Saml Sso, Wordpress 2025-08-16 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login allows PHP Local File Inclusion. This issue affects Cloud SAML SSO - Single Sign On Login: from n/a through 1.0.18.
CVE-2025-28975 2 Redqteam, Wordpress 2 Alike Wordpress Custom Post Comparison, Wordpress 2025-08-16 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison allows Reflected XSS. This issue affects Alike - WordPress Custom Post Comparison: from n/a through 3.0.1.
CVE-2024-53946 1 Kuwfi 1 Ac900 Router 2025-08-16 8.8 High
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes.
CVE-2024-53945 1 Kuwfi 1 Ac900 Router 2025-08-16 8.8 High
The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges via shell metacharacters in parameters such as pincode and cmds. Exploitation can lead to full system compromise, including enabling remote access (e.g., enabling telnet).