All CVEs — page 554 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated users to perform SQL injection attacks due to insufficient parameter sanitization in the VikRentItems plugin before 1.2.4, potentially leading to data compromise.
The flaw allows unauthenticated users to update settings in the Master Blocks WordPress plugin, leading to Stored XSS that can be executed in the session of any administrator visiting a wp-admin page.
The flaw in UsersWP 1.5.0 to 1.5.9 allows unauthenticated attackers to log in as any user by asserting ownership of an email address through a social login provider, potentially compromising administrator accounts.
This flaw allows unauthenticated users to update WordPress options and store executable scripts, leading to potential full site takeover and privilege escalation.
The flaw allows unauthenticated attackers to inject JavaScript into the page title, potentially leading to cross-site scripting (XSS) attacks.
The flaw allows any authenticated user to configure the Unbounce Landing Pages plugin to serve arbitrary content from a host they control, leading to potential data leakage and unauthorized access.
This vulnerability allows for a buffer overflow through the manipulation of the submit-url argument in the formWlWds function of the Totolink A3002MU Hh-B20211125.1046 device, enabling remote code execution.
The flaw allows authenticated attackers with Contributor-level access or higher to invoke arbitrary PHP functions, potentially disclosing sensitive information or enabling server-side abuse.
The flaw allows unauthenticated attackers to execute arbitrary shortcodes, leading to potential remote code execution.