150963+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that …
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Administrator SQL Injection in Email Log <= 2.63 versions.
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a …
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and …
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case …
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release …
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body …
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core …
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php …
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated …
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) …
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed …
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint …
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest …
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a …
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as …
Free website and port scanning — find vulnerabilities before attackers do.