Sat, Jun 20 · 02:16 PM CDTCVE-2019-25763
9.8/10 · Must read/watchNVDvuln
Summary
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a vali
CVECVE-2019-25763
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jun 20 · 02:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2020-37239
9.8/10 · Must read/watchNVDvuln
Summary
libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature fiel
CVECVE-2020-37239
SeverityCRITICAL
TypeUPDATED
PublishedSat, May 16 · 04:16 PM CDT
ModifiedTue, Sep 29 · 10:10 AM CDT
CVE-2022-50972
9.8/10 · Must read/watchNVDvuln
Summary
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PH
CVECVE-2022-50972
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jun 20 · 02:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2024-44659
9.8/10 · Must read/watchNVDvuln
Summary
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php.
CVECVE-2024-44659
SeverityCRITICAL
TypeUPDATED
PublishedMon, Nov 17 · 08:15 PM CST
ModifiedMon, Sep 28 · 02:10 PM CDT
CVE-2025-65823
9.8/10 · Must read/watchNVDvuln
Summary
The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Additionally, if an attacker w
CVECVE-2025-65823
SeverityCRITICAL
TypeUPDATED
PublishedWed, Dec 10 · 09:16 PM CST
ModifiedMon, Sep 28 · 10:10 PM CDT
CVE-2025-62023
9.0/10 · Must read/watchNVDvuln
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.
CVECVE-2025-62023
SeverityCRITICAL
TypeUPDATED
PublishedWed, Oct 22 · 03:16 PM CDT
ModifiedTue, Sep 29 · 07:16 AM CDT
CVE-2026-16526
8.8/10 · Worth your timeNVDvuln
Summary
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
CVECVE-2026-16526
SeverityHIGH
TypeUPDATED
PublishedThu, Jul 30 · 06:25 AM CDT
ModifiedMon, Sep 28 · 10:17 PM CDT
CVE-2025-20315
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper handling of malformed Control and Provisioning of
CVECVE-2025-20315
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 24 · 06:15 PM CDT
ModifiedMon, Sep 28 · 03:18 PM CDT
CVE-2026-20084
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series Swit
CVECVE-2026-20084
SeverityHIGH
TypeUPDATED
PublishedWed, Mar 25 · 04:16 PM CDT
ModifiedMon, Sep 28 · 03:18 PM CDT
CVE-2026-20263
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP request. An attacker cou
CVECVE-2026-20263
SeverityHIGH
TypeUPDATED
PublishedWed, Aug 05 · 05:16 PM CDT
ModifiedMon, Sep 28 · 03:18 PM CDT
CVE-2020-37242
8.2/10 · Worth your timeNVDvuln
Summary
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET parameter. Attackers can send crafted requests to the getListForTbl action with boolean-based blind or time-based blind SQL inj
CVECVE-2020-37242
SeverityHIGH
TypeUPDATED
PublishedSat, May 16 · 04:16 PM CDT
ModifiedTue, Sep 29 · 10:10 AM CDT
CVE-2020-37243
8.2/10 · Worth your timeNVDvuln
Summary
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that e
CVECVE-2020-37243
SeverityHIGH
TypeUPDATED
PublishedSat, May 16 · 04:16 PM CDT
ModifiedTue, Sep 29 · 10:10 AM CDT
CVE-2020-37244
8.2/10 · Worth your timeNVDvuln
Summary
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database infor
CVECVE-2020-37244
SeverityHIGH
TypeUPDATED
PublishedSat, May 16 · 04:16 PM CDT
ModifiedTue, Sep 29 · 10:10 AM CDT
CVE-2026-42013
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-
CVECVE-2026-42013
SeverityHIGH
TypeUPDATED
PublishedTue, May 26 · 10:16 PM CDT
ModifiedTue, Sep 29 · 01:16 AM CDT
CVE-2026-5260
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
CVECVE-2026-5260
SeverityHIGH
TypeUPDATED
PublishedTue, May 26 · 10:16 PM CDT
ModifiedTue, Sep 29 · 01:16 AM CDT
CVE-2026-73624
8.1/10 · Worth your timeNVDvuln
Summary
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process priv
CVECVE-2026-73624
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 13 · 12:17 PM CDT
ModifiedMon, Sep 28 · 06:42 PM CDT
CVE-2016-20085
7.8/10 · Worth your timeNVDvuln
Summary
Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem
CVECVE-2016-20085
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 10:10 AM CDT
CVE-2016-20086
7.8/10 · Worth your timeNVDvuln
Summary
Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and restart the service to execute code with LocalSystem privileges.
CVECVE-2016-20086
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20087
7.8/10 · Worth your timeNVDvuln
Summary
Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during service startup or system
CVECVE-2016-20087
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20088
7.8/10 · Worth your timeNVDvuln
Summary
Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.
CVECVE-2016-20088
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20089
7.8/10 · Worth your timeNVDvuln
Summary
Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be executed with elevated
CVECVE-2016-20089
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20090
7.8/10 · Worth your timeNVDvuln
Summary
Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon serv
CVECVE-2016-20090
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20091
7.8/10 · Worth your timeNVDvuln
Summary
Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious executables in the service path. Attackers can place executable files in unquoted path directories that the wfcs.exe service will execute with LocalSystem privileges
CVECVE-2016-20091
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20092
7.8/10 · Worth your timeNVDvuln
Summary
NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or system reboot, resulting
CVECVE-2016-20092
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
CVE-2016-20093
7.8/10 · Worth your timeNVDvuln
Summary
Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allowing local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that execute during service
CVECVE-2016-20093
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 03:16 PM CDT
ModifiedTue, Sep 29 · 09:10 AM CDT
