Export limit exceeded: 11989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15758 | 2 Iberezansky, Wordpress-extensions | 2 3d Flipbook, 3d Flipbook | 2026-11-13 | 5.3 Medium |
| The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks. | ||||
| CVE-2026-16593 | 1 Wordpress-extensions | 1 Wp Directory Kit | 2026-11-13 | 6.8 Medium |
| The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered. | ||||
| CVE-2026-16592 | 1 Wordpress-extensions | 1 Wp Directory Kit | 2026-11-13 | 2.7 Low |
| The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users. | ||||
| CVE-2026-18232 | 1 Wordpress-extensions | 1 Wp Directory Kit | 2026-11-13 | 5.3 Medium |
| The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users. | ||||
| CVE-2026-15402 | 2 Arraytics, Wordpress-extensions | 2 Eventin, Eventin | 2026-11-13 | 6.4 Medium |
| The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75983 | 2 Arraytics, Wordpress-extensions | 2 Eventin, Eventin | 2026-11-13 | 7.5 High |
| The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs. | ||||
| CVE-2026-75092 | 2 Red Hat, Redhat | 6 Enterprise Linux, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Openstack Platform 17.1 and 3 more | 2026-11-13 | 7.3 High |
| A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation. When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). The attack does not require write access to the default system plugin path under /usr; redirecting plugin_dir via mysql-owned persisted state is sufficient. Ordinary SQL privileges alone (including highly privileged SQL accounts) are not a sufficient startpoint — OS-level execution as the mysql service identity is required, plus later administrator invocation of Leapp. | ||||
| CVE-2026-87792 | 2 Developers Italia, Wordpress-extensions | 2 Design-scuole-wordpress-theme, Design-scuole-wordpress-theme | 2026-11-13 | N/A |
| The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation. | ||||
| CVE-2026-87793 | 2 Developers Italia, Wordpress-extensions | 2 Design-scuole-wordpress-theme, Design-scuole-wordpress-theme | 2026-11-13 | N/A |
| The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter. | ||||
| CVE-2026-87161 | 2 Oracle, Oracle Corporation | 3 Hrms, Human Resources Management System, Oracle Hrms (india) | 2026-11-13 | 8.5 High |
| Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (India). While the vulnerability is in Oracle HRMS (India), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). | ||||
| CVE-2026-14349 | 2 Themetechmount, Wordpress-extensions | 2 Truebooker, Truebooker | 2026-11-13 | 9.8 Critical |
| The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it. | ||||
| CVE-2026-76550 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 7.2 High |
| The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution. | ||||
| CVE-2026-76551 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 7.2 High |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution. | ||||
| CVE-2026-76552 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 8.8 High |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution. | ||||
| CVE-2026-76553 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 6.5 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root. | ||||
| CVE-2026-76555 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 6.8 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds. | ||||
| CVE-2026-76556 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 6.8 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks. | ||||
| CVE-2026-76557 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 6.8 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks. | ||||
| CVE-2026-76558 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 6.8 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen. | ||||
| CVE-2026-76559 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-11-13 | 4.1 Medium |
| The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397. | ||||