Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2025-41106 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-41105 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-41104 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-41103 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-10161 2025-11-11 HIGH 7.3 Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute…
CVE-2025-41102 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-41101 2025-11-11 N/A 0.0 HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending…
CVE-2025-11960 2025-11-11 MEDIUM 6.1 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS.This issue affects KVKNET: before…
CVE-2025-7633 2025-11-11 HIGH 7.3 Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
CVE-2025-7632 2025-11-11 HIGH 7.3 Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
CVE-2025-7430 2025-11-11 HIGH 7.3 Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
CVE-2025-12953 2025-11-11 MEDIUM 4.3 The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
CVE-2025-12846 2025-11-11 HIGH 8.8 The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type…
CVE-2025-12788 2025-11-11 MEDIUM 5.3 The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and…
CVE-2025-12787 2025-11-11 MEDIUM 5.3 The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is…
CVE-2025-12539 2025-11-11 CRITICAL 10.0 The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin…
CVE-2017-20210 2025-11-11 N/A 0.0 Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
CVE-2025-5317 2025-11-11 N/A 0.0 An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall…
CVE-2025-9524 2025-11-11 MEDIUM 4.3 The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with…
CVE-2025-9055 2025-11-11 MEDIUM 6.4 The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating…
CVE-2025-8998 2025-11-11 LOW 3.1 It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be…
CVE-2025-7429 2025-11-11 HIGH 7.3 Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVE-2025-10714 2025-11-11 HIGH 8.4 AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited…
CVE-2025-8108 2025-11-11 MEDIUM 6.7 An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device…
CVE-2025-6779 2025-11-11 MEDIUM 6.7 An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device…
CVE-2025-6571 2025-11-11 MEDIUM 6.0 A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
CVE-2025-6298 2025-11-11 MEDIUM 6.7 ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured…
CVE-2025-5718 2025-11-11 MEDIUM 6.8 The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation…
CVE-2025-5454 2025-11-11 MEDIUM 6.4 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the…
CVE-2025-5452 2025-11-11 MEDIUM 6.6 A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This…
CVE-2025-4645 2025-11-11 MEDIUM 6.7 An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to…
CVE-2025-11855 2025-11-11 N/A 0.0 The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a…
CVE-2025-11307 2025-11-11 N/A 0.0 The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS…
CVE-2025-11237 2025-11-11 N/A 0.0 The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a…
CVE-2025-12880 2025-11-11 MEDIUM 5.4 The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due…
CVE-2025-12813 2025-11-11 CRITICAL 9.8 The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is…
CVE-2025-12754 2025-11-11 MEDIUM 6.4 The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This…
CVE-2025-12753 2025-11-11 MEDIUM 6.4 The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to…
CVE-2025-12711 2025-11-11 MEDIUM 6.4 The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to…
CVE-2025-12672 2025-11-11 MEDIUM 6.4 The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5…
CVE-2025-12671 2025-11-11 MEDIUM 6.4 The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to…
CVE-2025-12668 2025-11-11 MEDIUM 6.4 The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including,…
CVE-2025-12667 2025-11-11 MEDIUM 6.4 The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including,…
CVE-2025-12665 2025-11-11 MEDIUM 4.3 The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint…
CVE-2025-12663 2025-11-11 MEDIUM 6.4 The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including,…
CVE-2025-12662 2025-11-11 MEDIUM 6.4 The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including,…
CVE-2025-12658 2025-11-11 MEDIUM 6.4 The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including,…
CVE-2025-12652 2025-11-11 MEDIUM 6.4 The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1.…
CVE-2025-12651 2025-11-11 MEDIUM 6.4 The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions…
CVE-2025-12644 2025-11-11 MEDIUM 6.4 The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up…
« Anterior Página 303 de 3933 Siguiente »