Vulnerabilities (CVE)

Total 301161 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-44107 1 Ivanti 1 Workspace Control 2025-06-12 N/A 8.8 HIGH
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.
CVE-2024-44106 1 Ivanti 1 Workspace Control 2025-06-12 N/A 8.8 HIGH
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
CVE-2024-44105 1 Ivanti 1 Workspace Control 2025-06-12 N/A 8.2 HIGH
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
CVE-2024-44104 1 Ivanti 1 Workspace Control 2025-06-12 N/A 8.8 HIGH
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
CVE-2024-44103 1 Ivanti 1 Workspace Control 2025-06-12 N/A 8.8 HIGH
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
CVE-2025-44073 1 Seacms 1 Seacms 2025-06-12 N/A 9.8 CRITICAL
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
CVE-2024-12595 1 Mitchelllevy 1 Ahathat 2025-06-12 N/A 4.7 MEDIUM
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVE-2024-11645 1 Computy 1 Float Block 2025-06-12 N/A 4.8 MEDIUM
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-11605 1 Wp-publications Project 1 Wp-publications 2025-06-12 N/A 4.8 MEDIUM
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-10103 1 Automattic 1 Mailpoet 2025-06-12 N/A 6.1 MEDIUM
In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVE-2024-6270 1 Community Events Project 1 Community Events 2025-06-12 N/A 4.8 MEDIUM
The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-11269 1 Mitchelllevy 1 Ahathat 2025-06-12 N/A 7.2 HIGH
The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.
CVE-2024-11267 1 Joomlaserviceprovider 1 Jsp Store Locator 2025-06-12 N/A 8.8 HIGH
The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
CVE-2025-2048 1 Lana 1 Lana Downloads Manager 2025-06-12 N/A 4.1 MEDIUM
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
CVE-2024-12736 1 Bu 1 Bu Section Editing 2025-06-12 N/A 6.1 MEDIUM
The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-11606 1 Tabs Shortcode Project 1 Tabs Shortcode 2025-06-12 N/A 5.3 MEDIUM
The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2024-8085 1 Solidcode 1 Peoplepond 2025-06-12 N/A 6.1 MEDIUM
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-8082 1 Justintadlock 1 Widgets Reset 2025-06-12 N/A 4.3 MEDIUM
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-8050 1 Jfarthing 1 Custom Author Base 2025-06-12 N/A 4.3 MEDIUM
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-8032 1 Ulfbenjaminsson 1 Smooth Gallery Replacement 2025-06-12 N/A 6.1 MEDIUM
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.