CVEs published in May 2022
2,612 vulnerabilities, 425 critical, 9 exploited.
- bootstrap-table bootstrap table, wenzhixin wenzhixin/bootstrap-table +1 moreBootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table6.8 Medium
- polonel polonel/trudesk, trudesk project trudesk +1 moreAllowing long password leads to denial of service in polonel/trudesk in polonel/trudesk7.6 High
- trend micro password manager, trend micro, inc. micro password manager +1 moreTrend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link...7.8 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreThe trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in…7.2 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreReflected XSS on ticket filter function in polonel/trudesk5.5 Medium
- jfrog artifactoryJFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of...8.8 High
- publify publify/publify, publify project publify +1 moreLeaking password protected articles content due to improper access control in publify/publify8.8 High
- diagrams drawio, jgraph jgraph/drawio +1 moreSSRF on /proxy in jgraph/drawio7.5 High
- publify publify/publify, publify project publify +1 moreCode Injection in publify/publify5.3 Medium
- publify publify/publify, publify project publify +1 moreImproper Access Control in publify/publify5.3 Medium
- diagrams drawio, jgraph jgraph/drawio +1 morePath Traversal in WellKnownServlet in jgraph/drawio7.5 High
- diagrams drawio, jgraph jgraph/drawio +1 moreSSRF in editor's proxy via IPv6 link-local address in jgraph/drawio7.5 High
- amministrazione aperta project aperta, unknown amministrazione aperta +1 moreAmministrazione Aperta < 3.8 - Admin+ LFI6.5 Medium
- cliprClipr <= 1.2.3 - Admin+ Stored Cross-Site Scripting4.8 Medium
- uleak-security-dashboard project uleak-security-dashboard, unknown uleak security & monitoring plugin +1 moreULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- unknown scrollreveal.js effects, scrollrevealjs-effects project scrollrevealjs-effects +1 moreScrollReveal.js Effects <= 1.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown wpc smart wishlist for woocommerceWPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site Scripting6.1 Medium
- callnowbutton call now buttonCall Now Button < 1.1.2 - Reflected Cross-Site Scripting6.1 Medium
- arni cinco wpcargo track & trace, wptaskforce track \& trace +1 moreWPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting6.1 Medium
- arni cinco wpcargo track & trace, wptaskforce track \& trace +1 moreWPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting4.8 Medium
- 2code wpqa builder, unknown wpqa builder plugin +1 moreWPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR4.3 Medium
- pluginmirror social stickersSocial Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRF6.1 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload7.2 High
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting4.8 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF6.5 Medium
- external media without import project media without import, unknown external media without import +1 moreExternal Media without Import <= 1.1.2 - Subscriber+ Blind SSRF6.5 Medium
- husani wp subtitle, wp subtitle project subtitle +1 moreWP Subtitle < 3.4.1 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- fusion builder project builder, theme-fusion avada, themefusion fusion builder +2 moreFusion Builder < 3.6.2 - Unauthenticated SSRF9.8 Critical
- 2code wpqa builder, unknown wpqa builder plugin +1 moreWPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR4.3 Medium
- macbookandrew wp youtube live, wp youtube live project youtube live +1 moreWP YouTube Live < 1.8.3 - Admin+ Stored Cross Site Scripting4.8 Medium
- bmi bmr calculator project bmr calculator, unknown bmi bmr calculator +1 moreBMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting6.1 Medium
- ait-pro bulletproof securityBulletProof Security < 6.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- custom tinymce shortcode button project tinymce shortcode button, unknown custom tinymce shortcode button +1 moreCustom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site Scripting6.1 Medium
- advanced image sitemap project image sitemap, unknown advanced image sitemap +1 moreAdvanced Image Sitemap <= 1.2 - Reflected Cross-Site Scripting6.1 Medium
- unknown visual slide box builder, visual slide box builder project slide box builder +1 moreVisual Slide Box Builder <= 3.2.9 - Subscriber+ SQLi8.8 High
- advanced uploader project uploader, unknown advanced uploader +1 moreAdvanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload8.8 High
- unknown bulk edit and create user profiles – wp sheet editor, wpsheeteditor bulk edit and create user profiles - wp sheet editor +1 moreBulk Edit and Create User Profiles < 1.5.14 - Admin+ Stored Cross-Site Scripting4.8 Medium
- th23 social, unknown th23 social +1 moreth23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- 2code wpqa builder, unknown wpqa builder plugin +1 moreWPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields5.4 Medium
- serhii pasyuk gmedia photo gallery, codeasily gmedia gallery +1 moreGmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- reputeinfosystems pricing table, unknown pricing table plugin +1 moreARPrice Lite < 3.6.1 - Unauthenticated SQLi9.8 Critical
- unknown agil(automatic grid image listing), wpsocket automatic grid image listing +1 moreAGIL <= 1.0 - Admin+ Arbitrary File Upload7.2 High
- accel-pppACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.7.5 High
- parallels h-sphereParallels H-Sphere 3.6.2 allows XSS via the index_en.php from parameter.6.1 Medium
- atmailatmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.6.1 Medium
- feminer wms project wmsA remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system...9.8 Critical
- totaljs total.jsA stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5...5.4 Medium
- tiddlywiki tiddlywiki5Withdrawn: Code execution via SVG file upload in tiddlywiki9.8 Critical
- graphql-upload project graphql-uploadAn arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows...9.8 Critical
- keystonejs keystoneAn arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows...9.8 Critical
- Show moreLoading…