CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- kevinlab 4st l-bemsA Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST...6.5 Medium
- kevinlab 4st l-bemsAn SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS...9.8 Critical
- bolt cmsCode Injection in Bolt CMS8.8 High
- jflyfox jfinal cmsJfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the...5.4 Medium
- secondlinethemes podcast importer secondlinePodcast Importer SecondLine < 1.3.8 - Admin+ SQLi7.2 High
- ocdi one click demo importOne Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload7.2 High
- advanced booking calendar booking calendar, elbtide advanced booking calendar +1 moreAdvanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting6.1 Medium
- advanced booking calendar booking calendar, elbtide advanced booking calendar +1 moreAdvanced Booking Calendar < 1.7.1 - Admin+ SQLi7.2 High
- unknown ns woocommerce watermark, nsthemes ns watermark for woocommerce +1 moreNS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality7.5 High
- unknown image optimization & lazy load by optimole, vertistudio image optimization \& lazy load by optimole +1 moreImage optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- sminozzi block bad bots and stop bad bots crawlers and spiders and anti spam protection, stopbadbots block and stop bad bots +1 moreWP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi9.8 Critical
- dimitri grassi salon booking system, unknown salon booking system pro +1 moreSalon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure7.5 High
- dimitri grassi salon booking system, unknown salon booking system pro +1 moreSalon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure5.3 Medium
- atlasgondal export all urlsExport All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF6.5 Medium
- atlasgondal export all urlsExport All URLs < 4.2 - Reflected Cross-Site Scripting6.1 Medium
- cybernetikz easy social iconsEasy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon4.8 Medium
- codename065 download managerDownload Manager < 3.2.39 - Unauthenticated brute force of files master key7.5 High
- pootlepress easy smooth scroll linksEasy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown migration, backup, staging – wpvivid, wpvivid migration\, backup\, staging +1 moreWPvivid Backup and Migration Plugin < 0.9.70 - Reflected Cross-Site Scripting6.1 Medium
- realfavicongenerator favicon by realfavicongeneratorFavicon by RealFaviconGenerator < 1.3.23 - Reflected Cross-Site Scripting6.1 Medium
- pickplugins post gridPost Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types6.4 Medium
- presscustomizr nimble page builderNimble Page Builder < 3.2.2 - Reflected Cross-Site Scripting6.1 Medium
- thimpress learnpress, learnpress – wordpress lms plugin +1 moreLearnPress < 4.1.6 - Reflected Cross-Site Scripting6.1 Medium
- unknown iq block countryiQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip4.9 Medium
- unknown portfolio gallery, product catalog – grid kit portfolio, wpsofts portfolio gallery\, product catalog - grid kit portfolio +1 moreGridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- heateor super socializer, the champ social share, social login and social comments plugin – super socializer +1 moreSuper Socializer < 7.13.30 - Reflected Cross-Site Scripting6.1 Medium
- pickplugins post gridPost Grid < 2.1.16 - Reflected Cross-Site Scripting via keyword6.1 Medium
- thedaylightstudio fuel cmsDaylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.5.4 Medium
- std42 elfinderRCE in Studio-42 elFinder on Windows before 2.1.619.8 Critical
- ivanti dsm remoteIvanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to...7.8 High
- fujitsu plugfree networkIn Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software...7.8 High
- os4ed opensisDue to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility...7.5 High
- zyxel vmg3312-t20a firmware, ax7501-b0 firmware, dx5401-b0 firmware +29 more +31 moreA potential buffer overflow vulnerability was identified in some internal functions of Zyxel...6.0 Medium
- zyxel vmg3312-t20a firmware, ax7501-b0 firmware, dx5401-b0 firmware +29 more +31 moreA command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30...8.0 High
- zyxel ap configurator (zac), ap configurator +1 moreA local privilege escalation vulnerability caused by incorrect permission assignment in some...7.3 High
- radare radare2, radareorg radareorg/radare2 +1 moreOut-of-bounds Read in r_bin_ne_get_entrypoints function in radareorg/radare26.6 Medium
- radare radare2, radareorg radareorg/radare2 +1 moreOut-of-bounds read in `r_bin_ne_get_relocs` function in radareorg/radare26.6 Medium
- alvarotrigo alvarotrigo/fullpage.js, fullpage project fullpage +1 morePrototype Pollution in alvarotrigo/fullpage.js7.3 High
- gnuboard gnuboard/gnuboard5, sir gnuboard +1 moreUse of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard58.2 High
- djangoproject django, debian linux +1 moreSQL Injection in Django9.8 Critical
- djangoproject django, debian linux +1 moreSQL Injection in Django9.8 Critical
- polonel polonel/trudesk, trudesk project trudesk +1 moreStored XSS viva .svg file upload in polonel/trudesk9.0 Critical
- autolab autolab/autolab, autolabproject autolab +1 moreCross-site Scripting (XSS) - Stored in autolab/autolab7.6 High
- webminA Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager...8.8 High
- webminA Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.6.1 Medium
- webminA Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.6.1 Medium
- webminA Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and...8.8 High
- webminA Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download...6.1 Medium
- webminA Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs...9.6 Critical
- webminA cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron...8.8 High
- Show moreLoading…