Export limit exceeded: 10003 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2023-25701

WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation

Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Watchtowerhq Wordpress
Products
Watchtower Wordpress
CVE-2025-13972

WatchTowerHQ <= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter

The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Watchtowerhq Wordpress
Products
Watchtower Wordpress
CVE-2024-9933

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'watchtower_ota_token' default value is empty, and the not empty check is missing in the 'Password_Less_Access::login' function. This makes it possible for unauthenticated attackers to log in to the WatchTowerHQ client administrator user.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Watchtowerhq
Products
Watchtower
CVE-2022-44584

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Watchtowerhq
Products
Watchtower
CVE-2022-44583

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability

Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Watchtowerhq
Products
Watchtower