Fast, deterministic intelligence across 396,747 official Common Vulnerabilities and Exposures (CVEs) with CVSS v3.1 vector breakdowns, threat severity scores, and verified remediation links.
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions....
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions....
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions....
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions....
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124....
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions....
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions....
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions....
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects ...
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions....
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions....
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerabil...
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The att...
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security token...
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to...
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints....