All CVEs — page 636 of 678
The complete archive, 25 per page, newest first. 16938 records. Search instead.
A SQL injection vulnerability in the Newsletters plugin allows authenticated administrators to execute arbitrary database queries, potentially leading to full system compromise. This affects versions 4.18 and earlier.
A SQL injection vulnerability exists in WP Maps plugin versions up to 4.9.9, allowing authenticated administrators to execute arbitrary SQL commands. This flaw enables attackers who have gained admin access to escalate their privileges or manipulate database content.
This flaw allows SQL injection in the Product Feed Manager, enabling attackers to execute arbitrary SQL commands, potentially leading to data theft or corruption.
This flaw allows unauthenticated users to exploit broken authentication mechanisms in Headless Single Sign On versions 1.7.0 and earlier, leading to unauthorized access to sensitive resources.
The flaw allows unauthenticated attackers to execute arbitrary code on the server, leading to full control over the system.
The flaw is an unauthenticated broken authentication vulnerability in EduAdmin Booking versions 5.4.2 and earlier, allowing attackers to bypass authentication mechanisms and gain unauthorized access to the system.
The flaw allows authenticated users to write files outside the storage root, potentially overwriting arbitrary files. This can lead to data loss or corruption.
The flaw allows attackers with log:view permission to read session tokens from the audit log, which can be used to gain full user access.