Średnia
CVE-2025-14073
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 8 950
Wyczyść filtry
Średnia
CVE-2026-10782
RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action
Średnia
CVE-2026-18059
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
Średnia
CVE-2026-17605
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
Wysoka
CVE-2026-15052
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
Średnia
CVE-2026-15951
Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Średnia
CVE-2026-16087
Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Średnia
CVE-2026-11995
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
Średnia
CVE-2026-13458
GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes
Średnia
CVE-2026-16090
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
Średnia
CVE-2026-16091
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
Wysoka
CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
Średnia
CVE-2026-2916
Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script
Krytyczna
CVE-2026-3141
FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
Średnia
CVE-2026-15403
Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
Średnia
CVE-2026-7623
SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
Wysoka
CVE-2026-15006
Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
Średnia
CVE-2026-13362
SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta
Średnia
CVE-2026-61970
Auto Featured Image (Auto Post Thumbnail) <= 5.0.4 - Authenticated (Contributor+) Server-Side Request Forgery
Wysoka
CVE-2026-66702
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting
Wysoka
CVE-2026-66690
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting
Średnia
CVE-2026-17567
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
Średnia
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
Niska
CVE-2026-16619
miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.