CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

9278 matches found

Cvelist•added 2022/03/14 2:41 p.m.•32 views

CVE-2021-24958 Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could...

5.5AI score0.006EPSS

SaveExploits2References1

Patchstack•added 2022/03/14 12:00 a.m.•9 views

WordPress Easy Social Icons plugin <= 3.1.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Easy Social Icons plugin versions = 3.1.4. Solution Update the WordPress Easy Social Icons plugin to the latest available version at least 3.2.0...

2.9AI score

SaveExploits0References1Affected Software1

Positive Technologies•added 2022/03/14 12:00 a.m.•8 views

PT-2022-9528

Name of the Vulnerable Software and Affected Versions Meks Easy Photo Feed Widget WordPress plugin versions prior to 1.2.4 Description The issue concerns a lack of capability and CSRF checks in the meks save business selected account AJAX action, which is accessible to any authenticated user...

5.4CVSS0.006EPSS

SaveExploits2References3

Rapid7 Vulnerability Database (full)•added 2022/03/14 12:00 a.m.•9 views

CVE-2021-24958: Improper Neutralization of Input During Web Page Generation

5.4CVSS6AI score0.006EPSS

SaveExploits2References3

Openbugbounty•added 2022/03/10 5:41 p.m.•8 views

easy-flex.nl Improper Access Control vulnerability OBB-2422472

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

0.1AI score

SaveExploits0

Positive Technologies•added 2022/03/09 12:00 a.m.•5 views

PT-2022-13206

Name of the Vulnerable Software and Affected Versions alextselegidis/easyappointments versions prior to 1.4.3 Description The issue concerns exposure of private personal information to an unauthorized actor due to a Broken Access Control vulnerability in the Easy Appointments plugin. This...

9.1CVSS0.43746EPSS

SaveExploits7References16

CNNVD•added 2022/03/09 12:00 a.m.•23 views

Easy!Appointments 安全漏洞

Easy!Appointments is a web-based appointment and schedule management system. There is a security vulnerability in Easy!Appointments, no information about the vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

9.1CVSS8.2AI score0.43746EPSS

SaveExploits7References9

wpexploit•added 2022/03/08 12:00 a.m.•152 views

Easy Social Icons < 3.1.4 - Admin+ SQL Injection

The plugin does not sanitize the selectedicons attribute to the cnsswidget before using it in an SQL statement, leading to a SQL injection vulnerability. Author : Qerogram import requests from bs4 import BeautifulSoup BASEURL = "http://localhost:8000" id = "wordpress" pw = "wordpress" def loginid...

7.2CVSS0.7AI score0.0131EPSS

SaveExploits2

Patchstack•added 2022/03/08 12:00 a.m.•37 views

WordPress Easy Social Icons plugin <= 3.1.3 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by qerogram in WordPress Easy Social Icons plugin versions = 3.1.3. Solution Update the WordPress Easy Social Icons plugin to the latest available version at least 3.1.4...

7.2CVSS3.5AI score0.0131EPSS

SaveExploits2References3Affected Software1

CVE•added 2022/02/28 9:06 a.m.•131 views

CVE-2022-0360

CVE-2022-0360 affects the WordPress plugin WP Ultimate CSV Importer (versions prior to 6.4.3). The root cause is failure to sanitise and escape imported comments, enabling stored Cross-Site Scripting (XSS) by high-privilege users who import malicious comments. Documented evidence shows an admin+ ...

4.8CVSS4.8AI score0.00647EPSS

SaveExploits2References2Affected Software1

Patchstack•added 2022/02/28 12:00 a.m.•21 views

WordPress RT Easy Builder – Advanced addons for Elementor plugin <= 1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RT Easy Builder – Advanced addons for Elementor plugin versions = 1.4. Solution Update the WordPress RT Easy Builder – Advanced addons for Elementor for PayFabric plugin to the latest available version...

3.8AI score