Export limit exceeded: 425471 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425471 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425471 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-51104 | 1 Artifex | 1 Mupdf | 2026-06-17 | 7.5 High |
| A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span equals zero. | ||||
| CVE-2023-51101 | 1 Tenda | 2 W9, W9 Firmware | 2026-06-17 | 9.8 Critical |
| Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo. | ||||
| CVE-2023-50729 | 1 Traccar | 1 Traccar | 2026-06-17 | 8.5 High |
| Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability. | ||||
| CVE-2023-50706 | 1 Efacec | 2 Uc 500e, Uc 500e Firmware | 2026-06-17 | 4.1 Medium |
| A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens. | ||||
| CVE-2023-50424 | 1 Sap | 1 Cloud-security-client-go | 2026-06-17 | 9.1 Critical |
| SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. | ||||
| CVE-2023-50422 | 1 Sap | 1 Cloud-security-services-integration-library | 2026-06-17 | 9.1 Critical |
| SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. | ||||
| CVE-2023-4971 | 1 Weavertheme | 1 Weaver Xtreme Theme Support | 2026-06-17 | 7.2 High |
| The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog. | ||||
| CVE-2023-4861 | 1 Ninjateam | 1 Filester | 2026-06-17 | 7.2 High |
| The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution. | ||||
| CVE-2023-4776 | 1 Igexsolutions | 1 Wpschoolpress | 2026-06-17 | 8.8 High |
| The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers. | ||||
| CVE-2023-4528 | 1 Redwood | 1 Jscape Mft | 2026-06-17 | 7.2 High |
| Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface | ||||
| CVE-2023-4490 | 1 Wpjobportal | 1 Wp Job Portal | 2026-06-17 | 9.8 Critical |
| The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users | ||||
| CVE-2023-4376 | 1 Nikolov | 1 Serial Codes Generator And Validator With Woocommerce Support | 2026-06-17 | 4.8 Medium |
| The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-4298 | 1 123.chat | 1 123.chat | 2026-06-17 | 4.8 Medium |
| The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-4277 | 1 Pragmaticmates | 1 Realia | 2026-06-17 | 8.8 High |
| The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to change user email via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2023-4209 | 1 Poeditor | 1 Poeditor | 2026-06-17 | 4.3 Medium |
| The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks. | ||||
| CVE-2023-4150 | 1 Mooveagency | 1 User Activity Tracking And Log | 2026-06-17 | 4.3 Medium |
| The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks | ||||
| CVE-2023-4040 | 1 Webtoffee | 1 Stripe Payment Plugin For Woocommerce | 2026-06-17 | 5.3 Medium |
| The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders. | ||||
| CVE-2023-4006 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-06-17 | 9.8 Critical |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. | ||||
| CVE-2023-4005 | 1 Fossbilling | 1 Fossbilling | 2026-06-17 | 9.8 Critical |
| Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. | ||||
| CVE-2023-49085 | 1 Cacti | 1 Cacti | 2026-06-17 | 8.8 High |
| Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist. | ||||