Export limit exceeded: 407487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44367 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59547 | 2 Easy Payment, Wordpress | 2 Payment Gateway For Paypal On Woo Commerce, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | ||||
| CVE-2026-65484 | 2 Analogwp, Wordpress | 2 Style Kits, Wordpress | 2026-07-23 | 6.3 Medium |
| Contributor Broken Access Control in Style Kits <= 2.6.5 versions. | ||||
| CVE-2026-56292 | 2 Acymailing, Acymailing.com | 2 Acymailing, Acymailing.com Acymailing Extension For Joomla | 2026-07-23 | 7.5 High |
| Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage. | ||||
| CVE-2026-57830 | 1 Ollyo | 1 Helix Ultimate | 2026-07-23 | 9.1 Critical |
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion. | ||||
| CVE-2026-25424 | 2 Mediavine, Wordpress | 2 Mediavine Control Panel, Wordpress | 2026-07-23 | 4.3 Medium |
| Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. | ||||
| CVE-2026-61950 | 2 Themetechmount, Wordpress | 2 Truebooker, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | ||||
| CVE-2026-65487 | 2 Themegoods, Wordpress | 2 Photography, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | ||||
| CVE-2026-65453 | 2 Motovnet, Wordpress | 2 Ebook Store, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | ||||
| CVE-2026-27355 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | ||||
| CVE-2026-65530 | 2 Templatespare, Wordpress | 2 Templatespare, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. | ||||
| CVE-2026-65007 | 1 Getgrav | 1 Grav | 2026-07-23 | 9.6 Critical |
| The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover. | ||||
| CVE-2026-65476 | 2 Uxper, Wordpress | 2 Civi, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. | ||||
| CVE-2026-43947 | 1 Frangoteam | 1 Fuxa | 2026-07-23 | N/A |
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue. | ||||
| CVE-2026-57703 | 2 Sunshinephotocart, Wordpress | 2 Sunshine Photo Cart, Wordpress | 2026-07-23 | 6.3 Medium |
| Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. | ||||
| CVE-2026-7253 | 1 Ibm | 4 Ibm Watson Speech Services Cartridge, Sterling B2b Integrator, Sterling File Gateway and 1 more | 2026-07-23 | 6 Medium |
| IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | ||||
| CVE-2026-59526 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-65451 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 8.5 High |
| Contributor SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-15761 | 2 Tickera, Wordpress | 2 Tickera – Sell Tickets & Manage Events, Wordpress | 2026-07-23 | 6.5 Medium |
| The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied. | ||||
| CVE-2026-25466 | 2 Wordpress, Wpgmaps | 2 Wordpress, Wp Go Maps | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | ||||
| CVE-2026-56144 | 1 Elastic | 1 Elasticsearch | 2026-07-23 | 5.3 Medium |
| Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly. | ||||