Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2017-20210 2025-11-11 N/A 0.0 Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
CVE-2025-5317 2025-11-11 N/A 0.0 An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall…
CVE-2025-9524 2025-11-11 MEDIUM 4.3 The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with…
CVE-2025-9055 2025-11-11 MEDIUM 6.4 The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating…
CVE-2025-8998 2025-11-11 LOW 3.1 It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be…
CVE-2025-7429 2025-11-11 HIGH 7.3 Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVE-2025-10714 2025-11-11 HIGH 8.4 AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited…
CVE-2025-8108 2025-11-11 MEDIUM 6.7 An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device…
CVE-2025-6779 2025-11-11 MEDIUM 6.7 An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device…
CVE-2025-6571 2025-11-11 MEDIUM 6.0 A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
CVE-2025-6298 2025-11-11 MEDIUM 6.7 ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured…
CVE-2025-5718 2025-11-11 MEDIUM 6.8 The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation…
CVE-2025-5454 2025-11-11 MEDIUM 6.4 An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the…
CVE-2025-5452 2025-11-11 MEDIUM 6.6 A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This…
CVE-2025-4645 2025-11-11 MEDIUM 6.7 An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to…
CVE-2025-11855 2025-11-11 N/A 0.0 The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a…
CVE-2025-11307 2025-11-11 N/A 0.0 The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS…
CVE-2025-11237 2025-11-11 N/A 0.0 The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a…
CVE-2025-12880 2025-11-11 MEDIUM 5.4 The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due…
CVE-2025-12813 2025-11-11 CRITICAL 9.8 The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is…
CVE-2025-12754 2025-11-11 MEDIUM 6.4 The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This…
CVE-2025-12753 2025-11-11 MEDIUM 6.4 The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to…
CVE-2025-12711 2025-11-11 MEDIUM 6.4 The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to…
CVE-2025-12672 2025-11-11 MEDIUM 6.4 The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5…
CVE-2025-12671 2025-11-11 MEDIUM 6.4 The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to…
CVE-2025-12668 2025-11-11 MEDIUM 6.4 The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including,…
CVE-2025-12667 2025-11-11 MEDIUM 6.4 The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including,…
CVE-2025-12665 2025-11-11 MEDIUM 4.3 The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint…
CVE-2025-12663 2025-11-11 MEDIUM 6.4 The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including,…
CVE-2025-12662 2025-11-11 MEDIUM 6.4 The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including,…
CVE-2025-12658 2025-11-11 MEDIUM 6.4 The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including,…
CVE-2025-12652 2025-11-11 MEDIUM 6.4 The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1.…
CVE-2025-12651 2025-11-11 MEDIUM 6.4 The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions…
CVE-2025-12644 2025-11-11 MEDIUM 6.4 The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up…
CVE-2025-12637 2025-11-11 HIGH 8.8 The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up…
CVE-2025-12632 2025-11-11 MEDIUM 5.5 The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and…
CVE-2025-12631 2025-11-11 MEDIUM 4.4 The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input…
CVE-2025-12590 2025-11-11 MEDIUM 6.1 The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing…
CVE-2025-12589 2025-11-11 MEDIUM 6.1 The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing…
CVE-2025-12588 2025-11-11 MEDIUM 4.3 The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to…
CVE-2025-12538 2025-11-11 MEDIUM 4.4 The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization…
CVE-2025-12526 2025-11-11 MEDIUM 4.3 The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions up…
CVE-2025-12132 2025-11-11 MEDIUM 4.3 The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to…
CVE-2025-12126 2025-11-11 MEDIUM 5.4 The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to…
CVE-2025-12021 2025-11-11 MEDIUM 6.1 The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization…
CVE-2025-12020 2025-11-11 MEDIUM 4.9 The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all…
CVE-2025-12019 2025-11-11 MEDIUM 4.4 The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization…
CVE-2025-12010 2025-11-11 MEDIUM 6.5 The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode…
CVE-2025-11999 2025-11-11 MEDIUM 5.3 The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in…
CVE-2025-11997 2025-11-11 MEDIUM 5.3 The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due…
« Anterior Página 304 de 3934 Siguiente »