CVEs published in April 2021
1,956 vulnerabilities, 217 critical, 16 exploited.
- clogica seo redirection, unknown seo redirection plugin - 301 redirect manager +1 moreSEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)5.4 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id6.5 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.7.7 - SQL Injection via tutor_place_rating6.5 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation8.8 High
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form6.5 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question6.5 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct6.5 Medium
- microkid related posts for wordpress, never5 related posts +1 moreRelated Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)5.4 Medium
- filemanagerpro file managerWP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)5.4 Medium
- jh 404 logger project 404 logger, unknown jh 404 logger +1 moreJH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)5.4 Medium
- posimyth the plus addons for elementor, unknown the plus addons for elementor page builder +1 moreThe Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass9.8 Critical
- unknown database backups, database-backups project database-backups +1 moreDatabase Backups <= 1.2.2.6 - CSRF to Backup Download8.1 High
- unknown vm backups, vm backups project backups +1 moreVM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)6.1 Medium
- unknown vm backups, vm backups project backups +1 moreVM Backups <= 1.0 - CSRF to Database Backup Download4.3 Medium
- unknown woocommerce upload filesWooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- cozmoslabs user profile pictureUser Profile Picture < 2.5.0 - Sensitive Information Disclosure7.5 High
- algolplus advanced order export for woocommerceAdvanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)6.1 Medium
- easy contact form pro project contact form pro, unknown easy contact form pro +1 moreEasy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)5.4 Medium
- unknown web-statWeb-Stat < 1.4.1 - API Key Disclosure7.5 High
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.4.34 - CSRF to OAuth Service Disconnection5.4 Medium
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.4.34 - Administrator Open Redirect6.1 Medium
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure4.3 Medium
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure8.8 High
- expresstech responsive menu, responsive menu pro, responsive menu – create mobile-friendly menu +2 moreResponsive Menu < 4.0.4 - CSRF to Settings Update8.8 High
- expresstech responsive menu, responsive menu pro, responsive menu – create mobile-friendly menu +2 moreResponsive Menu < 4.0.4 - CSRF to Arbitrary File Upload8.8 High
- expresstech responsive menu, responsive menu pro, responsive menu – create mobile-friendly menu +2 moreResponsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload8.8 High
- ionuticlanzan contact form 7 style, rocklobster contact form 7 +1 moreContact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting8.8 High
- themeisle orbit fox by themeisle, orbit fox +1 moreOrbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation6.5 Medium
- themeisle orbit fox by themeisle, orbit fox +1 moreOrbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting5.4 Medium
- testimonial rotator project rotator, unknown testimonial rotator +1 moreTestimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting5.4 Medium
- backup-guard backup guard, unknown wordpress backup and migrate plugin – backup guard +1 moreBackup Guard < 1.6.0 - Authenticated Arbitrary File Upload7.2 High
- mndpsingh287 theme editorTheme Editor < 2.6 - Authenticated Arbitrary File Download4.9 Medium
- unknown yoast seo, yoast seo +1 moreYoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)5.4 Medium
- sygnoos popup builder, unknown popup builder – responsive wordpress pop up – subscription & newsletter +1 morePopup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)6.1 Medium
- unknown like button rating ♥ likebtn, likebtn-like-button project likebtn-like-button +1 moreLike Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF7.5 High
- google chrome, fedoraproject fedora +1 moreUse after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker...8.8 High
- google chrome, fedoraproject fedora +1 moreOut of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who...7.4 High
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote...8.8 High
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- aveva edge, ibm edge application manager +1 moreIBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed...5.4 Medium
- qemuIt was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access...6.5 Medium
- froala editorCross-site Scripting in Froala Editor6.1 Medium
- eng knowageA SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url...8.8 High
- eng knowageKnowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can...5.4 Medium
- eng knowageA stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject...4.8 Medium
- eng knowageKnowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject...6.1 Medium
- marktextMark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote...9.6 Critical
- Show moreLoading…