CVEs published in March 2022
2,440 vulnerabilities, 400 critical, 18 exploited.
- tribalsystems zenarioCross-site Scripting in Zenario CMS4.8 Medium
- tribalsystems zenarioUnrestricted Upload of File with Dangerous Type in Zenario CMS7.2 High
- showdoc, star7th star7th/showdoc +1 moreStored XSS viva .properties file upload in star7th/showdoc9.0 Critical
- sedlex simple quotationSimple Quotation <= 1.3.2 - Subscriber+ SQL injection8.8 High
- sedlex simple quotationSimple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site Scripting6.1 Medium
- gd-mylist project gd-mylist, unknown gdmylist +1 moreGD Mylist <= 1.1.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown petfinder listings, unboxinteractive petfinder-listings +1 morePetfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown seo 301 meta, seo-301-meta project seo-301-meta +1 moreSEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- chrsinteractive simple trackingSimple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown wp home page menu, wp home page menu project home page menu +1 moreWP Home Page Menu < 3.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- kunze-medien kunze lawKunze Law < 2.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- sync qcloud cos project qcloud cos, unknown sync qcloud cos +1 moreSync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown commonsbookingCommonsBooking < 2.6.8 - Unauthenticated SQL Injection9.8 Critical
- i13websolution team circle image slider with lightboxTeam Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting6.1 Medium
- adamskaat countdown, coming soon, maintenance – countdown & clock, edmonsoft countdown\, coming soon\, maintenance - countdown \& clock +1 moreCountdown & Clock < 2.2.9 - Reflected Cross-Site Scripting6.1 Medium
- hamid alinia login with phone numberLogin with phone number < 1.3.7 - Unauthenticated remote plugin deletion6.5 Medium
- unknown wordpress multisite content copier/updater, obtaininfotech multisite content copier\/updater +1 moreMultisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site Scripting6.1 Medium
- mage-people event manager and tickets selling for woocommerce, unknown event manager and tickets selling plugin for woocommerce +1 moreEvent Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection8.8 High
- odude flexi, flexi – guest submit +1 moreFlexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting6.1 Medium
- berocket advanced product labels for woocommerceAdvanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site Scripting6.1 Medium
- jeweltheme master addons for elementorMaster Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting6.1 Medium
- matt wp voting contestWP Voting Contest < 3.0 - Reflected Cross-Site Scripting6.1 Medium
- unknown wordpress zero spam, highfivery zero-spam +1 moreZero Spam < 5.2.11 - Admin+ SQL Injection9.8 Critical
- contact form submissions project form submissions, unknown contact form submissions +1 moreContact Form Submissions < 1.7.3 - Unauthenticated Stored XSS6.1 Medium
- bwp-google-xml-sitemaps project bwp-google-xml-sitemaps, unknown better wordpress google xml sitemaps (support sitemap index, multi-site and google news) +1 moreBetter WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- 10web photo gallery, photo gallery by 10web – mobile-friendly image gallery +1 morePhoto Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection9.8 Critical
- king-theme kingcomposer, unknown page builder: kingcomposer – free drag and drop page builder by king-theme +1 morePage Builder KingComposer <= 2.9.6 - Open Redirect6.1 Medium
- ari-soft ari fancy lightbox, unknown ari fancy lightbox – wordpress popup +1 moreARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site Scripting6.1 Medium
- cookieinformation cookie information | free gdpr consent solution, wp-gdpr-compliance +1 moreCookie Information < 2.0.8 - Reflected Cross-Site Scripting6.1 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting5.5 Medium
- molie instructure canvas linking tool project instructure canvas linking tool, unknown molie – instructure canvas linking tool +1 moreMOLIE <= 0.5 - Authenticated SQL Injection9.8 Critical
- molie instructure canvas linking tool project instructure canvas linking tool, unknown molie – instructure canvas linking tool +1 moreMOLIE <= 0.5 - Reflected Cross-Site Scripting6.1 Medium
- arni cinco wpcargo track & trace, wptaskforce wpcargo track \& trace +1 moreWPCargo < 6.9.0 - Unauthenticated RCE9.8 Critical
- unknown idpay for contact form 7IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting6.1 Medium
- html5 responsive faq project responsive faq, unknown html5 responsive faq +1 moreHTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site Scripting4.8 Medium
- childtheme-generator child theme generatorChild Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting6.4 Medium
- bestwebsoft error log viewer, error log viewer by bestwebsoft +1 moreError Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing4.9 Medium
- unknown wp email users, techspawn wp-email-users +1 moreWP Email Users <= 1.7.6 - Subscriber+ SQL Injection8.8 High
- meks easy photo feed widget, mekshq meks easy photo feed widget +1 moreMeks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS5.4 Medium
- thememove insight coreInsight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS5.4 Medium
- unknown ووکامرس فارسی, woocommerce persian-woocommerce +1 morePersian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting6.1 Medium
- unknown add subtitleAdd Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- unknown cybersoldierCybersoldier < 1.7.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- mra13 simple download monitorSimple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal6.5 Medium
- luaUse after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows...6.3 Medium
- gpacGPAC 1.0.1 is affected by Use After Free through MP4Box.5.5 Medium
- gpacGPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.7.8 High
- showdoc, star7th star7th/showdoc +1 moreStored XSS viva cshtm file upload in star7th/showdoc9.0 Critical
- showdoc, star7th star7th/showdoc +1 moreStored XSS due to Unrestricted File Upload in star7th/showdoc7.3 High
- smartertools smartertrackFile upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.140109.1 Critical
- Show moreLoading…