CVE database
94,255 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.7 High severity
nocodb: Improper Neutralization of Special Elements used in an SQL Command
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into f
- 8.8 High severity
nocodb: Incorrect Authorization
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete recor
- 8.0 High severity
nocodb: Improper Privilege Management
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read,
- 7.4 High severity
nocodb: Concurrent Execution using Shared Resource with Improper Synchronization
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the l
- 7.5 High severity
nocodb: Concurrent Execution using Shared Resource with Improper Synchronization
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt ha
- 7.5 High severity
nocodb: Allocation of Resources Without Limits or Throttling
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a
- 7.1 High severity
nocodb: Authorization Bypass Through User-Controlled Key
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read privat
- 8.7 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped in
- 8.1 High severity
nocodb: Improper Privilege Management
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on
- 7.7 High severity
nocodb: Insufficiently Protected Credentials
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers re
- 8.7 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so t
- 7.5 High severity
siyuan: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod
- 7.4 High severity
siyuan: Improper Restriction of Excessive Authentication Attempts
SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force t
- 7.7 High severity
siyuan: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/cre
- 9.8 Critical severity
Chatterbug Forms – Fast, Flexible WordPress…: Unrestricted Upload of File with Dangerous Type
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extens
- 8.2 High severity
Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthe
- 8.8 High severity
SureDash – Community, Courses & Member Dashboard: Improper Privilege Management
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `
- 7.2 High severity
EZ SQL Reports Shortcode Widget and DB Backup: Improper Neutralization of Input During Web Page Generation
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions
- 9.8 Critical severity
ELEX WordPress HelpDesk & Customer Ticketing…: Deserialization of Untrusted Data
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form st
- 8.1 High severity
Photo Gallery, Sliders, Proofing and Themes –…: Improper Limitation of a Pathname to a Restricted Directory
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possib
- 8.8 High severity
Widget Options – Advanced Conditional…: Improper Control of Generation of Code
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing b
- 7.5 High severity
PowerScale InsightIQ: Incorrect Authorization
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- 8.3 High severity
OpenKM Community Edition: Improper Restriction of XML External Entity Reference
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attac
- 8.1 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or
- 8.6 High severity
zipline: Incorrect Authorization
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration a
- 7.7 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files o
- 7.5 High severity
magento-lts: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to exe
- 8.1 High severity
PowerScale InsightIQ: Weak Password Requirements
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthori
- 8.4 High severity
Edito CMS: Deserialization of Untrusted Data
Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the se
- 7.1 High severity
Edito CMS: Unrestricted Upload of File with Dangerous Type
Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for
- 7.1 High severity
Edito CMS: Improper Neutralization of Special Elements used in an Expression Language Statement
Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the atta
- 8.7 High severity
Edito CMS: Improper Verification of Cryptographic Signature
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obt
- 9.8 Critical severity
Streamit: Improper Control of Generation of Code
The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated a
- 7.2 High severity
WP Ultimate CSV Importer: Improper Control of Generation of Code
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitra
- 9.8 Critical severity
Ahime Image Printer: Unrestricted Upload of File with Dangerous Type
The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.
- 10.0 Critical severity
Easy DragDrop File Uploader: External Control of File Name or Path
The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.
- 9.1 Critical severity
Woocommerce Wishlist: Missing Authorization
The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, bre
- 8.1 High severity
WPCOM Member: Improper Authentication
The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official
- 7.5 High severity
WooCommerce Vindi Pagamento: Improper Neutralization of Input During Web Page Generation
The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers
- 7.5 High severity
WP Remote Users Sync: Improper Privilege Management
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any exi