Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,872

Export CSV
CVE-2022-1811

Unrestricted Upload of File with Dangerous Type in publify/publify

Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Publify Project
Products
Publify
CVE-2022-1752

Unrestricted Upload of File with Dangerous Type in polonel/trudesk

Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.

CVSS 3.1 · 8.0 High EPSS 1.9% KEV · Not listed
Vendors
Trudesk Project
Products
Trudesk
CVE-2022-1411

Unrestructed file upload in yetiforcecompany/yetiforcecrm

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yetiforce
Products
Yetiforce Customer Relationship Management
CVE-2022-1409

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Vikwp
Products
Hotel Booking Engine \& Pms
CVE-2022-1345

Stored XSS viva .svg file upload in causefx/organizr

Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed
Vendors
Organizr
Products
Organizr
CVE-2022-1273

Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Importwp
Products
Import Wp
CVE-2022-1103

Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload

The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE

CVSS 3.1 · 8.8 High EPSS 15.6% KEV · Not listed
Vendors
Advanced Uploader Project
Products
Advanced Uploader
CVE-2022-1045

Stored XSS viva .svg file upload in polonel/trudesk

Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.

CVSS 3.1 · 5.4 Medium EPSS 1.6% KEV · Not listed
Vendors
Trudesk Project
Products
Trudesk
CVE-2022-1034

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Craterapp
Products
Crater
CVE-2022-1008

One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Ocdi
Products
One Click Demo Import
CVE-2022-0962

Stored XSS viva .webma file upload in star7th/showdoc

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0960

Stored XSS viva .properties file upload in star7th/showdoc

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0951

File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0950

Unrestricted Upload of File with Dangerous Type in star7th/showdoc

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0945

Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc

Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Showdoc
Products
Showdoc
CVE-2022-0930

File upload filter bypass leading to stored XSS in microweber/microweber

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0921

Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 6.7 Medium EPSS 2.2% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0912

Unrestricted Upload of File with Dangerous Type in microweber/microweber

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-0863

WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.

CVSS 3.1 · 7.2 High EPSS 23.8% KEV · Not listed
Vendors
Wp Svg Icons Project
Products
Wp Svg Icons