CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- donations project donationsDonations <= 1.8 - Unauthenticated SQLi9.8 Critical
- usersultra users ultra, unknown users ultra membership, users community and member profiles with paypal integration plugin +1 moreUsers Ultra <= 3.1.0 - Unauthenticated SQL Injection9.8 Critical
- devbunch master elementsMaster Elements <= 8.0 - Unauthenticated SQLi9.8 Critical
- 5 stars rating funnel project stars rating funnel, unknown 5 stars rating funnel wordpress plugin | rratingg +1 more5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi9.8 Critical
- unknown web to print shop : udraw, webtoprint web to print shop\ +1 moreuDraw < 3.3.3 - Unauthenticated Arbitrary File Access7.5 High
- blair williams thirstyaffiliates, caseproof thirstyaffiliates affiliate link manager +1 moreThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF4.3 Medium
- flothemes flo-launchFlo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover9.8 Critical
- caseproof thirstyaffiliates affiliate link managerThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation5.4 Medium
- saad iqbal mycredmyCred < 2.4.4 - Subscriber+ Arbitrary Post Creation4.3 Medium
- saad iqbal mycredMycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure4.3 Medium
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager < 4.24 - Subscriber+ Shell Upload8.8 High
- supsystic pricing table by supsystic, price table +1 morePricing Table by Supsystic < 1.9.5 - Reflected Cross-Site Scripting6.1 Medium
- subsystic coming soon, supsystic coming soon by supsystic +1 moreComing Soon by Supsystic < 1.7.6 - Reflected Cross-Site Scripting6.1 Medium
- supsystic easy google mapsEasy Google Maps < 1.9.32 - Reflected Cross-Site Scripting6.1 Medium
- english wordpress admin project wordpress admin, unknown english wordpress admin +1 moreEnglish WordPress Admin < 1.5.2 - Unauthenticated Open Redirect6.1 Medium
- brandexponents tatsuTatsu < 3.3.12 - Unauthenticated RCE8.1 High
- advanced page visit counter project page visit counter, unknown advanced page visit counter – advanced wordpress visit counter +1 moreAdvanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection8.8 High
- designwall dw question \& answer, unknown dw question answer pro +1 moreDW Question & Answer Pro <= 1.3.4 - Multiple CSRF4.3 Medium
- designwall dw question \& answer, unknown dw question answer pro +1 moreDW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR4.3 Medium
- tenda ax12 firmwareTenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the...6.5 Medium
- tenda ax12 firmwareTenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the...6.5 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via web content template names6.1 Medium
- ibm planning analytics workspaceIBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files...6.8 Medium
- ibm planning analytics workspaceIBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not...6.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via the site name6.1 Medium
saltSUSERecommended update for SaltNo score- canon irisnextThe BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the...8.8 High
- ejsejs template injection vulnerability9.8 Critical
- online sports complex booking system project sports complex booking systemSCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting...6.1 Medium
- online sports complex booking system project sports complex booking systemSCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion...9.8 Critical
- gibbon project gibbonServer side request forgery in gibbon9.8 Critical
- giflib project giflib, fedoraproject fedora +1 moreThere is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.5.5 Medium
- xpdfreader xpdfxpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker...5.5 Medium
- typemillTypemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload...8.8 High
- jizhicmsJizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via ...9.8 Critical
- gallerycms project gallerycmsA stored cross-site scripting (XSS) vulnerability in /index.php/album/add of GalleryCMS v2.0...5.4 Medium
- hooskXSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via...6.1 Medium
- element-pluselement-plus vulnerable to cross-site scripting (XSS) via el-table-column6.1 Medium
- veryfitpro project veryfitproVeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and...7.8 High
- terra-master tosAn authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210...8.8 High
- terra-master tosIt is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2...9.8 Critical
- terra-master tosIt is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS...7.5 High
- open-emr openemr, openemr openemr/openemr +1 moreNon Privilege User can Enable or Disable Registered in openemr/openemr8.1 High
- f-secure atlant, all f-secure endpoint protection products on windows and mac f-secure linux security (32-bit) f-secure linux security 64 f-secure atlant f-secure internet gatekeeper f-secure cloud protection for salesforce +1 moreDenial-of-Service (DoS) Vulnerability4.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreNon-Privilege User Can View Patient’s Disclosures in openemr/openemr8.3 High
- open-emr openemr, openemr openemr/openemr +1 moreStored XSS Leads To Session Hijacking in openemr/openemr7.3 High
- facturascripts, neorazorx neorazorx/facturascripts +1 moreStore XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts9.0 Critical
- corebootAn issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM...9.8 Critical
- articatech web proxyThere is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255,...8.1 High
- universis universis-apiA SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select...8.1 High
- Show moreLoading…