Results
90,429· Page 362/1809Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
Author SQL Injection in WP ERP <= 1.17.9 versions.
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacke
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiP
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 v
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the N
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, le
Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisof
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unaut
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed du
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be trea
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Test your stack for 2026issues
CyberStrike tests your own apps and APIs, then verifies each finding before you see it.