13351+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation …
Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user …
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In …
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a …
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management …
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead …
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers …
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log …
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the …
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary …
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller …
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and …
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated …
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as …
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating …
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST …
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, …
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and …
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, …
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential …
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. …
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen …
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN …
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
Free website and port scanning — find vulnerabilities before attackers do.