CVEs published in December 2022
2,895 vulnerabilities, 265 critical, 5 exploited.
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion6.5 Medium
- unknown wp tools increase maximum limits, repair, server php info, javascript errors, file permissions, transients, error log, wptools project wptools +1 moreWPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation5.7 Medium
- antihacker project antihacker, sminozzi disable json api, login lockdown, xmlrpc, pingback, stop user enumeration anti hacker scan +1 moreAntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation6.5 Medium
- hassantafreshi easy form builderEasy Form Builder < 3.4.0 - Admin+ Stored XSS4.8 Medium
- car dealer project dealer, unknown car dealer (dealership) and vehicle sales wordpress plugin +1 moreCar Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation6.5 Medium
- unknown directoristDirectorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR6.5 Medium
- unknown image hover effectsImage Hover Effects < 5.5 - Admin+ Stored XSS4.8 Medium
- dpdbaltics dpd baltic shipping, dpdgroup woocommerce shipping +1 moreWooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion8.1 High
- getyourguide ticketing project ticketing, unknown getyourguide ticketing +1 moreGetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS4.8 Medium
- unknown booking calendar, appointment booking system, wpdevart booking calendar +1 moreBooking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown wp csv exporter, wp csv exporter project csv exporter +1 moreWP CSV Exporter < 1.3.7 - CSV Injection7.8 High
- unknown supra csv, supra-csv-parser project supra-csv-parser +1 moreSupra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRF5.4 Medium
- unknown icegram express, icegram email subscribers \& newsletters +1 moreIcegram Express < 5.5.1 - Subscriber+ SQLi8.8 High
- dokanDokan < 3.7.6 - Unauthenticated SQLi9.8 Critical
- donation button project button, unknown donation button +1 moreDonation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam4.3 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting5.4 Medium
- automattic jetpack crmJetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting4.8 Medium
- mehanoid flat pm, mehanoid.pro flatpm +1 moreFlat PM < 3.0.13 - Reflected Cross-Site Scripting5.4 Medium
- donation button project button, unknown donation button +1 moreDonation Button <= 4.0.0 - Contributor+ Stored XSS5.4 Medium
- buddybadges project buddybadgesBuddybadges <= 1.0.0 - Admin+ SQLi7.2 High
- g5theme essential real estateEssential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting5.4 Medium
- sminozzi block bad bots and stop bad bots crawlers and spiders and anti spam protection, stopbadbots project stopbadbots +1 moreStopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation6.5 Medium
- unknown all-in-one security (aios), updraftplus all-in-one security +1 moreAll In One WP Security & Firewall < 5.0.8 - IP Spoofing5.3 Medium
- unknown user registrationUser Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload7.5 High
- unknown memory usage, memory limit, php and server memory health check and fix plugin, wp-memory project wp-memory +1 moreWP Memory < 2.46 - Subscriber+ Arbitrary Plugin Installation6.5 Medium
- helloprint, helloprint plug your woocommerce into the largest catalog of customized print products from helloprint +1 moreHelloprint < 1.4.7 - Reflected Cross-Site Scripting6.1 Medium
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection8.8 High
- arc informatique pcvueA cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through...5.5 Medium
- arc informatique pcvueAn insertion of sensitive information into log file vulnerability exists in PcVue versions 15...4.7 Medium
- ifm moneo appliance, moneo qha200 firmware, moneo qha210 firmware +2 moreWeak Password Recovery in ifm moneo appliance9.8 Critical
- sap business objects business intelligence platform, business objects platform (monitoring db) +1 moreUnder certain conditions, an attacker authenticated as a CMS administrator and with high...6.0 Medium
squid3Ubuntusquid3 regressionNo score- sqlite, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreSQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not...7.3 High
- websoft hcmInsufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated...5.4 Medium
- websoft hcmInsufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated...6.1 Medium
- websoft hcmInsufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated...5.4 Medium
- websoft hcmInsufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated...5.4 Medium
- tenda w20e firmwareTenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow.7.2 High
- tenda w20e firmwareTenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.7.2 High
- tenda ax12 firmwareTenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via ...8.8 High
- tenda ax12 firmwareTenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at ...7.5 High
- tenda ax12 firmwareTenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform...8.8 High
- alistgo alistAlist Cross-site Scripting vulnerability5.4 Medium
- alistgo alistAList vulnerable to Improper Preservation of Permissions8.8 High
- zte zxhn-h108ns firmwareZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote...7.5 High
- boaBoa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint...5.3 Medium
- sens project sensSENS v1.0 is vulnerable to Incorrect Access Control vulnerability.8.8 High
- sens project sensSENS v1.0 has a file upload vulnerability.8.8 High
- sens project sensSENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller...5.4 Medium
- sens project sensSENS v1.0 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- Show moreLoading…