CVE-database
132.662 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-96573 HIGH · 7.2 The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar…
- CVE-2026-96268 MEDIUM · 6.4 The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions…
- CVE-2026-95687 HIGH · 8.8 The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and…
- CVE-2026-92244 HIGH · 7.2 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name /…
- CVE-2026-90992 MEDIUM · 6.4 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to,…
- CVE-2026-89427 MEDIUM · 6.1 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions…
- CVE-2026-89424 MEDIUM · 6.4 The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due…
- CVE-2026-85235 HIGH · 7.2 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field…
- CVE-2026-15983 HIGH · 8.1 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including,…
- CVE-2026-14995 HIGH · 7.2 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient…
- CVE-2026-103664 NONE MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL,…
- CVE-2026-103662 NONE MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The affected forms echoed…
- CVE-2026-103659 NONE MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the…
- CVE-2026-103656 NONE Rejected reason: this is rejected
- CVE-2026-103655 NONE MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its…
- CVE-2026-103431 HIGH · 7.7 colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local…
- CVE-2026-101925 MEDIUM · 6.4 The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter…
- CVE-2026-100184 MEDIUM · 4.7 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based…
- CVE-2026-100179 MEDIUM · 6.1 The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based…
- CVE-2026-93882 HIGH · 7.5 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up…
- CVE-2026-89047 MEDIUM · 6.1 De plug-in Social Media Share Buttons & Social Sharing Icons voor WordPress is kwetsbaar voor Reflected Cross-Site Scripting via URL in alle versies tot en…
- CVE-2026-78249 NONE Er bestaat een path traversal-kwetsbaarheid in de webbeheerinterface van diverse multifunctionele apparaten en printers, waaronder Apeos C4571 1.1.3 en eerdere versies, Apeos C3567 1.1.3 en…
- CVE-2026-75957 CRITICAL · 9.8 The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…
- CVE-2026-19902 MEDIUM · 6.1 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions…
- CVE-2026-19807 HIGH · 8.8 The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This…
- CVE-2026-15989 CRITICAL · 9.8 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316.…
- CVE-2026-103651 NONE MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token…
- CVE-2026-103544 MEDIUM · 6.3 A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al…
- CVE-2025-41753 CRITICAL · 9.8 The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited…
- CVE-2026-96255 HIGH · 7.5 The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the…
- CVE-2026-96200 MEDIUM · 5.3 The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing…
- CVE-2026-96173 MEDIUM · 5.3 De Betalingen voor Hubtel WordPress-plug-in vóór 1.0.2 verifieert niet dat de aanvrager bevoegd is om een bestelling te bekijken voordat een openbare terugbelverzoek wordt omgeleid,…
- CVE-2026-92412 HIGH · 7.1 De WordPress-plug-in Five Star Restaurant Reviews vóór 2.3.14 ontsnapt niet aan een door de gebruiker geleverde waarde voordat deze wordt uitgevoerd in een HTML-tag, waardoor…
- CVE-2026-90974 MEDIUM · 6.5 The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to…
- CVE-2026-90972 MEDIUM · 5.4 De WP Fusion Lite WordPress-plugin voert vóór versie 3.48.0 geen toegangsbewijs uit voor twee van de AJAX-handlers in het beheerderspaneel. Hierdoor kan elke geauthenticeerde abonnee…
- CVE-2026-89296 HIGH · 8.6 The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated…
- CVE-2026-88999 MEDIUM · 4.3 The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin…
- CVE-2026-87973 LOW · 3.1 The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page,…
- CVE-2026-87970 MEDIUM · 4.7 The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served…
- CVE-2026-86610 MEDIUM · 6.4 De Download Manager WordPress-plug-in vóór 3.3.71 ontsmet en ontsnapt niet voldoende aan een pakketinstelling voordat deze weer op een pagina wordt uitgevoerd, waardoor gebruikers met…
- CVE-2026-85679 HIGH · 7.2 The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due…
- CVE-2026-81809 HIGH · 7.5 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and…
- CVE-2026-81739 HIGH · 7.5 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin…
- CVE-2026-80276 HIGH · 7.5 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this…
- CVE-2026-80275 HIGH · 8.8 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated…
- CVE-2026-67075 MEDIUM · 6.5 HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted…
- CVE-2026-19253 HIGH · 8.7 The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine,…
- CVE-2026-103543 MEDIUM · 6.3 A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of…
- CVE-2026-103542 MEDIUM · 4.3 Er is een zwakke plek gevonden in formtools.org Form Tools tot en met 3.1.1. De functie smart_fill van het bestand /global/code/actions.php van de component AJAX…
- CVE-2026-103541 MEDIUM · 6.3 A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax…