CVEs published in July 2023
2,375 vulnerabilities, 275 critical, 16 exploited.
- wpeasycart wp easycart, levelfourstorefront shopping cart & ecommerce store +1 moreWP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'7.2 High
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup5.4 Medium
- hookandhook coming soon & maintenance mode page & under construction, wpconcern coming soon \& maintenance mode page +1 moreComing Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery Bypass4.3 Medium
- d3wp about me 3000 widget, wpmaniax about me 3000 +1 moreAbout Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update4.3 Medium
- inspireui mstore api, mstore api – create native android & ios apps on the cloud +1 moreMStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update4.3 Medium
- photoboxone smtp mailSMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject7.2 High
- billerickson gallery metabox, gallery-metabox project gallery-metabox +1 moreGallery Metabox <= 1.5 - Missing Authorization via refresh_metabox4.3 Medium
- instareza mail control, rahalaboulfeth mail control – email customizer, smtp deliverability, logging, open and click tracking +1 moreMail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject7.2 High
- unknown wp mail logWP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email7.2 High
- yaycommerce yaysmtp, yaysmtp and email logs: amazon ses, sendgrid, outlook, mailgun, brevo, google and any smtp service +1 moreYaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email7.2 High
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePost SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email7.2 High
- msh134 wp reroute email, wp reroute email project reroute email +1 moreWP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject7.2 High
- armemberplugin armember, reputeinfosystems armember – membership plugin, content restriction, member levels, user profile & user signup +1 moreARMember <= 4.0.5 - Cross-Site Request Forgery6.5 Medium
- getnet argentina para woocommerce project argentina para woocommerce, wanderlustcodes getnet argentina para woocommerce +1 moreThe Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass...7.5 High
- oacstudio mailtree log mailMailtree Log Mail <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject7.2 High
- learndash, stellarwp learndash lms +1 moreLearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change8.8 High
- dev4press gd mail queueGD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email7.2 High
- jamesward wp mail catcher, james ward mail logging – wp mail catcher +1 moreWP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject7.2 High
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass5.4 Medium
- fkrauthan wp-mpdfwp-mpdf <= 3.5.1 - Cross-Site Request Forgery Bypass4.3 Medium
- sunshinephotocart sunshine photo cart, sunshine photo cart – client photo gallery & photo proofing for photographers +1 moreSunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass4.3 Medium
- tyche softwares abandoned cart lite for woocommerceAbandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass4.3 Medium
- coolplugins process steps template designerProcess Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass4.3 Medium
- abrg wp prayerWP Prayer <= 1.6.5 - Cross-Site Request Forgery Bypass4.3 Medium
- wpeasypay wp easypay, saadiqbal wp easy pay – payment and donation form builder for square +1 moreWP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass4.3 Medium
- carlos a sanz qtranslate slug, qtranslate slug project slug +1 moreQtranslate Slug <= 1.1.18 - Cross-Site Request Forgery Bypass4.3 Medium
- exportfeed woocommerce etsy integration, purpleturtlepro etsy integration for woocommerce +1 moreWooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass4.3 Medium
- designwall dw question & answer, dw question \& answer +1 moreDW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass4.3 Medium
- ghuger custom bannersCustom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass4.3 Medium
- ewww image optimizer, exactly www ewww image optimizer +1 moreEWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass4.3 Medium
- simple online piggery management system project online piggery management systemOnline Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). An...6.1 Medium
- simple online piggery management system project online piggery management systemOnline Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can...9.8 Critical
- simple online piggery management system project online piggery management systemOnline Piggery Management System 1.0 is vulnerable to SQL Injection.9.8 Critical
- code-projects online restaurant management systemCode-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL...9.8 Critical
- keepersecurity keeper, keeperfill +1 moreAn issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the...5.5 Medium
- digiexamDigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access...9.8 Critical
- voltronicpower snmp web proThe authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows...9.8 Critical
- rizinAn issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0...5.5 Medium
- syncfusion ej2 aspcore file providerThe Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs...9.8 Critical
- syncfusion nodejs file system providerThe Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory...9.8 Critical
- mikrotik routerosAn issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of...7.5 High
@vendure/corenpmVendure Cross Site Request Forgery vulnerability impacting all API requestsNo scoregithub.com/jaegertracing/jaegerGoA stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries6.5 Medium- citrix secure access client for ubuntu, secure access client +1 moreA vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if...9.6 Critical
- citrix secure access client for windows, secure access client +1 moreA vulnerability has been discovered in the Citrix Secure Access client for Windows which, if...7.8 High
- johnson controls, inc istar ultra, sensormatic electronics, a subsidiary of johnson controls, inc. istar edge g2, istar ultra g2 +5 more +7 moreImproper Authentication in iSTAR7.5 High
- advcomsys.com onevote component for joomla, advcomsys onevote\! +1 moreExtension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.06.1 Medium
- go standard library net/http, golang go +1 moreInsufficient sanitization of Host header in net/http6.5 Medium
github.com/malfunkt/iprangeGoiprange may panic when parsing ranges with invalid masksNo score- Show moreLoading…