High
d6cbec61-cbe8-44a6-8cc8-8603393ed6b0
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2023-3869
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease
High
afd9046c-5b6a-411e-8e66-ff1ba60d7f9d
MultiVendorX <= 4.0.25 - Improper Authorization on REST Routes via 'save_settings_permission'
High
CVE-2023-4153
BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
High
a02f4fc4-42ca-4f8e-9c28-bfa69644e7b6
Booking calendar, Appointment Booking System <= 3.2.8 - Multiple Authenticated(Editor+) SQL Injection
Medium
CVE-2023-3998
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease
High
CVE-2023-4916
Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change
High
CVE-2023-4213
Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
Critical
CVE-2023-4488
Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion
Medium
CVE-2023-4271
Photospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
32f2fc21-165c-483f-ab81-48d8f221e4be
Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
32173d38-7f85-4e0c-9b4c-38bee2783d77
Quiz And Survey Master <= 8.1.15 - Cross-Site Request Forgery via 'display_results'
Medium
CVE-2023-4795
Testimonial Slider Shortcode <= 1.1.8 - Authenticated (Contributor+) Cross-Site Scripting Vulnerability via Shortcode
High
CVE-2023-41243
WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'
Medium
CVE-2023-4811
Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting
Medium
CVE-2022-1415
Drools Core Deserialization of Untrusted Data vulnerability
High
CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
Medium
CVE-2023-41336
Prevent injection of invalid entity ids for "autocomplete" fields
Medium
CVE-2023-4620
Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting
Medium
f1efcff5-3af6-4c44-9654-b917523419aa
WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure
High
CVE-2023-4827
File Manager Pro – Filester - <= 1.7.6 - Cross-Site Request Forgery to Arbitrary File Rename
Medium
CVE-2023-4887
Google Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2023-4840
MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2023-5203
WP Sessions Time Monitoring Full Automatic <= 1.0.8 - Unauthenticated SQL injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.