Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| PHPOK | CVE-2022-51023 PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through… |
8,8 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kavita | CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to… |
8,7 | 0,61 % | Brak wpisu w KEV nie wyklucza ataków | |
| WAPPLES | CVE-2022-51025 Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like… |
7,1 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPML Multilingual CMS | CVE-2023-54413 WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an… |
5,1 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| Readymade Unilevel Ecommerce MLM | CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or… |
8,8 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Sickbeard | CVE-2020-37284 Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming… |
5,1 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| E-cology | CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive… |
8,7 | 0,74 % | Brak wpisu w KEV nie wyklucza ataków | |
| FineReport | CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a… |
9,3 | 2,03 % | Brak wpisu w KEV nie wyklucza ataków | |
| JeeWMS | CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor,… |
8,7 | 0,56 % | Brak wpisu w KEV nie wyklucza ataków | |
| DedeCMS | CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary… |
9,3 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| BSCW Server | CVE-2021-48017 OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as… |
8,7 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| NotificationX | CVE-2022-51021 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted… |
8,8 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| Ad Widget | CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in… |
7,7 | 0,93 % | Brak wpisu w KEV nie wyklucza ataków | |
| Discourse | CVE-2017-20290 Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb… |
5,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Group-Office | CVE-2018-25438 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'… |
8,7 | 0,54 % | Brak wpisu w KEV nie wyklucza ataków | |
| MetInfo | CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like… |
8,7 | 0,47 % | Brak wpisu w KEV nie wyklucza ataków | |
| SeaCMS | CVE-2019-25778 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted… |
8,8 | 0,46 % | Brak wpisu w KEV nie wyklucza ataków | |
| Diarise | CVE-2019-25779 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like… |
8,7 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| QCubed | CVE-2017-20288 QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values… |
5,1 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| Javo Spot | CVE-2017-20287 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to… |
8,7 | 0,7 % | Brak wpisu w KEV nie wyklucza ataków | |
| webpack-dev-server | CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the… |
8,2 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| webpack-dev-server | CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value… |
5,3 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| OpenVPN 3 Core Library | CVE-2026-106017 Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions. |
6,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| WatchGuard Agent | CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left… |
6,9 | 0,06 % | Brak wpisu w KEV nie wyklucza ataków | |
| Extensions for Leaflet Map | CVE-2026-114703 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0. |
6,5 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 07:02 UTC – 15.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.