CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4083 matches found

Rapid7 Vulnerability Database (full)•added 2025/10/08 12:00 a.m.•6 views

CVE-2025-10494: External Control of File Name or Path

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with...

8.1CVSS6.3AI score0.00493EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2025/10/08 12:00 a.m.•2 views

CVE-2025-10635: Undefined Security Weakness

The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks...

7.7CVSS5.8AI score0.00326EPSS

SaveExploits0References1

Rapid7 Vulnerability Database (full)•added 2025/10/08 12:00 a.m.•7 views

CVE-2025-10587: Improper Neutralization of Special Elements used in an SQL Command

The Community Events plugin for WordPress is vulnerable to SQL Injection via the eventcategory parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

9.8CVSS5.8AI score0.00392EPSS

SaveExploits1References2

EUVD•added 2025/10/07 12:30 a.m.•9 views

EUVD-2020-30786

Malware in sbrugna...

6.3CVSS6.4AI score0.00354EPSS

SaveExploits0References3

Rapid7 Vulnerability Database (full)•added 2025/10/04 12:00 a.m.•3 views

CVE-2025-8726: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppauserupload function. This makes it possible for authenticated attackers, with Subscriber-level...

5.4CVSS6.1AI score0.0021EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2025/10/04 12:00 a.m.•9 views

CVE-2025-9243: Missing Authorization

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the getccorders and updateorderstatus functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with...

8.1CVSS5.8AI score0.00306EPSS

SaveExploits0References2

EUVD•added 2025/10/03 8:07 p.m.•18 views

EUVD-2024-32436